There are two security updates available for Slackware 7.0 and 
slackware-current. Affected packages are gpm.tgz and the E series (Emacs).
Users are advised to upgrade these packages as soon as possible.

   ==================================   gpm 1.19.2 AVAILABLE - (a1/gpm.tgz)
   ==================================
      gpm was upgraded to 1.19.2 to fix remaining security problems in the
      gpm-root daemon.

   ================================   emacs 20.6 AVAILABLE - (e1/*.tgz)
   ================================
      The E series was upgraded to GNU emacs 20.6.  This upgraded the
      following packages:

         elisp.tgz
         emac_nox.tgz
         emacinfo.tgz
         emacleim.tgz
         emacmisc.tgz
         emacsbin.tgz

      The recent security patch posted to BugTraq by RUS-CERT, University
      of Stuttgart was applied before building the packages.  The holes
      fixed include:

         o   Under certain circumstances, unprivileged local users can
             eavesdrop the communication between Emacs and its subprocesses.

         o   It is impossible to safely create temporary files in a public
             directory from Emacs Lisp.

         o   The history of recently typed keys may expose passwords.

      The entire advisory (as well as the patch) can be read on
      ftp.slackware.com in:
         /pub/slackware/slackware-current/source/e/emacs-rus-cert.diff.gz

Separate patches will not be produced for the /patches directory in the
Slackware 7.0 distribution tree.  Users of Slackware 7.0 can download the
necessary packages from the Slackware-current tree and run upgradepkg to
install them.

It's generally a good idea to bring your system into runlevel 1 when doing
package upgrades, just to minimize error.

   # telinit 1
   # upgradepkg 
   # telinit 3

Remember, it's also a good idea to backup configuration files before upgrading
packages.

Slackware: emacs and gpm vulnerabilities

April 25, 2000
Unauthorized access and other security vulnerabilities are present in emacs and gpm for Slackware 7.0 and slackware-current.

Summary

Where Find New Packages

MD5 Signatures

Severity
There are two security updates available for Slackware 7.0 and slackware-current. Affected packages are gpm.tgz and the E series (Emacs). Users are advised to upgrade these packages as soon as possible.
================================== gpm 1.19.2 AVAILABLE - (a1/gpm.tgz) ================================== gpm was upgraded to 1.19.2 to fix remaining security problems in the gpm-root daemon.
================================ emacs 20.6 AVAILABLE - (e1/*.tgz) ================================ The E series was upgraded to GNU emacs 20.6. This upgraded the following packages:
elisp.tgz emac_nox.tgz emacinfo.tgz emacleim.tgz emacmisc.tgz emacsbin.tgz
The recent security patch posted to BugTraq by RUS-CERT, University of Stuttgart was applied before building the packages. The holes fixed include:
o Under certain circumstances, unprivileged local users can eavesdrop the communication between Emacs and its subprocesses.
o It is impossible to safely create temporary files in a public directory from Emacs Lisp.
o The history of recently typed keys may expose passwords.
The entire advisory (as well as the patch) can be read on ftp.slackware.com in: /pub/slackware/slackware-current/source/e/emacs-rus-cert.diff.gz
Separate patches will not be produced for the /patches directory in the Slackware 7.0 distribution tree. Users of Slackware 7.0 can download the necessary packages from the Slackware-current tree and run upgradepkg to install them.
It's generally a good idea to bring your system into runlevel 1 when doing package upgrades, just to minimize error.
# telinit 1 # upgradepkg # telinit 3
Remember, it's also a good idea to backup configuration files before upgrading packages.

Installation Instructions

Related News