Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges

Alerts This Week
Warning Icon 1 488
Alerts This Week
Warning Icon 1 488

Slackware 15.0: SSA:2024-275-03 critical: rpath security flaws

slackware
Calendar Grey October 1, 2024
Scroller Slackware
The latest Slackware 15.0 update tackles rpath vulnerabilities through revised packages to strengthen overall system security.
Several packages have been updated for Slackware 15.0 and -current to fix rpath security issues

Summary

Here are the details from the Slackware 15.0 ChangeLog: Several ELF objects were found to have rpaths pointing into /tmp, a world writable directory. This could have allowed a local attacker to launch denial of service attacks or execute arbitrary code when the affected binaries are run by placing crafted ELF objects in the /tmp rpath location. All rpaths with an embedded /tmp path have been scrubbed from the binaries, and makepkg has gained a lint feature to detect these so that they won't creep back in. extra/llvm-17.0.6-i586-2_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) patches/packages/cryfs-0.10.3-i586-5_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) patches/packages/espeak-ng-1.50-i586-4_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) patches/packages/libvncserver-0.9.13-i586-4_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix

Read the Full Advisory

Where Find New Packages

MD5 Signatures

Severity
critical
Lowest
Low
Medium
High
Critical

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the packages using upgradepkg or slackpkg.