From: Slackware Security Team <security@slackware.com>
To: slackware-security@slackware.com
Subject: [slackware-security] ark (SSA:2025-051-01)
Date: Thu, 20 Feb 2025 13:33:19 -0800 (PST)





-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] ark (SSA:2025-051-01)

New ark packages are available for Slackware 15.0 and -current to
fix a security issue.


Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/ark-21.12.1-i586-2_slack15.0.txz: Rebuilt.
The ark archive tool in KDE was found to extract to absolute paths if they
are present in the archive, which may be surprising to those who haven't
examined an archive before extracting it. It has been patched to discard any
leading '/' in paths to prevent this unlikely occurrence.
Thanks to pbslxw for the heads-up.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-57966
(* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/ark-21.12.1-i586-2_slack15.0.txz

Updated package for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/ark-21.12.1-x86_64-2_slack15.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/kde/ark-23.08.5-i686-2.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/kde/ark-23.08.5-x86_64-2.txz


MD5 signatures:
+-------------+

Slackware 15.0 package:
6a839223f6254618afbcfbb10eb175ef ark-21.12.1-i586-2_slack15.0.txz

Slackware x86_64 15.0 package:
9aa453fdefa4a6adb19bf0e68891e407 ark-21.12.1-x86_64-2_slack15.0.txz

Slackware -current package:
87f69391f541b78904f74d32153f3ef8 kde/ark-23.08.5-i686-2.txz

Slackware x86_64 -current package:
cabab889f60ab143a3042bdca497d478 kde/ark-23.08.5-x86_64-2.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg ark-21.12.1-i586-2_slack15.0.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iF0EARECAB0WIQTsVknaQB4iq/pnNu9qRGPAQBAiMwUCZ7edIgAKCRBqRGPAQBAi
M2TEAJ0d4wzezkLcz2kjmJZwtHvkJgRJygCfbSHtZ8MzfaIwGBmBkc/NvcoJfr4=
=OuXk
-----END PGP SIGNATURE-----

Senaste Kernels