SlackWiki - User contributions [en]

Main Page

2023-07-06T22:03:37Z

Erik:

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on [ircs://irc.libera.chat:6697 Libera Chat]. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Libera Chat ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.40.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 22:03, 6 July 2023 (UTC)
{| class="mw-collapsible mw-collapsed wikitable"
|+ style=white-space:nowrap | Previous upgrades.
|-
|MediaWiki was upgraded to 1.38.4. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:30, 1 October 2022 (UTC)
|-
|MediaWiki was upgraded to 1.37.4. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:40, 9 July 2022 (UTC)
|-
|MediaWiki was upgraded to 1.37.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 05:14, 2 April 2022 (UTC)
|-
|MediaWiki was upgraded to 1.37.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:02, 25 November 2021 (UTC)
|-
|MediaWiki was upgraded to 1.36.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 15:55, 2 October 2021 (UTC)
|-
|MediaWiki was upgraded to 1.36.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 13:46, 23 September 2021 (UTC)
|-
|MediaWiki was upgraded to 1.31.7. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:15, 27 March 2020 (UTC)
|-
|MediaWiki was upgraded to 1.31.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:06, 7 June 2019 (UTC)
|-
|MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)
|-
|MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)
|-
|MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)
|-
|MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)
|-
|MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)
|-
|MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)
|}

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

User:Erik

2022-12-15T17:00:38Z

Erik: http to https

Name: [mailto:erik@sl1200.org Erik Hanson] 
Web: [https://sl1200.org/ https://sl1200s.org/] 
IRC: [ircs://irc.libera.chat:6697 Libera Chat]

Main Page

2022-10-01T19:30:17Z

Erik: MediaWiki Upgrade

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on [ircs://irc.libera.chat:6697 Libera Chat]. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Libera Chat ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.38.4. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:30, 1 October 2022 (UTC)
{| class="mw-collapsible mw-collapsed wikitable"
|+ style=white-space:nowrap | Previous upgrades.
|-
|MediaWiki was upgraded to 1.37.4. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:40, 9 July 2022 (UTC)
|-
|MediaWiki was upgraded to 1.37.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 05:14, 2 April 2022 (UTC)
|-
|MediaWiki was upgraded to 1.37.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:02, 25 November 2021 (UTC)
|-
|MediaWiki was upgraded to 1.36.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 15:55, 2 October 2021 (UTC)
|-
|MediaWiki was upgraded to 1.36.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 13:46, 23 September 2021 (UTC)
|-
|MediaWiki was upgraded to 1.31.7. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:15, 27 March 2020 (UTC)
|-
|MediaWiki was upgraded to 1.31.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:06, 7 June 2019 (UTC)
|-
|MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)
|-
|MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)
|-
|MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)
|-
|MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)
|-
|MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)
|-
|MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)
|}

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Main Page

2022-07-09T19:40:52Z

Erik: MediaWiki Upgrade

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on [ircs://irc.libera.chat:6697 Libera Chat]. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Libera Chat ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.37.4. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:40, 9 July 2022 (UTC)
{| class="mw-collapsible mw-collapsed wikitable"
|+ style=white-space:nowrap | Previous upgrades.
|-
|MediaWiki was upgraded to 1.37.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 05:14, 2 April 2022 (UTC)
|-
|MediaWiki was upgraded to 1.37.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:02, 25 November 2021 (UTC)
|-
|MediaWiki was upgraded to 1.36.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 15:55, 2 October 2021 (UTC)
|-
|MediaWiki was upgraded to 1.36.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 13:46, 23 September 2021 (UTC)
|-
|MediaWiki was upgraded to 1.31.7. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:15, 27 March 2020 (UTC)
|-
|MediaWiki was upgraded to 1.31.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:06, 7 June 2019 (UTC)
|-
|MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)
|-
|MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)
|-
|MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)
|-
|MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)
|-
|MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)
|-
|MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)
|}

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Main Page

2022-04-02T05:14:34Z

Erik: MediaWiki Upgrade

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on [ircs://irc.libera.chat:6697 Libera Chat]. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Libera Chat ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.37.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 05:14, 2 April 2022 (UTC)

MediaWiki was upgraded to 1.37.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:02, 25 November 2021 (UTC)

MediaWiki was upgraded to 1.36.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 15:55, 2 October 2021 (UTC)

MediaWiki was upgraded to 1.36.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 13:46, 23 September 2021 (UTC)

MediaWiki was upgraded to 1.31.7. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:15, 27 March 2020 (UTC)

MediaWiki was upgraded to 1.31.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:06, 7 June 2019 (UTC)

MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)

MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)

MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)

MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Main Page

2021-11-25T18:02:36Z

Erik: MediaWiki Upgrade

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on [ircs://irc.libera.chat:6697 Libera Chat]. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Libera Chat ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.37.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:02, 25 November 2021 (UTC)

MediaWiki was upgraded to 1.36.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 15:55, 2 October 2021 (UTC)

MediaWiki was upgraded to 1.36.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 13:46, 23 September 2021 (UTC)

MediaWiki was upgraded to 1.31.7. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:15, 27 March 2020 (UTC)

MediaWiki was upgraded to 1.31.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:06, 7 June 2019 (UTC)

MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)

MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)

MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)

MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Main Page

2021-10-02T15:55:11Z

Erik: Software Update

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on [ircs://irc.libera.chat:6697 Libera Chat]. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Libera Chat ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.36.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 15:55, 2 October 2021 (UTC)

MediaWiki was upgraded to 1.36.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 13:46, 23 September 2021 (UTC)

MediaWiki was upgraded to 1.31.7. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:15, 27 March 2020 (UTC)

MediaWiki was upgraded to 1.31.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:06, 7 June 2019 (UTC)

MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)

MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)

MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)

MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

User:Erik

2021-09-25T00:36:48Z

Erik: Freenode is dead.

Name: [mailto:erik@sl1200.org Erik Hanson] 
Web: [http://sl1200.org/~erik/ http://sl1200s.org/~erik/] 
IRC: [ircs://irc.libera.chat:6697 Libera Chat] 

<math>\phi_n(\kappa) = \frac{1}{4\pi^2\kappa^2} \int_0^\infty \frac{\sin(\kappa R)}{\kappa R} \frac{\partial}{\partial R}\left[R^2\frac{\partial D_n(R)}{\partial R}\right]\,dR</math>

Irssi

2021-09-23T13:53:50Z

Erik: Freenode is dead.

Irssi Quick tutorial - Based on http://www.irssi.org/documentation

== Installation ==
If you did a full install of Slackware, you may already have irssi, and you can skip to the next section of this guide. However, if typing 'irssi' at the command line returns nothing, you will need to install the program. Irssi is located in the 'n' folder of Slackware mirrors - and once you have downloaded it, you only need to run 'installpkg irssi[tab]' as root to install it.

== Usage ==
To start the client, "irssi" is entered from either the console or any xterm.

Connecting is done by the /server command
/server irc.libera.chat:6697 , would connect to the libera chat server
/connect does the same thing but is used to open a new connection in a new window
/disconnect is to leave that server.

If the nick or handle is already chosen, just issue /nick somenewhandle , this will change to a new name.

Names that are registered on NickServ must be identified by /msg NickServ IDENTIFY <password>
Or you can select window #2 by the alt key and number 2 and enter IDENTIFY <password>.
N.B alt key 0-10 is for windows 0-10, Alt-q through Alt-o is for 11-19.

To join a channel, issue /j #slackware, that will bring you to the wonderful people on Slackware's official channel on the Libera Chat IRC network.

Ctrl-X is used to switch between network connections, if you are connected to multiple servers, e.g. irc.libera.chat and another server.

/query and /q are used to initiate private convesationa with people. eg. /query linus would open a private chat window with the user 'linus'.

/set in the first window, shows all the settings, where by help is found by issuing the command. e.g. /help dcc would bring up information on the dcc commmand.

Window management

/WINDOW NEW , splits the screen in half
this new window will have a number assigned to it, to access just type alt 4, if the window is number 4.
/WINDOW CLOSE , this closes the current window.
/WINDOW BALANCE , this i am constantly using to keep the windows the same size.
/window name hilight, whenever someone types your name in the channel, the line is highlighted in another colour.

Don't forget to run the /save command, so that next time irssi loads, all the windows will be there.

SET term_force_colors ON, is a very useful command, as certain xterms need this to display the colours correctly.

[[Category:Tutorials]]

Main Page

2021-09-23T13:51:47Z

Erik: Freenode is dead.

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on [ircs://irc.libera.chat:6697 Libera Chat]. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Libera Chat ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.36.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 13:46, 23 September 2021 (UTC)

MediaWiki was upgraded to 1.31.7. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:15, 27 March 2020 (UTC)

MediaWiki was upgraded to 1.31.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:06, 7 June 2019 (UTC)

MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)

MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)

MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)

MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Main Page

2021-09-23T13:46:22Z

Erik: Update

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on irc.freenode.net. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Freenode ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.36.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 13:46, 23 September 2021 (UTC)

MediaWiki was upgraded to 1.31.7. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:15, 27 March 2020 (UTC)

MediaWiki was upgraded to 1.31.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:06, 7 June 2019 (UTC)

MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)

MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)

MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)

MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

User talk:Erik

2021-03-08T13:39:05Z

Erik: reply

Is it possible you could make available the wiki logo image so people (such as me) could link to it graphically from their public homepages?--[[User:Dchmelik|Dchmelik]] ([[User talk:Dchmelik|talk]]) 00:01, 8 March 2021 (UTC)
: The logo URL is [https://slackwiki.com/images/logo.png https://slackwiki.com/images/logo.png] --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 13:39, 8 March 2021 (UTC)

Main Page

2020-03-27T02:15:34Z

Erik: MediaWiki Upgrade

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on irc.freenode.net. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Freenode ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.31.7. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:15, 27 March 2020 (UTC)

MediaWiki was upgraded to 1.31.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:06, 7 June 2019 (UTC)

MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)

MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)

MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)

MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Main Page

2019-06-07T17:06:12Z

Erik: MediaWiki Upgrade

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on irc.freenode.net. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Freenode ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.31.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:06, 7 June 2019 (UTC)

MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)

MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)

MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)

MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Main Page

2018-10-27T18:42:37Z

Erik:

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on irc.freenode.net. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Freenode ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.31.1. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 18:42, 27 October 2018 (UTC)

MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)

MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)

MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Main Page

2018-06-16T17:59:02Z

Erik: /* News */ Version update

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on irc.freenode.net. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Freenode ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.31.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 17:59, 16 June 2018 (UTC)

MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)

MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Main Page

2018-03-11T20:21:30Z

Erik: Upgraded MediaWiki

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on irc.freenode.net. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Freenode ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.30.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 20:21, 11 March 2018 (UTC)

MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Main Page

2017-05-12T02:00:40Z

Erik: MediaWiki upgraded

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on irc.freenode.net. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Freenode ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.28.2. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 02:00, 12 May 2017 (UTC)

MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

SSL

2017-05-09T00:44:06Z

Erik: Info from Xesco

[[Category:Tutorials]]
= openSSL 0.9.8e =
'''IMPORTANT: Since this version has a [http://www.mail-archive.com/openssl-users@openssl.org/msg48671.html bug in the blowfish encryption] it is recommended not to use blowfish since it is incompatible with all other openSSL versions!'''

 Everything you read here was tested on Slackware 12 

; wikipedia says about openSSL:
: ''OpenSSL is an open source implementation of the SSL and TLS protocols. The core library (written in the C programming language) implements the basic cryptographic functions and provides various utility functions. Wrappers allowing the use of the OpenSSL library in a variety of computer languages are available.''

There are many ways to use openSSL. This just covers certificates for use with httpd. You can also use easy-rsa that comes with the openVPN package and can be found in ''/usr/doc/openvpn-2.0.9/easy-rsa/''. For more information read the included ''README'' or look here: [http://openvpn.net/easyrsa.html A Guide to basic RSA Key Management].
Normally you will make a ''Certificate Signing Request (CSR)'' and send this one to a ''Certifying Authority (CA)'' to be signed. But since we don't wanna pay for this and only want to use it for our own special purpose, we don't need to do that and sign everything ourself.

= openSSL + httpd =
Switch to ''/etc/ssl''
<pre>
cd /etc/ssl
</pre>

In this directory you should see the following listing. One some non-Slackware linuxes, or if OpenSSL was installed from source, the appropriate directory might be ''/etc/openssl''.
<pre>
root@pecan:/etc/ssl# ls -l
total 24
drwxr-xr-x 2 root root 4096 2007-06-13 12:40 certs/
drwxr-xr-x 2 root root 4096 2007-06-13 12:40 misc/
-rw-r--r-- 1 root root 9374 2007-06-13 12:40 openssl.cnf
drwxr-xr-x 2 root root 4096 2007-06-13 12:40 private/
root@pecan:/etc/ssl#
</pre>

We need to generate a private and public RSA key file.
The public key is used to encrypt messages to you and is distributed with your certificate.

== Creating a Self-Signed ''Certificate'' (CRT) ==

=== openssl.cnf + openSSL DB ===
(You should still do this step even if you are buying a commercial certificate.) First things first, so we gotta edit this file, mainly the ''[ CA_default ]'' section.
The
<pre>
[ CA_default ]

dir = ./demoCA # Where everything is kept
...
certificate = $dir/cacert.pem # The CA certificate
...
crl = $dir/crl.pem # The current CRL
private_key = $dir/private/cakey.pem# The private key
...
</pre>
to
<pre>
[ CA_default ]

dir = /etc/ssl # Where everything is kept
...
certificate = $dir/certs/ca.crt # The CA certificate
...
crl = $dir/crl/ca.crl # The current CRL
private_key = $dir/private/ca.key # The private key
...
</pre>
You can even change more options in this file but be aware what you are doing. 
openSSL has a database for storing information such as ''Certificate Revocation Lists'' (CRL). Since these files don't exist on startup and we don't use the ''CA.sh'' or ''CA.pl'' scripts we got to create them ourself:
<pre>
mkdir newcerts certs crl private
touch serial index.txt crlnumber crl/ca.crl
echo 01 | tee serial | tee crlnumber | Tee crl/ca.crl
</pre>
Thanks to ''alienBOB''. Hail to tee king! :p

=== Becoming a ''Certification Authority'' (CA) ===
(Skip this step if you are buying a certificate from a commercial certificate authority such as GoDaddy.) Before you can create and sign your own certificates, you first have to establish yourself as a "Certificate Authority".
To do so, we first create our key file (with a public and a private key) and use it to create our "master certificate" to use when signing other certificates.

; Generate the CA RSA Key (Triple-DES encrypted and PEM formatted)
: <pre>openssl genrsa -des3 -out private/ca.key 4096</pre>
; Create the CA CRT with the CA RSA Key
: <pre>openssl req -new -x509 -days 3650 -key private/ca.key -out certs/ca.crt</pre>

=== Create Server CRT ===
A CRT contains your RSA public key, your name, the name of the CA, and is digitally signed by the CA. Browsers that know the CA can verify the signature on that CRT, thereby obtaining your RSA public key. That enables them to send messages which only you can decrypt.
The next step is to create a Server RSA key, generate a ''Certificate Signing Request'' (CSR) out of it and sign it with our CA CRT to get a working SSL CRT for our server.
A CSR is a digital file which contains your public key and your name. Normally you would send the CSR to a CA, who will convert it into a real certificate, by signing it.

; Generate the Server RSA Key (Triple-DES encrypted and PEM formatted)
: <pre>openssl genrsa -des3 -out private/server.key 1024</pre>
; Create the Server CSR using the Server RSA Key
: '''When asked for the CommonName (CN) enter your domain!'''
: <pre>openssl req -new -key private/server.key -out private/server.csr</pre>
; Sign the CSR with our CA CRT
: <pre>openssl ca -in private/server.csr -out certs/server.crt</pre>

You can now delete ''server.csr'' if you want, because it is no longer needed.

(If you are using a commercially signed certificate from a place such as GoDaddy, do the first two commands above but not the last. Then do ''cat private/server.csr'' to get the text of the certificate request, which you will paste into GoDaddy's web interface to get the certificate. GoDaddy will then email the email address listed in the ''whois'' information for that domain (Make sure you haven't put in a fake address there to avoid spam!), and after the link in that email is clicked, GoDaddy will email another link to you from which you download a zip file.

The zip file will contain two .crt files, and you should put both of them in /etc/ssl/certs. Other commerical certificate authorities follow a very similar procedure.)

== Setup httpd ==
=== Edit httpd.conf ===
The whole httpd config is located in ''/etc/httpd''. Fire up your preferred text editor and simply change this at Line 459:
<pre>
# Secure (SSL/TLS) connections
#Include /etc/httpd/extra/httpd-ssl.conf
</pre>
to this
<pre>
# Secure (SSL/TLS) connections
Include /etc/httpd/extra/httpd-ssl.conf
</pre>
to enable SSL support.

You may also have to uncomment the line that starts ''LoadModule ssl_module''.

=== Edit extra/httpd-ssl.conf ===
Now we're going into the guts of the httpd SSL config. Search for ''SSLCertificateFile'' and ''SSLCertificateKeyFile'' change the path to our newly created CRT:
<pre>
...
SSLCertificateFile /etc/ssl/certs/server.crt
...
SSLCertificateKeyFile /etc/ssl/private/server.key
...
SSLCertificateChainFile /etc/ssl/certs/server.crt
...
SSLCACertificatePath /etc/ssl/certs
SSLCACertificateFile /etc/ssl/certs/ca.crt
...
SSLCARevocationPath /etc/ssl/crl
SSLCARevocationFile /etc/ssl/crl/ca.crl
...
</pre>

(If you have purchased a certificate from a commercial authority, the SSLCertificateFile will be one of the two files you receive from the CA (GoDaddy or VeriSign or whomever), and the SSLCACertificateFile will be the other. The files will be named such that you can tell which is which -- the SSLCertificateFile will probably be something like ''www.yourdomainname.com.crt'' and the SSLCACertificateFile will be something like ''nameofca-bundle.crt''.)

== Pass-phrase on httpd startup ==
The reason this dialog pops up at startup and every re-start is that the RSA private key inside your ''server.key'' file is stored in encrypted format for security reasons. The pass-phrase is needed decrypt this file, so it can be read and parsed. Removing the pass-phrase removes a layer of security from your server - proceed with caution!
<ol>
<li>
Remove the encryption from the RSA private key (while keeping a backup copy of the original file):
<pre>
cd /etc/ssl
mv private/server.key private/server.key.org
cd private
openssl rsa -in server.key.org -out server.key
</pre>
</li>
<li>
Make sure the server.key file is only readable by root since it is decrypted:
<pre>
cd /etc/ssl
chmod 0400 private/server.key
</pre>
</li></ol>
Now server.key contains an unencrypted copy of the key. If you point your server at this file, it will not prompt you for a pass-phrase. HOWEVER, if anyone gets this key they will be able to impersonate you on the net. PLEASE make sure that the permissions on this file are such that only root or the web server user can read it (preferably get your web server to start as root but run as another user, and have the key readable only by root).

As an alternative approach you can use the ''SSLPassPhraseDialog exec:/path/to/program'' facility. Bear in mind that this is neither more nor less secure, of course.

== Verifying and debugging ==
If you simply want to see every information on a CRT:
<pre>openssl x509 -noout -text -in XXX.crt</pre>

=== Verifying ===
; Verify that a private key matches its Certificate
: Generate a MD5 out of the public key/CRT and compare
: <pre>openssl x509 -noout -modulus -in private/XXX.crt | openssl md5 && openssl rsa -noout -modulus -in private/XXX.key | openssl md5</pre>

=== Debugging ===
; s_server - Debugging clients
: <pre>openssl s_server -accept 443 -www</pre>
; s_client - Debugging servers
: <pre>openssl s_client -connect localhost:443</pre> or <pre>openssl s_client -connect localhost:443 -state -debug</pre>

== Security ==
All the files expect the CRTs are only for your eyes, so we change the permissons:
<pre>chmod 0400 private/*.key</pre>

=== Client Revokation ===
This is only needed if your server certificate is compromised (eg. someone hacked your server and stole your server.key).
<pre>
openssl ca -gencrl -keyfile private/ca.key -cert certs/ca.crt -out crl/ca.crl
</pre>
That generated us the needed files which we use when we want to revoke a CRT.
 
Now that we got a compromised CRT, we got to get rid of it:
<pre>openssl ca -revoke certs/server.crt -keyfile private/ca.key -cert certs/ca.crt</pre>

== Other ==

=== Change the pass-phrase ===
<pre>
openssl rsa -des3 -in server.key -out server.key.new
mv server.key.new server.key
</pre>
The first time you're asked for a PEM pass-phrase, you should enter the old pass-phrase. After that, you'll be asked again to enter a pass-phrase - this time, use the new pass-phrase. If you are asked to verify the pass-phrase, you'll need to enter the new pass-phrase a second time.

=== CRT for Clients ===
Ok.. i won't write anything on this, and simply just C/P:
<pre>
openssl genrsa -des3 -out private/client1_priv.key 2048
openssl genrsa -des3 -out private/client2_priv.key 2048
# and so on... depends on how much clients you wanna serv...
openssl req -new -key private/client1_priv.key -out private/client1.csr
openssl req -new -key private/client2_priv.key -out private/client2.csr
# and so on...
openssl ca -in private/client1.csr -out private/client1.crt
openssl ca -in private/client2.csr -out private/client2.crt
cp private/client1.crt private/client1_preconv.crt
cat private/client1.key >> private/client1_preconv.crt
openssl pkcs12 -export -in private/client1_preconv.crt -out private/client1_postconv.p12
</pre>
Install in the clients browser... and change httpd.conf:
<pre>
SSLCACertificateFile PATH/TO/server.crt
SSLVerifyClient require
SSLVerifyDepth 1
</pre>

=== Convert CRT from PEM to DER format ===
Normally all CRTs are stored in the PEM format.
<pre>openssl x509 -in ca.crt -out ca.crt.der -outform DER</pre>

== Testing the CRT ==
If you have live web sites, you might wish to test your configuration before restarting apache, to avoid having that panicy few minutes of downtime while you scramble to see what you can do faster, fix the problem or copy back your backup configs. Test like this:
<pre>httpd -t</pre>
Look at the error messages it prints out, or the error_log as explained below, if it doesn't work.

Restart your httpd:
<pre>/etc/rc.d/rc.httpd restart</pre>
Take a look at the httpd ''error_log'' and scroll to the end of the file:
<pre>jed /var/log/httpd/error_log</pre>
If your getting an error like this:
<pre>[error] Init: Unable to read pass phrase [Hint: key introduced or changed before restart?]</pre>
... then you should take a look at ''Pass-phrase on httpd startup'' ...

= openSSL + openVPN =
$foo ... maybe next month...

= External Links =
* [http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html SSL/TLS Strong Encryption: FAQ @ httpd.apache.org]
* [http://www.tc.umn.edu/~brams006/selfsign.html Creating a self-signed SSL certificate]
* [http://www.madboa.com/geek/openssl/ OpenSSL Command-Line HOWTO]
* [http://www.5dollarwhitebox.org/wiki/index.php/Howtos_Self_Signed_SSL_Certificates OpenSSL Quick Reference]
* [http://www.opensourcehowto.org/how-to/apache/setup-apache2-with-openssl.html Setup Apache2 with OpenSSL]
* [http://www.marschke.info/admin/ap_opssl_https.html Apache2, OpenSSL und HTTPS: Server- und Client-Authentifizierung mit Zertifikaten über verschlüsselte Internet-Verbindungen]
* [http://www.online-tutorials.net/security/openssl-tutorial/tutorials-t-69-207.html openSSL / openVPN.. comming soon]

Main Page

2014-10-26T23:34:54Z

Erik: MediaWiki upgraded

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on irc.freenode.net. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Freenode ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.23.5. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 19:34, 26 October 2014 (EDT)

MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Multilib

2012-12-18T13:58:01Z

Erik: Reverted edits by RonaldCole (talk) to last revision by Merge-delete

There's a good tutorial (and packages) on how to set up multilib support (32-bit programs on Slackware64) at
[http://alien.slackbook.org/dokuwiki/doku.php?id=slackware:multilib AlienBOB's site]. You'd do well to go there next.

''However'', as that's not complete and clear on all points, here are some details:

==Binary display drivers==

You need to reinstall binary drivers. ATI and Nvidia driver packages contain both 64bit and 32bit libraries to be maximally useful on a 64bit multilib OS. However, the slackbuild scripts available at slackbuilds.org are not up to this task, so if you already installed 64-bit binary drivers from slackbuilds.org, you should remove these and then use ATI's or Nvidia's driver installer.

[[Category:Tutorials]]

Google Earth

2012-12-17T15:20:26Z

Erik: Reverted edits by Tonyguards (talk) to last revision by Erik

[[Category:Tips]]

You can download Google Earth from http://earth.google.com/

You have to set the .bin file that you download to be executatable, and then run it, to install.

<pre>
chmod a+x GoogleEarthLinux.bin
./GoogleEarthLinux.bin
</pre>

By default it installs itself in /opt/google-earth/ . It offers to make a link from /usr/local/bin/googleearth to the right executable, I recommend allowing it to do this.

Once it is done, to run it you just type "googleearth" in an xterm (X must be running). You can make the appropriate desktop icon or menu item depending on what window manager you are using.

If the splash screen shows up for some amount of time, and then all of X (the entire graphical environment) crashes (if you have graphical login set up, it will give you a login screen again, otherwise you will go back to the console), some people have found this to be solved by downloading the libGL.so library. It should be put in the /opt/google-earth/ directory:

(as root)
<pre>
cd /opt/google-earth/
wget http://librarian.launchpad.net/7037027/libGL.so.1 -O libGL.so.1
</pre>

Some places on the web also refer to downloading it from http://www.ground-impact.com/libGL.so.1.2 . Here are links to a few discussions of the issue:

http://www.linuxquestions.org/questions/slackware-14/google-earth-crashes-x-598569/?s=3ff14bc2cdec277267c5547b7dee84d9
http://forum.mandriva.com/viewtopic.php?t=71691&highlight=googleearth

'''Performance Issue with Google Earth:'''
<pre>
if google earth is slow in slackware Linux, check whether DRI is enabled or not, if Direct Rendering is enabled then
disable "Atmosphere" effect from View menu -> [x] Atmosphere for smoother functioning of the graphics in Google Earth window.
</pre>

Main Page

2012-06-01T04:30:56Z

Erik: MediaWiki Upgrade

Welcome to slackwiki! Feel free to [[Special:Userlogin|Create an account or log in]] and edit any of the pages, or add your own (see [http://meta.wikimedia.org/wiki/Help:Starting_a_new_page Starting A New Page]). Come talk to some of us in ##slackware on irc.freenode.net. When saving changes, please provide a brief summary of your changes in the box provided - it's nice for those sad people who follow [[Special:Recentchanges|RecentChanges]] via RSS. Any questions about the wiki? See the [http://meta.wikipedia.org/wiki/MediaWiki_User%27s_Guide User's Guide].

==Main Sections==
Please [[Special:Userlogin|LOG IN]] before adding/editing pages.

* [[:Category:Information|Information]]
* [[:Category:Tutorials|Tutorials]]
* [[:Category:Tips|Tips]]
* [[:Category:Security|Security]]
* [[:Category:Hardware|Hardware]]
* [[Links]]
<hr style="width:20em"/>
* [[The Regulars|Regulars of Freenode ##slackware]]
* [[Contest|Logo Contest]] (Finished)

==Thanks==
* '''Anyone who contributes to the wiki :)'''

==News==
MediaWiki was upgraded to 1.19.0. --[[User:Erik|Erik]] ([[User talk:Erik|talk]]) 00:30, 1 June 2012 (EDT)

MediaWiki was upgraded to 1.18.0. --[[User:Erik|Erik]] 03:44, 17 December 2011 (CST)

Patched to 1.16.2. --[[User:Erik|Erik]] 18:53, 1 February 2011 (EST) | Patched to 1.16.5. --[[User:Erik|Erik]] 17:55, 13 June 2011 (CDT)

MediaWiki was upgraded to 1.16.1. --[[User:Erik|Erik]] 11:43, 5 January 2011 (CST)

Patched to 1.15.3. --[[User:Erik|Erik]] 09:33, 7 April 2010 (UTC) | Patched to 1.15.4. --[[User:Erik|Erik]] 08:31, 30 May 2010 (UTC)
| Patched to 1.15.5. --[[User:Erik|Erik]] 23:12, 28 July 2010 (UTC)

MediaWiki was upgraded to 1.15.2. --[[User:Erik|Erik]] 00:25, 9 March 2010 (UTC)

Sorry for the temporary downtime - we forgot to renew the domain name registration. --[[User:rworkman|rworkman]] 0006, 3 November 2009 (UTC)

There has been a reset of the wiki. The database was corrupted. A few pages, all Talk/Discussion pages and all user accounts were lost. --[[User:Erik|Erik]] 23:44, 6 June 2009 (UTC)

MediaWiki was upgraded to 1.14.0 --[[User:Erik|Erik]] 16:49, 16 March 2009 (UTC)

We've moved! We're now hosted by [http://onyxlight.net/ http://onyxlight.net/] with an upgrade to MediaWiki 1.6.6 and
spambot prevention in place. --[[User:Erik|Erik]] 11:33, 22 May 2006 (GMT)

The contest has been won by [[User:Marcus|Marcus]]. Admire the logo :) --[[User:FredEmmott|FredEmmott]] 12:36, 24 Feb 2005 (GMT)

Updated SlackWiki to MediaWiki 1.4.7 --[[User:FredEmmott|FredEmmott]] 12:01, 21 Jul 2005 (GMT)

We're now sharing [http://cardinal.lizella.net cardinal.lizella.net] with several other Slackware projects such as [http://www.slacksec.org SlackSec], the [http://www.slackbook.org Slackware Book Project], and [http://www.slamd64.com Slamd64]. Hopefully this will mean a more reliable and faster wiki --[[User:FredEmmott|FredEmmott]] 19:42, 2 May 2005 (GMT)

We're back onto my little UML temporarily, but I've finally judged the contest,
congratulations to [[User:Marcus|Marcus]]. Next artwork contest comming soon, please use the [[Talk:Main_Page|main talk page]] for suggestions on more technical contests --[[User:FredEmmott|FredEmmott]] 18:36, 24 Feb 2005 (GMT)

Thanks to RackSpace and Michael Shuler - they've generously donated a dedicated server to http://www.slacksec.org, which slackwiki is sharing --[[User:FredEmmott|FredEmmott]] 15:06, 1 Dec 2004 (CST)

We are now sharing this server with http://www.slacksec.info - security updates in Pat's absence --[[User:FredEmmott|FredEmmott]] 22:22, 19 Nov 2004 (GMT)

We should not have as many problems with server now - I have no choice but to run debian on this server, and apparantly they missed backporting a security patch, so it's now on traditional non-debianified apache 1.3.33 :) --[[User:FredEmmott|FredEmmott]] 18:03, 2 Nov 2004 (GMT)

Please feel free to bring our old pages over from [http://slackwiki.org/old/index.php?pagename=HomePage the old site] --[[User:FredEmmott|FredEmmott]] 21:23, 31 Oct 2004 (GMT)

Swapped wiki software again because PHPWiki is too buggy --[[User:FredEmmott|FredEmmott]] 21:11, 31 Oct 2004 (GMT)

Chromium browser

2012-03-29T14:08:01Z

Erik: Reverted edits by Perlna (talk) to last revision by Klickback

[[Category:Tutorials]]
== Introduction ==

Chromium is an open source web browser from Google. It is based on the WebKit rendering engine and is the upstream project for Google's popular Chrome Web Browser.

Keep in mind that Chromium is the '''testing''' branch of the Chrome web browser, and is not recommended for mission-critical systems. Consider using [http://www.google.com/chrome Google Chrome] or [http://www.mozilla.org/en-US/firefox/ Mozilla Firefox] for production systems.

=== Use Case ===

This tutorial explains how to install the latest Chromium build on Slackware and automate the process of updating it regularly. It is aimed at users on a personal desktop or laptop, especially on a single-user system.

While the [http://slackbuilds.org slackbuilds.org] project provides excellent quality build scripts for Chromium, downloading 140MB+ source code and doing compilations that often take more than a couple of hours to complete is generally not feasible for people with laptops, slower computers or slow internet connections.

Therefore, this guide aims on how to automate the process of installing and updating Chromium using daily binary builds that are much smaller in size and take up negligible resources for the install and update process, thus helping the user always run the latest and greatest builds without the hassle of downloading and compiling the source code.

== Getting started ==

Chromium depends on <code>GConf</code> and <code>ORBit2</code>, and these should be installed first. Newer versions may also need the PAM library.

=== Slackware 13.37 ===

The above mentioned dependencies are included in the '''extra/''' tree of Slackware 13.37, so these can be simply installed by :
<pre>
# slackpkg install GConf ORBit2 google-chrome-pam-solibs
</pre>

=== Slackware 13.1 ===

GConf and ORBit2 are availabe at the [http://slackbuilds.org slackbuilds.org] repository. These can be installed manually or using [http://sbopkg.org Sbopkg] :
<pre>
# sbopkg -i 'ORBit2 GConf'
</pre>

Get the <code>google-chrome-pam-solibs</code> package [http://slackware.osuosl.org/slackware-13.37/extra/google-chrome/google-chrome-pam-solibs-1.1.3-i486-1.txz 32-bit] [http://slackware.osuosl.org/slackware64-13.37/extra/google-chrome/google-chrome-pam-solibs-1.1.3-x86_64-1.txz 64-bit] and install it :
<pre>
# installpkg ./google-chrome-pam-solibs-1.1.3-x86_64-1.txz
</pre>

== Getting and installing the latest Chromium build ==

Google maintains a repository of daily chromium builds that you can get from [http://commondatastorage.googleapis.com/chromium-browser-continuous/index.html?path=Linux/ here] (32bit) or [http://commondatastorage.googleapis.com/chromium-browser-continuous/index.html?path=Linux_x64/ here] for 64 bit. Scroll down to the bottom and navigate to the latest build directory, and download the 'chrome-linux.zip' file there.

Extract the zip file to a place of your liking (I like to keep mine in /home/username/soft), and run the 'chrome-wrapper' binary that will run Chromium and also generate a 'chromium-dev.desktop' file in /home/user/.local/share/applications/ and a Chromium entry will appear in your KDE or Xfce menu. Copy that file to your desktop if you prefer a desktop shortcut.

To upgrade Chromium, just download the latest zip file and extract it where you previously did, overwriting the previous files.

== Automating the Process ==

The following script helps to automate the process of installing and upgrading Chromium. Edit the <code>INSTALLDIR</code> variable to your liking - that is the place where chromium will be installed. Its recommended to keep it in a folder in your home directory to make it easy to manage. make sure the folder exists before running the script, or the script will fail.

<pre>
#!/bin/bash

# Installation directory - change this to a directory of your choice
# Please make sure the directory exists first, or the script won't work
INSTALLDIR=$HOME/soft

# Determine the architecture of the machine in use and set variables accordingly
if [ -z "$ARCH" ]; then
case "$( uname -m )" in
i686) ARCH=i686 ;;
*) ARCH=$( uname -m ) ;;
esac
fi

if [ "$ARCH" = "i686" ];then
DIRSUFFIX=""
elif [ "$ARCH" = "x86_64" ]; then
DIRSUFFIX="_x64"
else
echo "The ARCH should be either i686 or x86_64. Exiting."
exit
fi

# Determine the build number of the latest build
LATESTBUILD=$(curl http://commondatastorage.googleapis.com/chromium-browser-continuous/Linux/LAST_CHANGE)

# The URL to download from
CHROMEURL="http://commondatastorage.googleapis.com/chromium-browser-continuous/Linux"$DIRSUFFIX/$LATESTBUILD/"chrome-linux.zip"

cd $INSTALLDIR
if [ -e chrome-linux.zip ]; then # Check to see if `chrome-linux.zip` already exists
mv chrome-linux.zip chrome-linux.zip.old # if it does, rename it to chrome-linux.zip.old as backup
fi # in case the current build has problems
wget -O chrome-linux.zip $CHROMEURL
unzip -u -o ./chrome-linux.zip

</pre>

To automate the process, first save the script as '''chromium-update.sh''' and add it to your users's cron jobs. Here is an example on how to set it up :
<pre>
$ cd $HOME
$ mkdir .cron
$ cp ./chromium-update.sh ./.cron/
$ chmod a+x ./.cron/chromium-update.sh
$ crontab -e
</pre>
Add the following to your crontab :
<pre>
# Run daily cron job at 13:20 every day:
20 13 * * * ~/.cron/chromium-update.sh 1> /dev/null
</pre>
This will run the script at 13:20 every day. See <code>man crontab</code> for more on how to customize your cron jobs.

== Resources ==
[http://www.chromium.org/Home Chromium home page]

[http://en.wikipedia.org/wiki/Chromium_(web_browser)#Differences_from_Google_Chrome Differences from Google Chrome]

[https://wiki.archlinux.org/index.php/Chromium#Configuration Tips on configuration and customization from Archwiki]

Third Party Package Managers

2012-03-17T18:24:51Z

Erik: Reverted edits by Vegasseo (talk) to last revision by Erik

= Purpose =

The mere mention of third party package managers (such as [http://software.jaos.org/#slapt-get slapt-get] and [http://swaret.sourceforge.net/ swaret]) often results in a quick admonishment from Slackware users, and unfortunately, the only reason given in most cases is something along the lines of "they'll break your system." This leaves users in a state of confusion, as the respective web sites of these third party tools tout them as an improvement. The purpose of this page is to explain why and how these tools will often result in system breakage.

= Overview of Slackware's Native Package Tools =

Slackware's native package management utilities (<tt>pkgtool(8)</tt>, <tt>installpkg(8)</tt>, <tt>removepkg(8)</tt>, and <tt>upgradepkg(8)</tt>) do not support any form of dependency checking. A Slackware package is essentially a compressed tarball of the files associated with an application, a file containing a short description of the application (<tt>./install/slack-desc</tt>), and a script that performs some essential post-installation tasks (<tt>./install/doinst.sh</tt>). Installing a Slackware package simply copies those files to the filesystem and then executes the post-install script, while removing the package removes the files and reverses the post-install script. As result, there is no guarantee that libraries and other files needed by a particular package are already present on the system when that particular package is installed.

= Overview of Selected Third Party Tools =

As stated above, Slackware's native package management suite neither has nor supports dependency resolution. Because the third-party add-ons all use Slackware's native package tools, they are bound by this same limitation, at least to some extent, but some of them try to mitigate this in various ways; the following is an overview.

== swaret ==

=== Overview ===

Swaret makes use of an unofficial file that tries to list all package dependencies based on output of <tt>ldd(1)</tt>. The idea is that by running <tt>ldd(1)</tt> on some binary or shared object, you can see what that file is linked to, and then see what package(s) contain those files, and then install those packages.

=== Potential Problems ===

Since some library developers don't see the need to update their shared object version strings when making changes that are incompatible with the previous release, it's easy to need a newer release of some package but for swaret to not be able to determine this.
Since swaret is meant for upgrading packages, it will fail to roll back a package's version number if this occurs in the upstream Slackware tree for some reason.

== slapt-get ==

=== Overview ===

Slapt-get makes use of additional files (<tt>slack-required</tt>, <tt>slack-suggests</tt>, <tt>slack-conflicts</tt>) inside a Slackware package. Essentially, if a package is listed in <tt>slack-required</tt>, then slapt-get will install or upgrade it first; if a package is listed in <tt>slack-conflicts</tt>, then slapt-get will remove it first; if a package is listed in <tt>slack-suggests</tt>, then slapt-get will offer to install it in addition to the packages noted in <tt>slack-required</tt>.

=== Potential Problems ===

Since official Slackware packages do not have the <tt>slack-required</tt> and other files needed for slapt-get to determine dependencies, it is not able to resolve dependencies for them. Therefore, slapt-get's perceived usefulness is in keeping unofficial third-party packages (or at least those which do contain the necessary files) up to date. See the discussion below for more information on unofficial third-party packages.
Also, slapt-get, like swaret, will not "downgrade" a package to a previous version if it occurs in the upstream Slackware tree.

== sbopkg ==

=== Overview ===

[http://www.sbopkg.org/ SBopkg] is a tool for automating the download, compile and package build for SBo projects hosted in the [http://www.slackbuilds.org SlackBuilds.org ] repository. SBo packages are reviewed by team members for completeness as well as applicability to each Slackware release. SBo package documentation includes information regarding dependencies.

= Third Party (Unofficial) Packages =

This subject can elicit opinions just as strong as the topic of third-party package managers, and there are knowledgeable people on both sides of the issue. Third party packages can obviously present a security risk, as there's no way to know what's really in them, but for the average user, there are (amazingly enough) bigger concerns. On one hand, the user wants a package of some application that's not included with Slackware, but he doesn't want it to create other problems. Oftentimes, third party packages are not built on "clean" systems -- that is, the computer on which they're built has quite a few other non-official packages installed -- so the resulting package needs those other things to work properly. If the packager doesn't make note of all the different packages that this one depends on, the user installs it only to find that it still doesn't work. Even worse, those other dependencies are often not even necessary if the package is built on a clean system - if the other package had not been present, the new one obviously wouldn't have linked against it.
Installing third party packages from two different packagers can cause problems. Package A might depend on Package B, which depends on Package C and optionally Package D. If the person who built Package B only linked it against Package C (not D), but the Package A expects Package B to have both Package C and Package D dependencies, then Package A may not work, even though you (think you) have everything it needs installed.
Another frequent problem with third party packages is encountered by replacing stock (official) packages with unofficial ones. In addition to the library version issues mentioned in the swaret discussion, newer package versions often require newer versions of other packages, which might require newer versions of still other packages, and before you know it, you have replaced a sizable portion of the official Slackware packages. If/when something breaks, you will find it very difficult to find someone willing to help you, as there's no way to know how much effect the unofficial packages are having.

= Slackware -current =

Slackware -current is *not* a stable release of Slackware. It is intended for advanced users who are familiar with how Slackware works to test (and report success/failure, find and fix bugs, etcetera) the new packages leading to the next stable release of Slackware. Packages are constantly being added, removed, split up, merged, and otherwise mangled, and third party package managers (swaret/slapt-get/et al) should not be expected to know how to deal with this. If you use one of those tools while trying to run Slackware -current and you don't understand how they work and their limitations, you *will* break your system and you will *not* have much luck finding someone who is sympathetic. You have been warned.

You may be wondering why these tools have trouble with -current. I won't even attempt to detail all of the potential issues, but here are a couple:
1. When upgrading to -current with one of these tools, the package sets are upgraded in alphabetical order (and the packages therein also in alphabetical order). This means that a/bash will be upgraded before a/glibc-solibs. If bash has been recompiled against newer glibc, and you upgrade to that new version, it will promptly stop working due to the fact that the needed version of glibc has not been upgraded yet; at that point, you are stuck with a "chicken and egg" problem.
2. Third party package tools will not install *new* packages that have been added in Slackware -current. This is not a bug - it's a feature; if you purposefully didn't install something, then you don't want your automatic package updater reinstalling it. However, when a package depends on something else that has been added or split out of an existing package, and your add-on package manager upgrades the existing package but doesn't install the added one, then the (upgraded) existing package will not work any more.

= Solutions and Suggestions =

For upgrading to Slackware -current, there is only *one* supported method: <tt>UPGRADE.TXT</tt> -- you can find this file on any Slackware mirror. Note that this is also the only supported method to upgrade from one stable release of Slackware to another.

For keeping up to date on post-release patches added to a stable release of Slackware, you will *usually* be okay to use one of the third party package managers. You should still read the <tt>ChangeLog.txt</tt> before doing any upgrades, though, as new packages are occasionally added in /patches when circumstances require it.

For software not included in official Slackware, consider building it yourself or using a SlackBuild script from one of the projects which provides them.

One of the regular Slackware contributors, PiterPUNK, wrote and maintains a third-party package manager that minimizes all of the risks mentioned above. [http://slackpkg.org Slackpkg] does not support downloading or installing unofficial packages, and it has provisions to install any added packages and uninstall any removed packages as well as the normal install/upgrade/remove routines.

Another third party package manager that promotes good practices is [http://slackroll.sourceforge.net/ SlackRoll] (see [[SlackRoll Tutorial|tutorial]]). Its philosophy is similar to that of Slackpkg but it is not included as part of Slackware. Programmed in Python, it is faster, has more features and detects more events from Slackware -current. However, the initial setup and workflow are a bit more complex.

= See Also =

* <tt>pkgtool(8)</tt> -- man 8 pkgtool
* <tt>installpkg(8)</tt> -- man 8 installpkg
* <tt>removepkg(8)</tt> -- man 8 removepkg
* <tt>upgradepkg(8)</tt> -- man 8 upgradepkg
* <tt>makepkg(8)</tt> -- man 8 makepkg
* <tt>explodepkg(8)</tt> -- man 8 explodepkg

= TODO =

* Add links to other wiki pages that are related to this topic (add to "See Also" above)
* Add hyperlinks to slapt-get, swaret, and other projects mentioned on this page
* Others?

[[Category:Information]]
[[Category:Tutorials]]

Category:Security:SSA

2012-02-10T14:30:07Z

Erik: mozilla-* up to date

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] (PRNG weakness) affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

=== curl ===
==== [http://curl.haxx.se/docs/adv_20120124.html CVE-2012-0036] (Execute Code) affected: current, and all before ====
curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs.

==== [http://curl.haxx.se/docs/adv_20120124B.html CVE-2011-3389] (man-in-the-middle attacks) affected: current, 13.37 ====
curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

Category:Security:SSA

2012-02-10T14:29:23Z

Erik: php up to date

Category:Security:SSA

2012-02-10T14:28:47Z

Erik: proftpd up to date

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] (PRNG weakness) affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected: current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

=== curl ===
==== [http://curl.haxx.se/docs/adv_20120124.html CVE-2012-0036] (Execute Code) affected: current, and all before ====
curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs.

==== [http://curl.haxx.se/docs/adv_20120124B.html CVE-2011-3389] (man-in-the-middle attacks) affected: current, 13.37 ====
curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

=== mozilla-firefox (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/firefox.html#firefox9, at LEAST:

Fixed in Firefox 9:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

=== mozilla-thunderbird (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html#thunderbird9, at LEAST:

Fixed in Thunderbird 9:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

=== seamonkey (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html#seamonkey2.6, at LEAST:

Fixed in SeaMonkey 2.6:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

Category:Security:SSA

2012-02-10T14:28:17Z

Erik: httpd up to date

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] (PRNG weakness) affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code) affected: current, 13.37, and all before ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected: current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

=== curl ===
==== [http://curl.haxx.se/docs/adv_20120124.html CVE-2012-0036] (Execute Code) affected: current, and all before ====
curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs.

==== [http://curl.haxx.se/docs/adv_20120124B.html CVE-2011-3389] (man-in-the-middle attacks) affected: current, 13.37 ====
curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

=== mozilla-firefox (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/firefox.html#firefox9, at LEAST:

Fixed in Firefox 9:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

=== mozilla-thunderbird (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html#thunderbird9, at LEAST:

Fixed in Thunderbird 9:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

=== seamonkey (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html#seamonkey2.6, at LEAST:

Fixed in SeaMonkey 2.6:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

Category:Security:SSA

2012-02-04T02:34:56Z

Erik: freetype2 up to date

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] (PRNG weakness) affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (Denial Of Service) affected: current, 13.37 and all before ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges) affected: current, 13.37 and all before ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] affected: current, 13.37 and all before ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code) affected: current, 13.37, and all before ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected: current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

=== curl ===
==== [http://curl.haxx.se/docs/adv_20120124.html CVE-2012-0036] (Execute Code) affected: current, and all before ====
curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs.

==== [http://curl.haxx.se/docs/adv_20120124B.html CVE-2011-3389] (man-in-the-middle attacks) affected: current, 13.37 ====
curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

=== mozilla-firefox (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/firefox.html#firefox9, at LEAST:

Fixed in Firefox 9:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

=== mozilla-thunderbird (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html#thunderbird9, at LEAST:

Fixed in Thunderbird 9:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

=== seamonkey (various issues, all versions impacted) ===
From http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html#seamonkey2.6, at LEAST:

Fixed in SeaMonkey 2.6:
*MFSA 2011-58 Crash scaling <video> to extreme sizes
*MFSA 2011-57 Crash when plugin removes itself on Mac OS X
*MFSA 2011-56 Key detection without JavaScript via SVG animation
*MFSA 2011-55 nsSVGValue out-of-bounds access
*MFSA 2011-54 Potentially exploitable crash in the YARR regular expression library
*MFSA 2011-53 Miscellaneous memory safety hazards (rv:9.0)

Category:Security:SSA

2012-01-30T22:58:14Z

Erik: minor changes for consistency

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected: current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
==== [http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705] affected: current, 13.37 and all before ====
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

==== [http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188] (Denial Of Service, Execute Code) affected: current, 13.37 and all before ====
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected: current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected: current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected: current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected: current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (Denial Of Service) affected: current, 13.37 and all before ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges) affected: current, 13.37 and all before ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] affected: current, 13.37 and all before ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected: current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected: current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected: current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected: current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected: current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected: current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] affected: current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected: current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected: current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code) affected: current, 13.37, and all before ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected: current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected: current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow) affected: current, 13.37 and all before ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected: current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected: current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected: current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected: current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected: current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected: current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

Category:Security:SSA

2012-01-30T19:26:27Z

Erik:

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected : current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected : current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected : current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
[http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705]
[http://cvedetails.com/cve/CVE-2011-1004 CVE-2011-1004]
[http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188]

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected : current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected : current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected : current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected : current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (DoS, affected : current, 13.37 and all before) ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges, affected : current, 13.37 and all before) ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] (affected : current, 13.37 and all before) ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected : current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected : current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected : current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected : current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected : current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected : current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected : current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] affected : current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected : current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected : current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code, affected : current, 13.37, and all before) ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected : current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected : current, 13.37 through 12.0 ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow, current, 13.37 and all before) ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected : current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected : current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected : current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected : current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected : current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

Category:Security:SSA

2012-01-30T19:04:49Z

Erik:

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected : current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected : current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (Denial Of Service, Overflow, Memory corruption) affected : current, 13.37 through 10.0 ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
[http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705]
[http://cvedetails.com/cve/CVE-2011-1004 CVE-2011-1004]
[http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188]

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected : current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected : current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected : current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected : current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (DoS, affected : current, 13.37 and all before) ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges, affected : current, 13.37 and all before) ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] (affected : current, 13.37 and all before) ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected : current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected : current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected : current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected : current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected : current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected : current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected : current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] affected : current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected : current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected : current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code, affected : current, 13.37, and all before) ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected : current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected : current ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow, current, 13.37 and all before) ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected : current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected : current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected : current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected : current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected : current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

Category:Security:SSA

2012-01-30T18:59:23Z

Erik: added dhcp details

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected : current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected : current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (DDoS, affected: current and stable) ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
[http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705]
[http://cvedetails.com/cve/CVE-2011-1004 CVE-2011-1004]
[http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188]

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected : current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected : current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected : current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected : current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (DoS, affected : current, 13.37 and all before) ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges, affected : current, 13.37 and all before) ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] (affected : current, 13.37 and all before) ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
==== [http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868] (Denial Of Service) affected : current, 13.37, and all before ====
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.

==== [http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539] (Denial Of Service) affected : current, 13.37, 13.1 ====
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.

==== [http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749] (Denial Of Service) affected : current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.

==== [http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748] (Denial Of Service) affected : current, 13.37, and all before ====
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected : current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected : current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected : current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] affected : current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected : current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected : current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code, affected : current, 13.37, and all before) ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected : current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected : current ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow, current, 13.37 and all before) ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected : current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected : current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected : current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected : current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected : current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

Category:Security:SSA

2012-01-30T18:43:53Z

Erik: added openssl details

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected : current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected : current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (DDoS, affected: current and stable) ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
[http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705]
[http://cvedetails.com/cve/CVE-2011-1004 CVE-2011-1004]
[http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188]

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected : current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected : current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected : current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected : current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (DoS, affected : current, 13.37 and all before) ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges, affected : current, 13.37 and all before) ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] (affected : current, 13.37 and all before) ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
[http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868]
[http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539]
[http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749]
[http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748]

=== openssl ===
==== [http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027] (Denial Of Service) affected : current, 13.37, and all before ====
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.

==== [http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619] (Denial Of Service) affected : current, 13.37, and all before ====
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service via unspecified vectors.

==== [http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576] (Obtain Information) affected : current, 13.37, and all before ====
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

==== [http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109] affected : current, 13.37 through 11.0 ====
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

==== [http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108] affected : current, 13.37, and all before ====
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

==== [http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210] (Denial Of Service) affected : current, 13.37 through 11.0 ====
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code, affected : current, 13.37, and all before) ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected : current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected : current ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow, current, 13.37 and all before) ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected : current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected : current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected : current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected : current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected : current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

Category:Security:SSA

2012-01-30T18:25:18Z

Erik: added t1lib details

Slackware has recently started to be inactive. At the same time, a number of security issues have been found in various components. This page aims at listing them in order to help everyone know which components have known vulnerabilities.

The list below is provided as-is. It is meant to be as good as possible but we can't guarantee anything. It is sorted by slackware categories: a/, ap/, d/, ...

A more comprehensive effort might appear at some point in the future (binary packages?) but this is currently only a list of packages and their CVEs when applicable and useful. In some cases, we consider pointing out a specific CVE is not useful because of the number of issues (i.e. get the last version; e.g. mozilla-*).

The CVEs are typically listed as follow:
${SUMMARY}
* Fix:
** Fixed upstream on: ${DATE}
** Available in version: ${UPSTREAM_VERSION_WITH_FIX} (-current ${VERSION_IN_CURRENT}; -stable: ${VERSION_IN_13_37})
** Upstream commit: ${URL_TO_THE_SPECIFIC_FIX_COMMIT}

== a ==
=== cups ===
==== [http://cvedetails.com/cve/CVE-2011-3170 CVE-2011-3170] (Execute Code, Overflow) affected : current, 13.37 and all before ====
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.

==== [http://cvedetails.com/cve/CVE-2011-2896 CVE-2011-2896] (Execute Code, Overflow) affected : current, 13.37 and all before ====
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.

== d ==
=== perl ===
==== [http://cvedetails.com/cve/CVE-2011-2939 CVE-2011-2939] (DDoS, affected: current and stable) ====
Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2939 (on cve.mitre.org)].
* Fix:
** Fixed upstream on: Tue, 9 Aug 2011
** Available in version: 5.14.2 (-current: 5.14.0; -stable: 5.12.3)
** Commit: http://perl5.git.perl.org/perl.git/commitdiff/e46d973584785af1f445c4dedbee4243419cb860#patch5

=== ruby ===
[http://cvedetails.com/cve/CVE-2011-2705 CVE-2011-2705]
[http://cvedetails.com/cve/CVE-2011-1004 CVE-2011-1004]
[http://cvedetails.com/cve/CVE-2011-0188 CVE-2011-0188]

== e ==
=== emacs ===

== k ==
=== kernel ===

== l ==
=== t1lib ===
==== [http://cvedetails.com/cve/CVE-2011-1554 CVE-2011-1554] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1553 CVE-2011-1553] (Denial Of Service) affected : current, 13.37 and all before ====
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-1552 CVE-2011-1552] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.

==== [http://cvedetails.com/cve/CVE-2011-0764 CVE-2011-0764] (Execute Code) affected : current, 13.37 and all before ====
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6 and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.

=== freetype2 ===
==== [http://cvedetails.com/cve/CVE-2011-0226 CVE-2011-0226] (Denial Of Service, Execute Code, Memory corruption) affected : current, 13.37 and all before ====
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.

=== libxml2 ===
==== [http://cvedetails.com/cve/CVE-2011-1944 CVE-2011-1944] (Denial Of Service, Execute Code, Overflow) affected : current, 13.37 and all before ====
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.

== n ==
=== httpd ===
==== [http://cvedetails.com/cve/CVE-2011-4415 CVE-2011-4415] (DoS, affected : current, 13.37 and all before) ====
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.

==== [http://cvedetails.com/cve/CVE-2011-3607 CVE-2011-3607] (Overflow, Gain privileges, affected : current, 13.37 and all before) ====
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

==== [http://cvedetails.com/cve/CVE-2011-3368 CVE-2011-3368] (affected : current, 13.37 and all before) ====
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

=== dhcp ===
[http://cvedetails.com/cve/CVE-2011-4868 CVE-2011-4868]
[http://cvedetails.com/cve/CVE-2011-4539 CVE-2011-4539]
[http://cvedetails.com/cve/CVE-2011-2749 CVE-2011-2749]
[http://cvedetails.com/cve/CVE-2011-2748 CVE-2011-2748]

=== openssl ===
[http://cvedetails.com/cve/CVE-2012-0027 CVE-2012-0027]
[http://cvedetails.com/cve/CVE-2011-4619 CVE-2011-4619]
[http://cvedetails.com/cve/CVE-2011-4576 CVE-2011-4576]
[http://cvedetails.com/cve/CVE-2011-4109 CVE-2011-4109]
[http://cvedetails.com/cve/CVE-2011-4108 CVE-2011-4108]
[http://cvedetails.com/cve/CVE-2011-3210 CVE-2011-3210]

=== proftpd ===
==== [http://cvedetails.com/cve/CVE-2011-4130 CVE-2011-4130] (Execute Code, affected : current, 13.37, and all before) ====
([http://bugs.proftpd.org/show_bug.cgi?id=3711 proftpd bug tracker #3711])

Use-after-free vulnerability in the Response API in ProFTPD '''before 1.3.3g''' allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

=== php ===
==== [http://cvedetails.com/cve/CVE-2011-4885 CVE-2011-4885] (Denial Of Service) affected : current, 13.37 and all before ====
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

==== [http://cvedetails.com/cve/CVE-2011-3379 CVE-2011-3379] (Execute Code) affected : current ====
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

== x ==
=== libXfont ===
==== [http://cvedetails.com/cve/CVE-2011-2895 CVE-2011-2895] (Execute Code, Overflow, current, 13.37 and all before) ====
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.

== xap ==
=== pidgin ===
==== [http://cvedetails.com/cve/CVE-2011-4603 CVE-2011-4603] (Denial Of Service) affected : current, 13.37 and all before ====
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.

==== [http://cvedetails.com/cve/CVE-2011-4602 CVE-2011-4602] (Denial Of Service) affected : current, 13.37 and all before ====
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.

==== [http://cvedetails.com/cve/CVE-2011-4601 CVE-2011-4601] (Denial Of Service) affected : current, 13.37 and all before ====
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.

==== [http://cvedetails.com/cve/CVE-2011-3594 CVE-2011-3594] (Denial Of Service, Overflow) affected : current, 13.37 and all before ====
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.

==== [http://cvedetails.com/cve/CVE-2011-3184 CVE-2011-3184] (Denial Of Service) affected : current, 13.37 and all before ====
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.

==== [http://cvedetails.com/cve/CVE-2011-2943 CVE-2011-2943] (Denial Of Service) affected : current, 13.37 and all before ====
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.

Category:Security:SSA

2012-01-30T18:15:00Z

Erik: added cups details

Category:Security:SSA

2012-01-30T18:07:24Z

Erik: added libxml2 details

Category:Security:SSA

2012-01-30T18:04:41Z

Erik: added freetype2 details

Category:Security:SSA

2012-01-30T18:00:36Z

Erik: make more CVEs into links

Category:Security:SSA

2012-01-30T17:51:15Z

Erik: seperate php CVEs

Category:Security:SSA

2012-01-30T17:33:01Z

Erik:

Category:Security:SSA

2012-01-30T17:31:45Z

Erik: details for pidgin

The Regulars

2012-01-30T04:19:41Z

Erik:

==Staff==
* [[User:Alan_Hicks|Alan Hicks]]
* [[User:alienbob|alienBOB]]
* nachox/darkjoker
* [[User:phrag|phrag]]
* [[User:rworkman|rworkman]]
* [[User:Stx|Stx]]
* [[User:Unixfool|Unixfool/W|GGL|T]]

==Others==

* [[User:Adioe3|adioe3]]
* [[User:Alisonken1|Alisonken1]]
* [[User:Apeitheo|Apeitheo]]
* [[User:Boojit|boojit]]
* [[User:Michiel |BP{k}]]
* [[User:Buzzedlightyear|Buzzedlightyear]]
* [[User:chopp|chopp]]
* [[User:Chrismo|Chrismo]]
* [[User:clavius|clavius]]
* [[USer:codermaniac|codermaniac]]
* [[User:Crudo|crudo]]
* [[User:Crypticlineage|crypticlineage]]
* [[User:dadexter|dadexter]]
* [[User:dchmelik|dchmelik]]
* [[User:derxob|derxob]]
* [[User:Dominian|Dominian]]
* dtanner
* [[eclipse75]]
* [[User:Erik|erik]]
* [[User:FredEmmott|fred]]
* [[User:giangy|giangy]]
* [[User:jcm |jcm]]
* [[User:jpipkin |jpipkin]]
* [[User:macavity|macavity]]
* [[User:Marcus | Marcus_]]
* [[User:Mmlj4|mmlj4]]
* [[User:natex|natex]]
* [[USer:Phoul|Phoul]]
* [[User:Dardan Fejzullahi |radiohead]]
* [[User:radi0head|radi0head]]
* Riddick
* [[User:robert-brown|robert-brown]]
* [[User:1337ln | ron1n]]
* [[User:Ryanx0r|Ryanx0r]]
* [[USer:slackmagic|slackmagic]]
* [[User:Slakmagik|slakmagik]]
* [[StevenR]]
* [[User:Straterra|Straterra]]
* [[USer:Strykar|Strykar]]
* [[User:tecky|tecky]]
* [[User:Tewmten|tewmten]]
* [[User:v3ctor|v3ctor]]
* [[User:Zordrak|Zordrak]]

==SlackWiki Admins==
There is a [[Special:Listadmins|list]] of SlackWiki admins. Please contact one if you think you'd be a suitable admin.

The Regulars

2012-01-30T04:18:02Z

Erik: cpunches is not a regular

==Staff==
* [[User:Alan_Hicks|Alan Hicks]]
* [[User:alienbob|alienBOB]]
* nachox/darkjoker
* [[User:phrag|phrag]]
* [[User:rworkman|rworkman]]
* [[User:Stx|Stx]]
* [[User:Unixfool|Unixfool/W|GGL|T]]

==Others==

* [[User:Adioe3|adioe3]]
* [[User:Alisonken1|Alisonken1]]
* [[User:Apeitheo|Apeitheo]]
* [[User:Boojit|boojit]]
* [[User:Michiel |BP{k}]]
* [[User:Buzzedlightyear|Buzzedlightyear]]
* [[User:chopp|chopp]]
* [[User:Chrismo|Chrismo]]
* [[User:clavius|clavius]]
* [[USer:codermaniac|codermaniac]]
* [[User:Crudo|crudo]]
* [[User:Crypticlineage|crypticlineage]]
* [[User:dadexter|dadexter]]
* [[User:dchmelik|dchmelik]]
* [[User:derxob|derxob]]
* [[User:Dominian|Dominian]]
* dtanner
* [[eclipse75]]
* [[User:Erik|erik]]
* [[User:FredEmmott|fred]]
* [[User:giangy|giangy]]
* [[User:jcm |jcm]]
* [[User:jpipkin |jpipkin]]
* [[User:macavity|macavity]]
* [[User:Marcus | Marcus_]]
* [[User:Mmlj4|mmlj4]]
* [[USer:Phoul|Phoul]]
* [[User:Dardan Fejzullahi |radiohead]]
* [[User:radi0head|radi0head]]
* Riddick
* [[User:robert-brown|robert-brown]]
* [[User:1337ln | ron1n]]
* [[User:Ryanx0r|Ryanx0r]]
* [[USer:slackmagic|slackmagic]]
* [[User:Slakmagik|slakmagik]]
* [[StevenR]]
* [[User:Straterra|Straterra]]
* [[USer:Strykar|Strykar]]
* [[User:tecky|tecky]]
* [[User:Tewmten|tewmten]]
* [[User:v3ctor|v3ctor]]
* [[User:Zordrak|Zordrak]]
* [[User:natex|natex]]

==SlackWiki Admins==
There is a [[Special:Listadmins|list]] of SlackWiki admins. Please contact one if you think you'd be a suitable admin.

User talk:Merge-delete

2012-01-30T03:52:30Z

Erik: moved User talk:Amanda27 to User talk:Merge-delete: Automatically moved page while merging the user "Amanda27" to "Merge-delete"

Boutique Hotels In India

Indulge yourself in sheer luxury throughout your remain in boutique hotels in India.[http://hotelslonavala.net/ hotels in lonavala] These are the places where one can live like rajas and maharajas. They're simply unique within their architecture and hang up where one can get highly personalized services inside a distinctive manner. They are heritage hotels that supply you with a unique connection with living existence.[http://hotelslonavala.net/ hotels in lonavala] Just opposite to western style hotels, these places permit you to know and have the wealthy culture and history of India.

On a trip from the beaten tracks in India, you might find several boutique hotels where one can unwind yourself and also have home-cooked food. With enchanting folk music, amazing architecture, peace and exceptional hospitality, these hotels can bring alive the times of rajas and maharajas of older occasions. Their architecture, gardens, food and luxuries echo from the glorious past of India. Although you will find several hotels in India but when youre searching for best hotels, then certainly Rajasthan may be the condition that you need to visit whenever you arrived at India.

You will find several havelis-converted-hotels in Rajasthan where you can unwind yourself and dip your senses in luxury. Remaining during these hotels is definitely an entirely different experience. Youll feel like you aren't nowadays. For experience a completely different lifestyle, you have to visit these hotels and spend your trip. Trust, youll possess a lifetime experience. The deserted great thing about Rajasthan and wealthy tradition enables you to definitely go through the luxury in simplicity. You no more have to pretend as possible be genuine and do what youve always loved.

The best hotels in Rajasthan are Rawla Narlai, Raas Hotel, The Serai, Udai Kothi, Bhainsrorgarh and Devigarh. From the sights of those hotels, regal inside and grass to authentic antiques, lodging and fooding may be worth admiring. You seem like wandering within the deserts, going through the wonder, studying wealthy tradition, listening folk music and gorging on local meals. Several companies offer vacation packages to Rajasthan. Whenever you arrived at India, you just cant manage to miss these places. They feature glorious past of India.

User:Erik

2012-01-29T18:41:28Z

Erik:

Name: [mailto:erik@sl1200.org Erik Hanson] 
Web: [http://sl1200.org/~erik/ http://sl1200s.org/~erik/] 
IRC: [irc://frop.taphouse.org/ Taphouse Cabal] [irc://irc.efnet.org/ EFnet] [irc://chat.freenode.net/ The Freenode Network] 

<math>\phi_n(\kappa) = \frac{1}{4\pi^2\kappa^2} \int_0^\infty \frac{\sin(\kappa R)}{\kappa R} \frac{\partial}{\partial R}\left[R^2\frac{\partial D_n(R)}{\partial R}\right]\,dR</math>

User:Erik

2012-01-27T19:09:24Z

Erik:

SlackBuild Scripts

2012-01-24T19:52:10Z

Erik: Removed offline/404 sites

SlackBuild scripts are simple shell scripts which can automate the compiling and packaging of a program from source.

While not necessary to compile and create packages on Slackware, SlackBuilds serve as tools for scripting the compiling and packaging processes, which are often repetitive. Just as importantly, SlackBuilds also act as documentation of compile-time options and configurations for that particular package. For that reason, official Slackware packages come with SlackBuilds bundled with the source code, and the inclusion of a SlackBuild is desirable in third-party packages.

== Using SlackBuild Scripts ==
In this example I'm going to use the [http://www.pidgin.im Pidgin] slackbuild. First you find on the mirror in the source directory and download the whole directory of Pidgin:

: <code>mkdir pidgin</code>
: <code>cd pidgin</code>
: <code>wget --passive-ftp <nowiki>ftp://slackware.at/slackware-12.1/source/xap/pidgin/*</nowiki></code>

This downloads the files needed for Slackware scripts. The same idea applies for SlackBuild scripts from other
sources - you generally need to download all of the files in the directory that contains the build script. For example, in the pidgin source directory, you would need the following files:

: <code>pidgin-2.4.1.tar.bz2 pidgin-encryption-3.0.tar.gz pidgin.SlackBuild* slack-desc </code>

There will sometimes be other files, such as doinst.sh, diff.gz patch files, and rc.* scripts in this directory.

Now, say you want to get the newest version of pidgin? Well, you download the tar.bz2 file (in Pidgin, the script uses tar.bz2). Now you open up pidgin.Slackbuild:

: <code>VERSION=2.4.1</code>

This is the line we are looking at. Now we can change this to

: <code>VERSION=2.4.2</code>

Now you can edit the compile flags and other cool things not covered here. Now that we have downloaded and edited the SlackBuild script, let's make it executable:

: <code>chmod +x pidgin.SlackBuild</code>

Now this is executable, and we want to run as root for permissions and other reasons so we want to become root:

: <code>su -</code>

Now we start the script, and this will compile Pidgin and make a Slackware package. Depending on how the
script is written, the resulting package will be in /tmp, some directory of /tmp, or perhaps some
other location - have a look at the SlackBuild script for some hints if you can't find the package that
was built.

Once you find the package, you simply use 'installpkg' to install it normally (and you probably want to
move it somewhere else on your system for safekeeping).

: <code>./pidgin.SlackBuild</code>

=SlackBuild Archives=
;* http://www.slackbuilds.org
;* http://repository.slacky.eu
;* http://www.slackware.com/~alien/slackbuilds/

=Other Resources=
For a bit more detailed tutorial, see this entry: [[Writing A SlackBuild Script]]

[[Category:Tutorials]]

Writing A SlackBuild Script

2012-01-24T19:47:42Z

Erik: Removed offline/404 sites

[[Category:Tutorials]]

= Introduction =

Originally written by Florian Mueller jjdm@jjdm.org
Substantial cleanup and enhancement by Robby Workman (rworkman)

If you use slackware as your main operating system, you have probably wanted to install quite a few applications which are not available in the official slackware.com or even third-party repositories like linuxpackages.net, or perhaps you just don't like using third-party packages. In this situation, you have several options on how to install the application:

* ./configure && make && make install
* use checkinstall
* use installwatch
* compile and use makepkg by hand
* write a SlackBuild script

I will go through the last option: writing [[SlackBuild Scripts]] (which combines the best qualities of all the other aforementioned methods). With a SlackBuild script, you have the build process automated, which will allow you to easily do later upgrades or patches to the package. SlackBuild scripts are also the method by which Patrick Volkerding builds all of the official packages for Slackware. If you look at the various scripts from different sources, you will notice that there is generally an application-independent portion of a script and an application-specific portion of the script.

I cannot teach you how to build the "perfect" package, as reaching that goal requires fairly in-depth knowledge of the Slackware operating system. You must consider the interactions of your proposed package with all of the other packages within the distribution; they must be integrated seamlessly. What I can teach you is how to build a package that works and which stays true to the "Slackware Way."

"But it takes so much time!"

It will take approximately thirty minutes to go through this tutorial and about fifteen minutes to create each package (actual compile process not included), but the time you save in the future (you want to create a newer version of the package) makes the initial time expenditure worth it.

= The Slackware package structure =

See [[Packages#Slackware Package Layout]]

= Setting up your build environment =

See [[Build_Environment]] for examples of how various users do this.

= Getting Started =

Hopefully, everything is now clear about Slackware package structure, and you have set up a clean build environment, so we'll begin the process of building a package with a SlackBuild script.

For this example, we'll create a package of latex2html - I made my homepage with that tool.

First, you have to create a directory named <build_environment>/latex2html/. Get the most recent source code release of latex2html place it in this directory. Note that use of wget below to obtain the most recent source code is optional - you can just as well use your favorite web browser to download it, and then move it into the correct directory.

$ cd <build_environment>
$ mkdir latex2html
$ cd latex2html
$ wget http://saftsack.fs.uni-bayreuth.de/~latex2ht/current/latex2html-2002-2-1.tar.gz # 05.02.2005

Next, we'll create some other needed files with touch. If you're not familiar with touch, see:
man touch
Note that the *.SlackBuild file will always contain the name of the application for which it's written; for example, gaim would have gaim.SlackBuild.

$ touch latex2html.SlackBuild
$ touch slack-desc

Extract the source code of the application, because we'll need to look at the configure script later on to determine what options we need to pass to it.

$ tar -xzf latex2html-2002-2-1.tar.gz || exit 1

= Writing the slack-desc file =

See this [[Slack-desc]] page on SlackWiki.org for instructions on how to write a proper slack-desc file.

= Writing the SlackBuild script =

This is the section which takes the most time, and I'll go through it with you step by step. When you build more packages, you'll probably be able to just copy an existing SlackBuild script and customize it. First, you need to understand that you can write your SlackBuild script in any manner you choose so long as it creates a working package; the method described here is more or less the way Pat Volkerding [[http://slackware.com/~volkerdi]] does it, but even Pat has several different styles for writing the official SlackBuild scripts. Therefore, if you see something you would do a different way, feel free to do it that way - it's okay.

===Initial Setup===

Open the file latex2html.SlackBuild with your favourite editor. What follows below is a piece by piece walk-through of a working SlackBuild script. You may certainly paste the exact contents of those pieces, but in the author's opinion, you have a better chance of understanding it if you write everything yourself.

First, you'll need to set your shell interpreter. This should be /bin/sh, as *every* Slackware system is guaranteed to have this shell installed, and you want maximum portability. For this same reason, be careful not to use any extensions and/or syntax that is customized for your particular shell (bash, zsh, or whatever), as it won't be interpreted correctly. The '-e' flag tells the shell to exit on any error; this helps with both debugging your script as well as ensuring your script does not proceed in an unknown state.

#!/bin/sh -e

You might want to include a license of some sort with your SlackBuild script (preferably a GPL or BSD-style license), but at a minimum, you'll want something like this:

#<your name> revision date yyyy/mm/dd

With the next few lines, we set some variables that will be used throughout the script. First is the "CWD" variable; in our case, CWD will be <build_environment>/latex2html/. We also test if the TMP variable is set, and if not, we set it to /tmp.

#Set initial variables:

CWD=$(pwd)
if [ "$TMP" = "" ]; then
TMP=/tmp
fi

Some people like to build in a subdirectory of /tmp (such as /tmp/build), but that's up to you.

# The version which appears in the application's filename
VERSION=2002-2-1

# If the version conflicts with the Slackware package standard
# The dash character ("-") is not allowed in the VERSION string
# You can set the PKG_VERSION to something else than VERSION
PKG_VERSION=2002.2.1 # the version which appears in the package name.

ARCH=${ARCH:-i486} # the architecture on which you want to build your package

# First digit is the build number, which specifies how many times it has been built.
# Second string is the short form of the authors name, typical three initials:w
BUILD=${BUILD:-1_rlw}

# The application's name
APP=latex2html

# The installation directory of the package (where its actual directory
# structure will be created)
PKG=$TMP/package-$APP

Set SLKCFLAGS (which will be used for both CFLAGS and CXXFLAGS). If you are building on a system with an earlier version of gcc than 3.4.x, then you'll need to use "-mcpu" instead of "-mtune" below.

if [ "$ARCH" = "i486" ]; then
SLKCFLAGS="-O2 -march=i486 -mtune=i686"
elif [ "$ARCH" = "x86_64" ]; then
SLKCFLAGS="-O2 -fPIC"
fi

The section just finished sets up a few application-specific variables. When you want to create a package of some other application, you can usually just change the variables, and most of the further steps will work automatically.

=== Extract Sources ===

# Delete the leftover directories if they exist (due to a previous build)
# and (re)create the packaging directory
rm -rf $PKG
mkdir -p $TMP $PKG
rm -rf $TMP/$APP-$VERSION

# Change to the TMP directory
cd $TMP || exit 1

# Extract the application source in TMP
# Note: if your application comes as a tar.bz2, you need tar -jxvf
tar -zxvf $CWD/$APP-$VERSION.tar.gz || exit 1

# Change to the application source directory
cd $APP-$VERSION || exit 1

# Change ownership and permissions if necessary
# This may not be needed in some source tarballs, but it never hurts
chown -R root:root .
chmod -R u+w,go+r-w,a-s .

===Configure and Compile Sources===

# Set configure options
# If your app is written in C++, you'll also need to add a line for CXXFLAGS
CFLAGS="$SLKCFLAGS" \
./configure \
--prefix=/usr \
--sysconfdir=/etc \
--localstatedir=/var \
--with-perl=/usr/bin/perl \
--enable-eps \
--enable-gif \
--enable-png \
--build=$ARCH-slackware-linux \
--host=$ARCH-slackware-linux

# compile the source, but exit if anything goes wrong
make || exit

# Install everything into the package directory, but exit if anything goes wrong
make install DESTDIR=$PKG || exit

There are three configure options I always set:

* --prefix=/usr
* --sysconfdir=/etc
* --localstatedir=/var

This makes configuration files go to /etc, state files (such as log files) go to /var, and the rest goes to /usr. That's the usual Slackware way, but it's your system, so you can certainly install everything in /usr/local or some other location. See the Unix Filesystem Hierarchy Standard [[http://www.pathname.com/fhs/]] for more information on "correct" locations of various filetypes.

You notice that there were several other options passed to the configure script, and for each application you compile, you have to figure those out for yourself - that's why you were told to extract the sources earlier in this process. You simply cd into the source directory and run:
./configure --help
This will produce a page or two (sometimes more, though) of information about various options that are specific to the application. Read through this information and figure out what you need (I like to pipe that command through lpr to get a printed copy, but you can certainly use some sort of pager as well:
./configure --help | lpr
./configure --help | less

The DESTDIR variable is very important in this script because it specifies the directory in which the files should be installed. This should always be our package directory ($PKG). Unfortunately, some applications' Makefiles will not support the DESTDIR variable, so you can't use it for those apps. A simple line like this:
grep DESTDIR Makefile*
while inside the source directory should tell you whether it supports DESTDIR or not. If you get some lines of output with $DESTDIR in them, you're in good shape. If the command returns no output, then the Makefile does not support the DESTDIR variable.

Here's a piece of advice: ALWAYS go through the ./configure && make && make install DESTDIR=/somedir process manually and as a NORMAL USER account BEFORE you run your SlackBuild script. There are quite a few applications out there which try to do "funny stuff" during the installation phase.
For example, apcupsd will attempt to patch your /etc/rc.d/rc.6 init script
Yes, it's possible to avoid this with a configure option, but it's not obvious that you would need
to do so until you look at all of the Makefiles for apcupsd (or watch the install process)
Anyway, if you go through the process as a normal user, you will get "Permission Denied" errors and such if the install process tries to write anywhere it's not allowed to do so.

=== Install Documentation ===

# Create a directory for documentation
mkdir -p $PKG/usr/doc/$APP-$VERSION

# Copy documentation to the docs directory and fix permissions
cp -a BUGS Changes FAQ INSTALL LICENSE MANIFEST README TODO docs/ $PKG/usr/doc/$APP-$VERSION
find $PKG/usr/doc/$APP-$VERSION -type f -exec chmod 644 {} \;

I (rworkman) also like to place a copy of my SlackBuild script in this directory
cat $CWD/$APP.SlackBuild > $PKG/usr/doc/$APP-$VERSION/$APP.SlackBuild

Make sure you look inside the actual source archive of the application, because some applications won't have all of the documentation files specified above, and some applications will have additional files. In other words, don't just copy/paste what you see above into your SlackBuild script - you *must* customize this section for each individual application.

=== Final Touches ===

# Create the ./install directory and copy the slack-desc into it
mkdir -p $PKG/install
cat $CWD/slack-desc > $PKG/install/slack-desc

NOTE: In some cases, you will have some sort of command or setup that
needs to run after the package contents are installed - for this, you
would add a file to $CWD called "doinst.sh" which contains the needed
commands, and then compress that file with gzip. The SlackBuild script
will zcat (which means to gunzip and cat its contents) that file and
write the output to a doinst.sh file in the $PKG/install directory.

# Add doinst.sh to package (if it exists)
if [ -e $CWD/doinst.sh.gz ]; then
zcat $CWD/doinst.sh.gz > $PKG/install/doinst.sh
fi

Let's conserve space if we can; strip libraries and binaries and compress man pages with gzip
Note that you might be able to use "make install-strip" instead of "make install" above instead to accomplish the same purpose

# Strip some libraries and binaries
( cd $PKG
find . | xargs file | grep "executable" | grep ELF | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null
find . | xargs file | grep "shared object" | grep ELF | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null
)

# Compress man pages if they exist
if [ -d $PKG/usr/man ]; then
( cd $PKG/usr/man
find . -type f -exec gzip -9 {} \;
for i in $(find . -type l) ; do ln -s $(readlink $i).gz $i.gz ; rm $i ; done
)
fi

# Compress info pages if they exist (and remove the dir file)
if [ -d $PKG/usr/info ]; then
gzip -9 $PKG/usr/info/*.info
rm -f $PKG/usr/info/dir
fi

=== Build the Package ===

# Build the package
cd $PKG
/sbin/makepkg -l y -c n $TMP/$APP-$PKG_VERSION-$ARCH-$BUILD.tgz

= Other Concerns =

=== DESTDIR Option Not Available ===

As mentioned above, there are quite a few applications whose Makefiles do not support the DESTDIR option for make install. On some applications the DESTDIR Makefile variable has another name. For example, some Qt applications use the variable INSTALL_ROOT for the same purpose. If you can understand Makefiles, it is probably worth your time to take a look at its contents and try to find out which actions are performed in the install rule. Sometimes there will be no DESTDIR equivalent at all. The best thing you can do in this situation is write a patch for the Makefile.in or equivalent, and submit it to the developer(s) for inclusion in the source, but I realize that everyone doesn't have the ability to do that. The second best thing you can do it write to the developer(s) and ask them to include that functionality in future releases. In the meantime, here are some thoughts on the subject...

==== Example 1: ====
Configure the build with:
./configure --prefix=$PKG/usr
along with your other configure options. This will install *all* of the package contents in that directory. If the package creates $PKG/usr/etc and $PKG/usr/var directories (or any other directories that should be elsewhere), you can probably just move them to their correct location within the package directory tree and everything will be fine. You might also try this along with your other configure options.
./configure --prefix=$PKG/usr \
--sysconfdir=$PKG/etc \
--localstatedir=$PKG/var
There are some applications, however, which "hard-code" configuration files based on configure/Makefile parameters. In those cases, you'll have to figure out a way to patch the config file prior to packaging it, or in worst-case scenario, include instructions for the end user on how to make the necessary changes.

==== Example 2: ====
This example makes use of the ability to override any Makefile variable, which is called a '''macro''' in the Makefile terminology, on the command line and not have to worry about patching the Makefile to include a '''DESTDIR''' macro in the Makefile. This approach makes it a bit easier for those not familiar with Makefiles.

If the Makefile does not honor '''DESTDIR''' for the 'make install' command, you can change the prefix macro, instead:
make prefix=$PKG/usr install
This will override the $(prefix) variable inside the Makefile and install to the location you supplied on the command line. Therefore, you can configure with the standard ''./configure --prefix=/usr'' (or ''./configure --prefix=/usr/local'') syntax, yet install to a different location as if you supplied a ''DESTDIR=$PKG/usr'' for the 'make install' command.

IMPORTANT NOTE: Macro names are case-sensitive (at least for GNU make). Some Makefiles may use a "'''PREFIX ='''" macro instead of the usual "'''prefix ='''", so the 'make install' command would look like this:
make PREFIX=$PKG/usr install
Therefore, it's necessary to look inside the Makefile to be sure which form was used for the prefix. For large, complex makefiles, the easiest way is to 'grep' the Makefile, like so:
grep -i '^prefix \?=' Makefile{,.in}
The ''-i'' option makes the search case-insensitive and the ''{,.in}'' part at the end will search "Makefile" or "Makefile.in" files, the second one being a template for the "configure" script. Grep's search term is a basic regular expression, so the escaped question mark after the space (\?) means there may or may not be a space in between when searching.

Once in a while, there may be a "'''PREFIX ='''" in a Makefile that is not defined which you are to edit and supply the location. Use the usual ''/usr'' (or ''/usr/local''), in this case, and then use 'make PREFIX=$PKG/usr install' to install to the package's build location.

=== Patching the Sources ===

Sooner or later, there will be some reason to patch the source code prior to building a package, and you'll want to be able to do this automatically.

===== Obtaining the Patch =====

In most cases, the patch will be provided by the author of the source code, so we're not going to discuss patch *creation* here. Download the patch and place it in the same directory as the SlackBuild script, slack-desc file, and other related files (in $CWD from above).
$ wget http://someapplication.org/files/patches/bigsecuritypatch.diff
It's not necessary to do the next step, but because developers generally want to conserve space if possible, it's conventional to do this:
$ gzip -9 bigsecuritypatch.diff
This will result in a new file called bigsecuritypatch.diff.gz -- we'll use that in the SlackBuild script in just a moment.

===== Applying the Patch =====

You will now need to edit your <application>.SlackBuild script so that it applies the patch before it runs configure, make, and make install. To do this, you'll want something like this to run before the configure script, but after extracting the sources:
zcat $CWD/bigsecuritypatch.diff.gz | patch -p1 || exit
Depending on how the patch was created, you might use a different patchlevel on that line, as in:
zcat $CWD/bigsecuritypatch.diff.gz | patch -p0 || exit
It's a bit beyond the scope of this HOWTO, but essentially, the -p# specifies the number of trailing directories to skip when looking for the file to patch. You'll often need to skip the top-level directory, but not always (hence the -p0).

= See Also =

* [[SlackBuild_Scripts]]
* [[Different_Approach_To_Buildscripts]]
* [[Building_A_Package]]
* [[Slack-desc]]
* [[Checkinstall]]
* [[Compiling]]

= SlackBuild Script Repositories =

;* http://slackbuilds.org
;* http://www.slackware.com/~alien/slackbuilds/
;* http://slackbuilds.slackadelic.com/
;* http://slackbuilds.rlworkman.net/