My thoughts on Slackware, life and everything

Tag: glibc (Page 1 of 4)

Security updates for glibc and chromium

Two reminders about security related package updates in my repositories.

Google released an update to its chromium sources last week and I built packages for Slackware (14.2 and -current). You may already have seen them appear if you follow the ChangeLog.txt for my repository.
Get Chromium 97.0.4692.99 now, because it addresses one critical vulnerability (CVE-2022-0289): https://slackware.nl/people/alien/slackbuilds/chromium/

The GNU C Library (glibc) package for Slackware was rebuilt and hence also my multilib packages for glibc needed an update, after two security vulnerabilities were fixed (CVE-2021-3998 and CVE-2021-3999).
The multilib glibc packages (release 2.33, build ‘5alien’) can be found at http://www.slackware.com/~alien/multilib/current/ .

 

Eric

Slackware 15.0 alpha1

Hold the press! There’s good news on Slackware development front.
Slackware 14.2, the last stable release, saw the light on 30 June 2016. Since then, it has received many security patches but nothing has changed functionally and although 14.2 is super stable, it is also getting stale, in particular its default KDE desktop.
In all that time since the release of Slackware 14.2, the distro has been heavily worked on, and the slackware-current development release is a joy to work with, containing the latest tools and desktop environments.

The frequent and sometimes intrusive updates to -current are keeping the less knowledgeable Slackware users at bay, they prefer 14.2 since that requires minimal maintenance and won’t break after a careless upgrade.
But after almost 5 years of rising anxiety, there is now real movement toward a new stable release.

From the ChangeLog.txt today:

Mon Feb 15 19:23:44 UTC 2021
Here we go again... upgraded to glibc-2.33 and one last mass rebuild for
Slackware 15.0. The only packages upgraded in this batch are glibc and the
kernels - everything else is just a rebuild against the new glibc. Not
rebuilt in this batch: devs (best to just leave this alone), glibc-zoneinfo,
kernel-firmware, rust, linux-faqs, linux-howtos, aspell-en, mozilla-firefox,
mozilla-thunderbird, and seamonkey. There's a new Rust compiler but Firefox
and Thunderbird will need to be patched to use it, so we'll hold off on
those until they're ready for the new Rust either with patches or new
upstream releases. Until we have that and a few more scheduled upgrades I'm
not quite ready to call this beta yet, but you can call it 15.0-alpha1. :-)
Cheers!

I will do my best to update the multilib repository ASAP, I have multilib versions of the rebuilt gcc and upgraded glibc packages ready but occupied with other stuff at the moment.

Have fun upgrading 1550+ packages… again.
Eric

Some thoughts on the recent updates in Slackware-current

 Last week, a new LTS kernel (4.9.26), new glibc (2.25) and a new gcc compiler suite (7.1.0) landed in Slackware-current. Note that gcc no longer contains the Java compiler (gcj): subsequently Slackware’s gcc-java package has been removed from slackware-current.
We are at the head of the herd again folks. There is not yet any other distro that ships with the gcc-7 compiler by default. This will certainly pose some challenges for people who compile their stuff themselves – the SBo team warned their community about scripts that require patches to compile against gcc-7.

I have my set of challenges myself too… until now, I have not been able to compile the multilib versions of the gcc compiler suite. That’s infuriating, I can tell you. Specifically, I have issues with brig, gnat, go and objc compilers; the 7.1.0 versions of c and c++ compilers are just fine. I hope to resolve this soon-ish… until then, you will have to wait for new multilib compilers. If you really need a gcc 7.1.0 compiler (for instance, to compile a kernel module) I suggest that you (temporarily) switch to Slackware-current’s gcc 7.1.0 packages. Running your multilib system is of course not affected by this – gcc is only needed to compile stuff. I will probably release glibc-2.25_multilib packages ahead of the problematic gcc multilib packages to give you at least something.

Another interesting addition is lame. After the last Fraunhofer MP3 patent expired on 16 April 2017, the doors were opened to enable MP3 encoding support in Slackware. Several packages have been recompiled to take advantage of the new MP3 encoding capability (cdrdao, sox, ffmpeg, MPlayer, audacious-plugins) and the gstreamer packages were updated for good measure.

I have added ‘lame’ to the ‘massconvert32.sh‘ script of my compat32-tools package and updated the set of “compat32” packages in my multilib repository.

Multilib glibc patched for GHOST vulnerability (CVE-2015-0235)

There was some unrest about the most recent glibc update in the stable releases of Slackware (slackware-current excluded). Glibc was patched against a new vulnerability, CVE-2015-0235, for which the only known exploit currently is in the MTA Exim (software which is not part of Slackware) and an exploit for this vulnerability is difficult to write apparently. I usually am quite fast in following up on Slackware updates for gcc and especially glibc. This time, I was busy with answering questions about the new KDE 5 at night, and buried in shit at work during the day.

Nevertheless, when there were no updated multilib versions of glibc the next day, some people asked when they could expect a patched package. Others were less polite and demanded updated packages. That sucked.

Here is where you can find the updated packages:

For the un-initiated: multilib is needed if you want to use binary-only 32-bit software on 64-bit Slackware. Examples of that are Skype, Valve’s Steam Client, the WINE emulator, the Pipelight browser plugin, Citrix client etc.

Instructions on how to add or update multilib on your 64-bit Slackware can be found on the Slackware Documentation Project.

Cheers, Eric

 

Rebuild for glibc-2.17_multilib in slackware-current

Pat’s inquery on LinuxQuestions.org about how to “backtrack to sanity” in order to stabilize slackware-current and start laying out the next release, resulted in a kernel upgrade (3.8.8) and accompanying glibc rebuild.

I built the “companion” update of the glibc multilib packages last night. They can be downloaded from:

Remember, multilib configuration is (only) needed if you want to use binary-only 32-bit software on 64-bit Slackware – think of Valve’s Steam Client, the WINE emulator, Citrix client etc.

If you are looking for instructions on how to add or update multilib on your 64-bit Slackware, check out our Slackware Documentation Project which has this information and much more.

Cheers, Eric

« Older posts

© 2024 Alien Pastures

Theme by Anders NorenUp ↑