-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  libgcrypt (SSA:2016-236-02)

New libgcrypt packages are available for Slackware 13.0, 13.1, 13.37, 14.0,
14.1, 14.2, and -current to fix a security issue.


Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/libgcrypt-1.7.3-i586-1_slack14.2.txz:  Upgraded.
  Fix critical security bug in the RNG [CVE-2016-6313].  An attacker who
  obtains 580 bytes from the standard RNG can trivially predict the next
  20 bytes of output.  (This is according to the NEWS file included in the
  source.  According to the annoucement linked below, an attacker who obtains
  4640 bits from the RNG can trivially predict the next 160 bits of output.)
  Problem detected by Felix Doerre and Vladimir Klebanov, KIT.
  For more information, see:
    https://lists.gnupg.org/pipermail/gnupg-announce/2016q3/000395.html
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6313
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/libgcrypt-1.5.6-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/libgcrypt-1.5.6-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/libgcrypt-1.5.6-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/libgcrypt-1.5.6-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/libgcrypt-1.5.6-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/libgcrypt-1.5.6-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/libgcrypt-1.5.6-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/libgcrypt-1.5.6-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/libgcrypt-1.5.6-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/libgcrypt-1.5.6-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/libgcrypt-1.7.3-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/libgcrypt-1.7.3-x86_64-1_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/libgcrypt-1.7.3-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/libgcrypt-1.7.3-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 13.0 package:
746744e7851ec64143ca9f11d5120916  libgcrypt-1.5.6-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
dc471573d1de585f6b32dbf44c9171ad  libgcrypt-1.5.6-x86_64-1_slack13.0.txz

Slackware 13.1 package:
ec165ecd16ab861b1bb8b85ac22eda24  libgcrypt-1.5.6-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
22c6a54adafdd6910308f4b8a986739c  libgcrypt-1.5.6-x86_64-1_slack13.1.txz

Slackware 13.37 package:
c8cb4bf4670f7a2027beb3cac7e42d12  libgcrypt-1.5.6-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
5871b9e016439689a793f079c44abfde  libgcrypt-1.5.6-x86_64-1_slack13.37.txz

Slackware 14.0 package:
5eeaa749b2a610140b6f1f10f0d5229d  libgcrypt-1.5.6-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
836394a52faaf7d29d0622b0cff79464  libgcrypt-1.5.6-x86_64-1_slack14.0.txz

Slackware 14.1 package:
57412d10a69f5adbe9c73ff27339fd77  libgcrypt-1.5.6-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
eab31a839b016bb8cc988a32c0eca984  libgcrypt-1.5.6-x86_64-1_slack14.1.txz

Slackware 14.2 package:
48d41635054a9b27ae35fa64dbb5ae9a  libgcrypt-1.7.3-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
d056790a1a39ee8ba7bd2fdc93b0409a  libgcrypt-1.7.3-x86_64-1_slack14.2.txz

Slackware -current package:
40066b89b5950e4198fbed0eab7eb42e  n/libgcrypt-1.7.3-i586-1.txz

Slackware x86_64 -current package:
7b0c774415b931d2d47a90e45b5f9bbf  n/libgcrypt-1.7.3-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg libgcrypt-1.7.3-i586-1_slack14.2.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAle8tksACgkQakRjwEAQIjMPbgCggDbrh2kIWw9/OSz3iIsXF1gY
09AAoI3O3orG2gRCGzHVltDdCvkmGGkA
=rseX
-----END PGP SIGNATURE-----