ChangeLog for: 2014-02-20 01:30:49

a/kernel-firmware-20140215git-noarch-1.txz:  Upgraded.
a/kernel-generic-3.10.30-x86_64-1.txz:  Upgraded.
  These are new kernels that fix CVE-2014-0038, a bug that can allow local
  users to gain a root shell.
  Be sure to reinstall LILO (run "lilo" as root) after upgrading the kernel
  packages, or on UEFI systems, copy the appropriate kernel toi
  /boot/efi/EFI/Slackware/vmlinuz).
  For more information, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0038
  (* Security fix *)
a/kernel-huge-3.10.30-x86_64-1.txz:  Upgraded.
  These are new kernels that fix CVE-2014-0038, a bug that can allow local
  users to gain a root shell.
  Be sure to reinstall LILO (run "lilo" as root) after upgrading the kernel
  packages, or on UEFI systems, copy the appropriate kernel toi
  /boot/efi/EFI/Slackware/vmlinuz).
  For more information, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0038
  (* Security fix *)
a/kernel-modules-3.10.30-x86_64-1.txz:  Upgraded.
a/shadow-4.1.5.1-x86_64-3.txz:  Rebuilt.
  Shadow 4.1.5 addressed a tty-hijacking vulnerability in "su -c"
  (CVE-2005-4890) by detaching the controlling terminal in the non-PAM
  case via a TIOCNOTTY request.  Bi-directional protection is excessive
  and breaks a commonly-used methods for privilege escalation on non-PAM
  systems (e.g. xterm -e /bin/su -s /bin/bash -c /bin/bash myscript).
  This update relaxes the restriction and only detaches the controlling
  tty when the callee is not root (which is, after all, the threat vector).
  Thanks to mancha for the patch (and the above information).
ap/mariadb-5.5.35-x86_64-1.txz:  Upgraded.
  This update fixes a buffer overflow in the mysql command line client which
  may allow malicious or compromised database servers to cause a denial of
  service (crash) and possibly execute arbitrary code via a long server
  version string.
  For more information, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0001
  (* Security fix *)
d/kernel-headers-3.10.30-x86-1.txz:  Upgraded.
k/kernel-source-3.10.30-noarch-1.txz:  Upgraded.
  These are new kernels that fix CVE-2014-0038, a bug that can allow local
  users to gain a root shell.
  Be sure to reinstall LILO (run "lilo" as root) after upgrading the kernel
  packages, or on UEFI systems, copy the appropriate kernel toi
  /boot/efi/EFI/Slackware/vmlinuz).
  For more information, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0038
  (* Security fix *)
n/gnutls-3.1.21-x86_64-1.txz:  Upgraded.
  This update fixes a flaw where a version 1 intermediate certificate would be
  considered as a CA certificate by GnuTLS by default.
  For more information, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1959
  (* Security fix *)
xap/mozilla-firefox-27.0.1-x86_64-1.txz:  Upgraded.
isolinux/initrd.img:  Rebuilt.
kernels/*:  Upgraded.
usb-and-pxe-installers/usbboot.img:  Rebuilt.