Date: Mon, 24 Apr 2000 16:44:12 -0700 From: David Cantrell <david@slackware.com> To: slackware-security@slackware.com Subject: emacs & gpm fixes for Slackware 7.0 & -current There are two security updates available for Slackware 7.0 and Slackware-current. Affected packages are gpm.tgz and the E series (Emacs). Users are advised to upgrade these packages as soon as possible. =================================== gpm 1.19.2 AVAILABLE - (a1/gpm.tgz) =================================== gpm was upgraded to 1.19.2 to fix remaining security problems in the gpm-root daemon. ================================= emacs 20.6 AVAILABLE - (e1/*.tgz) ================================= The E series was upgraded to GNU emacs 20.6. This upgraded the following packages: elisp.tgz emac_nox.tgz emacinfo.tgz emacleim.tgz emacmisc.tgz emacsbin.tgz The recent security patch posted to BugTraq by RUS-CERT, University of Stuttgart was applied before building the packages. The holes fixed include: o Under certain circumstances, unprivileged local users can eavesdrop the communication between Emacs and its subprocesses. o It is impossible to safely create temporary files in a public directory from Emacs Lisp. o The history of recently typed keys may expose passwords. The entire advisory (as well as the patch) can be read on ftp.slackware.com in: /pub/slackware/slackware-current/source/e/emacs-rus-cert.diff.gz Separate patches will not be produced for the /patches directory in the Slackware 7.0 distribution tree. Users of Slackware 7.0 can download the necessary packages from the Slackware-current tree and run upgradepkg to install them. It's generally a good idea to bring your system into runlevel 1 when doing package upgrades, just to minimize error. # telinit 1 # upgradepkg <packagename> # telinit 3 Remember, it's also a good idea to backup configuration files before upgrading packages. - The Slackware Linux Project http://www.slackware.com