Re: [blfs-book] [BLFS Trac] #10356: procmail: at least two CVE fixes

2018-02-08 Thread BLFS Trac via blfs-book 
#10356: procmail: at least two CVE fixes
-+-
 Reporter:  ken@…|   Owner:  ken@…
 Type:  enhancement  |  Status:  closed
 Priority:  high |   Milestone:  8.2
Component:  BOOK | Version:  SVN
 Severity:  normal   |  Resolution:  fixed
 Keywords:   |
-+-
Changes (by ken@…):

 * status:  assigned => closed
 * resolution:   => fixed


Comment:

 r19740

--
Ticket URL: 
BLFS Trac 
Beyond Linux From Scratch
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

[blfs-book] r19740 - in trunk/BOOK: . introduction/welcome networking/mailnews

2018-02-08 Thread via blfs-book 
Author: ken
Date: Thu Feb  8 23:41:07 2018
New Revision: 19740

Log:
Patch procmail for various issues.

Modified:
   trunk/BOOK/general.ent
   trunk/BOOK/introduction/welcome/changelog.xml
   trunk/BOOK/networking/mailnews/procmail.xml

Modified: trunk/BOOK/general.ent
==
--- trunk/BOOK/general.ent  Thu Feb  8 13:49:09 2018(r19739)
+++ trunk/BOOK/general.ent  Thu Feb  8 23:41:07 2018(r19740)
@@ -1,12 +1,12 @@
 
 
-   
+   

 
 
 
 
-
+
  
   
   

Modified: trunk/BOOK/introduction/welcome/changelog.xml
==
--- trunk/BOOK/introduction/welcome/changelog.xml   Thu Feb  8 13:49:09 
2018(r19739)
+++ trunk/BOOK/introduction/welcome/changelog.xml   Thu Feb  8 23:41:07 
2018(r19740)
@@ -42,6 +42,16 @@
 
 -->
 
+  February 10th, 2018
+  
+
+  [ken] - Patch procmail to fix security issues. Fixes
+  #10356.
+
+  
+
+
+
   February 8th, 2018
   
 

Modified: trunk/BOOK/networking/mailnews/procmail.xml
==
--- trunk/BOOK/networking/mailnews/procmail.xml Thu Feb  8 13:49:09 2018
(r19739)
+++ trunk/BOOK/networking/mailnews/procmail.xml Thu Feb  8 23:41:07 2018
(r19740)
@@ -56,6 +56,16 @@
   
 
 
+Additional Downloads
+
+  
+
+  Required patch:
+  
+
+  
+
+
 Procmail Dependencies
 
 Recommended
@@ -76,9 +86,10 @@
 Install Procmail by running the following
 commands as the root user:
 
-sed -i 's/getline/get_line/' src/*.[ch] 

+sed -i 's/getline/get_line/' src/*.[ch] 
  
+patch -Np1 -i ../procmail--consolidated_fixes-1.patch 

 
-make LOCKINGTEST=/tmp MANDIR=/usr/share/man install 
+make LOCKINGTEST=/tmp MANDIR=/usr/share/man install   
 make install-suid
 
   
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

[blfs-book] BLFS Package Currency Check - 2018-02-09 06:45:01 GMT

2018-02-08 Thread via blfs-book 
BLFS PackageBLFS Version  Latest  Ticket
chapter 09: enchant 2.2.12.2.3#10299
chapter 09: exempi  2.4.32.4.4#10344
chapter 09: libblockdev 2.15 2.16 
chapter 09: libwacom0.27 0.28 #10352
chapter 10: fribidi 0.19.7   1.98 #10345
chapter 10: qpdf7.1.07.1.1#10346
chapter 11: ImageMagick66.9.9-23 6.9.9-34 #7859
chapter 11: ImageMagick77.0.7-11 7.0.7-22 #7859
chapter 12: dbus1.12.2   1.12.4   
chapter 12: udisks2 2.7.52.7.6
chapter 14: NetworkManager  1.10.2   1.10.4   #10348
chapter 14: samba   4.7.44.7.5#10353
chapter 17: alpine  2.21 2.21.99  #10188
chapter 20: dovecot 2.2.33.2 2.3.0#10209
chapter 20: postgresql  10.1 10.2 
chapter 24: xf86-input-wacom0.35.0   0.36.0   #10297
chapter 26: oxygen-icons5   5.41.0   5.43.0   #10239
chapter 29: extra-cmake-modules 5.41.0   5.43.0   #10239
chapter 32: kf5 5.41 5.43 #10239
chapter 32: kf5-apps17.12.0  17.12.2  #10245
chapter 32: plasma5 5.11.4   5.12.0   #10229
chapter 35: evolution-data-serve3.26.4   3.26.5   #10349
chapter 35: gvfs1.34.1   1.34.2   #10350
chapter 35: tracker 2.0.22.0.3#10351
chapter 36: evolution   3.26.4   3.26.5   #10349
chapter 36: gnome-logs  3.26.2   3.26.3   #10336
chapter 36: gnome-power-manager 3.24.0   3.26.0   #10329
chapter 37: parole  0.8.10.9.2#8870
chapter 37: thunar-volman   0.8.10.9.0#10163
chapter 39: kguiaddons  5.41.0   5.43.0   #10239
chapter 39: kidletime   5.41.0   5.43.0   #10239
chapter 39: kwindowsystem   5.41.0   5.43.0   #10239
chapter 39: libkscreen  5.11.4   5.12.0   #10229
chapter 39: solid   5.41.0   5.43.0   #10239
chapter 43: chromium64.0.3282.11964.0.3282.140#10337
chapter 43: libreoffice 5.4.4.2  6.0.1.1  #10331
chapter 43: seamonkey   2.49.1   2.49.2   #10355
chapter 43: thunderbird 52.5.2   52.6.0   #10306
chapter 44: x26420170822 daily#7555
chapter 45: kwave   17.12.0  17.12.2  #10245
chapter 45: vlc 2.2.83.0.0

-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

Re: [blfs-book] [BLFS Trac] #10356: procmail: at least two CVE fixes

2018-02-08 Thread BLFS Trac via blfs-book 
#10356: procmail: at least two CVE fixes
-+---
 Reporter:  ken@…|   Owner:  ken@…
 Type:  enhancement  |  Status:  assigned
 Priority:  high |   Milestone:  8.2
Component:  BOOK | Version:  SVN
 Severity:  normal   |  Resolution:
 Keywords:   |
-+---
Changes (by ken@…):

 * owner:  blfs-book@… => ken@…
 * status:  new => assigned


--
Ticket URL: 
BLFS Trac 
Beyond Linux From Scratch
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

[blfs-book] [BLFS Trac] #10356: procmail: at least two CVE fixes

2018-02-08 Thread BLFS Trac via blfs-book 
#10356: procmail: at least two CVE fixes
-+-
 Reporter:  ken@…|  Owner:  blfs-book@…
 Type:  enhancement  | Status:  new
 Priority:  high |  Milestone:  8.2
Component:  BOOK |Version:  SVN
 Severity:  normal   |   Keywords:
-+-
 I noticed a while back that Arch had picked up a CVE fix from debian. I've
 now found time to dig down and sort out what fedora and debian are using.

 The two CVEs are CVE-2014-3618.patch and CVE-2017-16844 (the latter is
 what Arch added recently, and originated at debian).
 There is also a 'truncate' and a 'crash fix' patch which look useful.

 Fedora use a consolidated patch from debian procmail_3.22-8 but a lot of
 it looks like policy rather than bug fixes.

 Debian have a suite of 28 patches, names just 01-28, but many of these are
 for policy, including in the documentation. There is also a patch to
 enable ipv6, but I don't have any way to test that, and it seems to
 require autoreconf, so I'm ignoring it since nobody has complained it
 doesn't support ipv6.

 Of the individual patches which were not policy and not ipv6, the
 following are withing the 3.22-8 patch that fedora use, so I've added
 them:

 10 (segfault in manifold.c)
 14 (wrong amounts of memory allocated in a pipe)
 17 (formail prints body if content length header is found)

 I've prepared a consolidated patch, and applied it to my 8.1 system where
 it seems to be working.

--
Ticket URL: 
BLFS Trac 
Beyond Linux From Scratch
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

[blfs-book] r19739 - in trunk/BOOK: . introduction/welcome xsoft/graphweb

2018-02-08 Thread via blfs-book 
Author: ken
Date: Thu Feb  8 13:49:09 2018
New Revision: 19739

Log:
firefox-58.0.2

Modified:
   trunk/BOOK/introduction/welcome/changelog.xml
   trunk/BOOK/packages.ent
   trunk/BOOK/xsoft/graphweb/firefox.xml

Modified: trunk/BOOK/introduction/welcome/changelog.xml
==
--- trunk/BOOK/introduction/welcome/changelog.xml   Thu Feb  8 05:59:40 
2018(r19738)
+++ trunk/BOOK/introduction/welcome/changelog.xml   Thu Feb  8 13:49:09 
2018(r19739)
@@ -42,6 +42,16 @@
 
 -->
 
+  February 8th, 2018
+  
+
+  [ken] - Update to firefox-58.0.2. Fixes
+  #10354.
+
+  
+
+
+
   February 7th, 2018
   
 
@@ -54,6 +64,7 @@
 
   
 
+
 
   February 4th, 2018
   

Modified: trunk/BOOK/packages.ent
==
--- trunk/BOOK/packages.ent Thu Feb  8 05:59:40 2018(r19738)
+++ trunk/BOOK/packages.ent Thu Feb  8 13:49:09 2018(r19739)
@@ -728,7 +728,7 @@
 
 
 
-
+
 
 
 

Modified: trunk/BOOK/xsoft/graphweb/firefox.xml
==
--- trunk/BOOK/xsoft/graphweb/firefox.xml   Thu Feb  8 05:59:40 2018
(r19738)
+++ trunk/BOOK/xsoft/graphweb/firefox.xml   Thu Feb  8 13:49:09 2018
(r19739)
@@ -6,8 +6,8 @@
 
   
   
-  
-  
+  
+  
   
   
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

Re: [blfs-book] [BLFS Trac] #10354: firefox-58.0.2

2018-02-08 Thread BLFS Trac via blfs-book 
#10354: firefox-58.0.2
-+---
 Reporter:  bdubbs@… |   Owner:  ken@…
 Type:  enhancement  |  Status:  assigned
 Priority:  normal   |   Milestone:  8.2
Component:  BOOK | Version:  SVN
 Severity:  normal   |  Resolution:
 Keywords:   |
-+---
Changes (by ken@…):

 * owner:  blfs-book@… => ken@…
 * status:  new => assigned


Comment:

 From the Release Notes:

 Avoid a signature validation issue during update on macOS

 Blocklisted graphics drivers related to off main thread painting
 crashes

 Tab crash during printing

 Fix clicking links and scrolling emails on Microsoft Hotmail and
 Outlook (OWA) webmail


 Looking at a diff from 58.0.1, the blacklisted graphics driver appears to
 be on Win7. But there are a lot of changes in the testsuite for
 certificates, and third party python module pyasn1 has been updated.

 So no listed security vulnerabilities, but better safe than sorry.

--
Ticket URL: 
BLFS Trac 
Beyond Linux From Scratch
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

[blfs-book] [BLFS Trac] #10355: seamonkey-2.49.2

2018-02-08 Thread BLFS Trac via blfs-book 
#10355: seamonkey-2.49.2
-+-
 Reporter:  bdubbs@… |  Owner:  blfs-book@…
 Type:  enhancement  | Status:  new
 Priority:  normal   |  Milestone:  8.2
Component:  BOOK |Version:  SVN
 Severity:  normal   |   Keywords:
-+-
 New point version.

--
Ticket URL: 
BLFS Trac 
Beyond Linux From Scratch
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

[blfs-book] [BLFS Trac] #10354: firefox-58.0.2

2018-02-08 Thread BLFS Trac via blfs-book 
#10354: firefox-58.0.2
-+-
 Reporter:  bdubbs@… |  Owner:  blfs-book@…
 Type:  enhancement  | Status:  new
 Priority:  normal   |  Milestone:  8.2
Component:  BOOK |Version:  SVN
 Severity:  normal   |   Keywords:
-+-
 New point version.

--
Ticket URL: 
BLFS Trac 
Beyond Linux From Scratch
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

[blfs-book] [BLFS Trac] #10353: samba-4.7.5

2018-02-08 Thread BLFS Trac via blfs-book 
#10353: samba-4.7.5
-+-
 Reporter:  bdubbs@… |  Owner:  blfs-book@…
 Type:  enhancement  | Status:  new
 Priority:  normal   |  Milestone:  8.2
Component:  BOOK |Version:  SVN
 Severity:  normal   |   Keywords:
-+-
 New point version.

--
Ticket URL: 
BLFS Trac 
Beyond Linux From Scratch
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

[blfs-book] [BLFS Trac] #10352: libwacom-0.28

2018-02-08 Thread BLFS Trac via blfs-book 
#10352: libwacom-0.28
-+-
 Reporter:  bdubbs@… |  Owner:  blfs-book@…
 Type:  enhancement  | Status:  new
 Priority:  normal   |  Milestone:  8.2
Component:  BOOK |Version:  SVN
 Severity:  normal   |   Keywords:
-+-
 New point version.

--
Ticket URL: 
BLFS Trac 
Beyond Linux From Scratch
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page

[blfs-book] r19738 - in trunk/BOOK: . general/genutils

2018-02-08 Thread via blfs-book 
Author: pierre
Date: Thu Feb  8 05:59:40 2018
New Revision: 19738

Log:
Graphviz: make all dependencies optional and explain what they are useful for

Modified:
   trunk/BOOK/general.ent
   trunk/BOOK/general/genutils/graphviz.xml

Modified: trunk/BOOK/general.ent
==
--- trunk/BOOK/general.ent  Wed Feb  7 16:15:43 2018(r19737)
+++ trunk/BOOK/general.ent  Thu Feb  8 05:59:40 2018(r19738)
@@ -1,12 +1,12 @@
 
 
-   
+   

 
 
 
 
-
+
  
   
   

Modified: trunk/BOOK/general/genutils/graphviz.xml
==
--- trunk/BOOK/general/genutils/graphviz.xmlWed Feb  7 16:15:43 2018
(r19737)
+++ trunk/BOOK/general/genutils/graphviz.xmlThu Feb  8 05:59:40 2018
(r19738)
@@ -99,36 +99,87 @@
 
 Graphviz Dependencies
 
-Recommended
-
-  ,
-  ,
-  ,
-  ,
-  ,
-  ,
-  ,
-   and
-  
+
+  
+Graphviz basic usage does not need any
+libraries out of what is found in the LFS book. Its core
+rendering engine allows to generate several graphic formats, such as
+Postscript, SVG, VML, .fig, and Tk. Those formats can be converted
+to almost any other, using for example tools from . The dependencies below add the ability to
+generate graph images in bitmap format, to display the graph image on
+screen, to edit a graph by seeing directly the result image, or to view
+large graphs. Since Graphviz is a dependency
+of several other packages in this book, it is suggested to first build
+it without any dependencies, then to rebuild it when you have built
+enough packages to suit your needs.
+  
+
+
+Optional, for various bitmap 
outputs
+
+  , with
+  ,
+  ,
+  , and
+  , to generate images in bitmap SVG, postscript,
+  PNG, and PDF formats, or displaying the image on screen
 
 
-Optional
 
-  ,
-  ,
-  ,
-  ,
+  Adding
+   with
+   allows to add JPEG, BMP, TIF, and ICO formats,
+  and to display the image in a GTK+ window
+
+
+
+  http://www.libgd.org/;>GD Library may be used
+  instead of Pango. It adds the ability to
+  generate images in GIF, VRML, and GD formats, but
+  Pango provides better outputs for the other
+  formats, and is needed for displaying images
+
+  
+
+  Other formats may be added with
+   (WebP support is considered experimental),
   http://openil.sourceforge.net/projects.php;>DevIL,
-  http://linux.softpedia.com/get/Programming/Debuggers/Electric-Fence-3305.shtml/;>Electric
 Fence,
   http://sourceforge.net/projects/lasi/;>libLASi,
-  http://www.libgd.org/;>GD Library, and
-  http://www.freedesktop.org/wiki/Software/glitz;>glitz
+  http://www.freedesktop.org/wiki/Software/glitz;>glitz,
+  and http://www.libming.org/;>libming (Macromedia
+  Flash)
+
+
+Optional, to load graphic images that may be
+displayed inside the nodes of a graph
+
+
+  libgs.so from
+  ,
+  , and
+  
+
+
+Optional, to build more tools
+
+
+   (with , 
+  https://projects.gnome.org/gtkglext/;>GtkGLExt, and
+  http://gts.sourceforge.net/;>libGTS, for building
+  the smyrna large graph viewer, which is
+  considered experimental),
+  , for building the gvedit
+  graph editor. Another graph editor, dotty needs only
+  
+
 
 
 Optional (To Build Language 
Bindings)
 
(SWIG must be
   installed or no bindings will be built),
+   (for the go language),
   ,
   ,
   ,
@@ -143,6 +194,13 @@
   http://www.r-project.org/;>R
 
 
+Optional (building tools)
+
+  https://github.com/Snaipe/Criterion;>Criterion
+  (framework for tests),
+  http://linux.softpedia.com/get/Programming/Debuggers/Electric-Fence-3305.shtml/;>Electric
 Fence,
+
+
 User Notes:
   
 
@@ -223,6 +281,17 @@
   This is possible nevertheless by using the -I switch inside the variable.
 
 
+
+  --with-webp: Even if  is
+  installed, it is not included in the build without this option.
+
+
+
+  --with-smyrna: Even if the needed dependencies are 
+  installed, the interactive graph viewer smyrna is not
+  built without this option.
+
+
   
 
   
-- 
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page