Stay Secure with the Latest Linux Advisories

security advisorydenial of servicepackage update

Slackware 15.0: SSA:2024-275-03 critical: rpath security flaws

Several packages have been updated for Slackware 15.0 and -current to fix rpath security issues. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] rpath security issues (SSA:2024-275-03) Several packages have been updated for Slackware 15.0 and -current to fix rpath security issues. Here are the details from the Slackware 15.0 ChangeLog: +--------------------------+ Several ELF objects were found to have rpaths pointing into /tmp, a world writable directory. This could have allowed a local attacker to launch denial of service attacks or execute arbitrary code when the affected binaries are run by placing crafted ELF objects in the /tmp rpath location. All rpaths with an embedded /tmp path have been scrubbed from the binaries, and makepkg has gained a lint feature to detect these so that they won't creep back in. extra/llvm-17.0.6-i586-2_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) patches/packages/cryfs-0.10.3-i586-5_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) patches/packages/espeak-ng-1.50-i586-4_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) patches/packages/libvncserver-0.9.13-i586-4_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) patches/packages/marisa-0.2.6-i586-5_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) patches/packages/mlt-7.4.0-i586-2_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) patches/packages/openobex-1.7.2-i586-6_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) patches/packages/pkgtools-15.0-noarch-44_slack15.0.txz: Rebuilt. makepkg: when looking for ELF objects with --remove-rpaths or --remove-tmp-rpaths, avoid false hits on files containing 'ELF' as part of the directory or filename. Also warn about /tmp rpaths after the package is built. patches/packages/spirv-llvm-translator-13.0.0-i586-2_slack15.0.txz: Rebuilt. Remove rpaths frombinaries. (* Security fix *) testing/packages/llvm-18.1.8-i686-2_slack15.0.txz: Rebuilt. Remove rpaths from binaries. (* Security fix *) +--------------------------+ Installation instructions: +------------------------+ Upgrade the packages using upgradepkg or slackpkg. +-----+ . The latest Slackware 15.0 update tackles rpath vulnerabilities through revised packages to strengthen overall system security.. Slackware Security, Rpath Issues, Package Updates, Denial of Service, Security Enhancements. . Severity: Critical. LinuxSecurity.com Team

Oct 01, 2024 •Critical Slackware