Packages

Description:

• “chroot” initscript contains some errors on “chroot” initscript.

Additional info:

• openrc 0.28-18

/etc/conf.d/chroot

 # initial command
 CR_COMD=/sbin/openrc-init
-# network interfaces
-CR_NINF="veth_guest ethernet"
-# wifi interfaces
-CR_WINF="wifi"
-# service dependecies
-CR_DEPS="net_veth.interface_host
-         chroot.name net.interface_ethernet net.interface_wifi"
+# network interfaces, example: CR_NINF="veh0 eth0"
+CR_NINF=""
+# wifi interfaces, example: CR_WINF="wlan0"
+CR_WINF=""
+# service dependecies, example: CR_DEPS="net.veh0 chroot.dns chroot.ntp net.eth0 net.wlan0"
+CR_DEPS=""
 # wait in seconds to run CR_COMD
 CR_CDWT=1
-# wait in seconds to start the sercice
+# wait in seconds to start the service
 CR_STWT=7
 # wait in seconds to stop the service
 CR_SPWT=7

/etc/init.d/chroot

 depend() {
-        need $CR_NDEP
+        need $CR_DEPS
         after modules bootmisc localmount net netmount
         keyword -jail -prefix -vserver
         provide oslv
 }

$ pacman -Si openrc
Repository      : core
Name            : openrc
Version         : 0.28-18
Description     : A dependency based init system that works with the system provided init program
Architecture    : x86_64
URL             : https://wiki.gentoo.org/wiki/Project:OpenRC
Licenses        : BSD2
Groups          : None
Provides        : None
Depends On      : psmisc  pam
Optional Deps   : netifrc: network interface management scripts
                  networkmanager: network connection manager and user applications
Conflicts With  : None
Replaces        : None
Download Size   : 193.18 KiB
Installed Size  : 1720.00 KiB
Packager        : André Silva <emulatorman@hyperbola.info>
Build Date      : Sun 08 Jul 2018 01:28:16 AM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Steps to reproduce:

• On boot “openrc” and/or start “chroot” initscripts.

Description:

• “net_veth” and “net_macsec” initscripts contains some issues.

Additional info:

• netifrc 0.6.0-2.backports1

/etc/conf.d/net_veth

-# Source Interface (host)
-IFSRC=interface_host
+# Source Interface (host), example: IFSRC=veh0
+IFSRC=veh0
 # Set custom parameters on Source Interface
 IFCTS=
-# Destination Interface (guest)
-IFDST=interface_guest
+# Destination Interface (guest), example: IFDST=veg0
+IFDST=veg0
 # Set custom parameters on Destination Interface
 IFCTD=

/etc/conf.d/net_macsec

-# Source Interface (host)
-IFSRC=interface_host
-# Network init service dependency from Source Interface
-#IFDEP=net.interface_host
-# Destination Interface (macsec/guest)
-IFDST=interface_macsec
+# Source Interface (host), example: IFSRC=eth0
+IFSRC=eth0
+# Network init service dependency from Source Interface, example: IFDEP=net.eth0
+IFDEP=
+# Destination Interface (macsec/guest), example: IFDST=macsec0
+IFDST=macsec0
 # Set custom parameters on MACsec Interface
 IFCTD=

---

 IFPAR="cipher gcm-aes-128
        icvlen 16
        encrypt on
        protect off
        replay off
        send_sci on
-       validate strict"
+       validate disabled"

---

-# Add receive channels and/or receive association keys (RXSC), examples:
-#
-# [sci_<0..ffffffffffffffff(hex)>|port_<1..65535(dec)>_address_<00:00:00:00:00:00..ff:ff:ff:ff:ff:ff(hex)>][_<on/off>]
-#
-# sci_0
-# sci_ffffffffffffffff_on
-# port_1_address_00:00:00:00:00:00
-# port_2_address_ff:ff:ff:ff:ff:ff_off
-#
-# [sci_<0..ffffffffffffffff(hex)>_|port_<1..65535(dec)>_address_<00:00:00:00:00:00..ff:ff:ff:ff:ff:ff(hex)>_]sa_<0..3(dec)>_[pn_<1..4294967295(dec)>_][<on/off>_]key_<00..ff(hex)>_<00000000000000000000000000000000..ffffffffffffffffffffffffffffffff(hex)>
-#
-# sa_0_key_00_00000000000000000000000000000000
-# sa_1_key_pn_1_01_f00f00f00f00f00f00f00f00f00f00f0
-# sa_2_key_on_32_de_de00de00de00de00de00de00de00de00
-# sa_3_key_pn_16345_off_a1_fca1fca1fca1fca1fca1fca1fca1fca1
-# sci_0_sa_0_key_00_00000000000000000000000000000000
-# sci_32_sa_1_key_pn_1_01_f00f00f00f00f00f00f00f00f00f00f0
-# sci_451_sa_2_key_on_32_de_de00de00de00de00de00de00de00de00
-# sci_7438f_sa_3_key_pn_16345_off_a1_fca1fca1fca1fca1fca1fca1fca1fca1
-# port_1_address_00:00:00:00:00:00_sa_0_key_00_00000000000000000000000000000000
-# port_2_address_ff:ff:ff:ff:ff:ff_sa_1_key_pn_1_01_f00f00f00f00f00f00f00f00f00f00f0
-# port_3_address_00:00:00:ff:ff:ff_sa_2_key_on_32_de_de00de00de00de00de00de00de00de00
-# port_4_address_ff:ff:ff:00:00:00_sa_3_key_pn_16345_off_a1_fca1fca1fca1fca1fca1fca1fca1fca1
+# Add receive channels and/or receive association keys (RXSC), examples:
+#
+# "[sci <0..ffffffffffffffff(hex)>|port <1..65535(dec)> address <00:00:00:00:00:00..ff:ff:ff:ff:ff:ff(hex)>][ <on/off>]"
+#
+# "sci 0"
+# "sci ffffffffffffffff on"
+# "port 1 address 00:00:00:00:00:00"
+# "port 2 address ff:ff:ff:ff:ff:ff off"
+#
+# "[sci <0..ffffffffffffffff(hex)> |port <1..65535(dec)> address <00:00:00:00:00:00..ff:ff:ff:ff:ff:ff(hex)> ]sa <0..3(dec)> [pn <1..4294967295(dec)> ][<on/off> ]key <00..ff(hex)> <00000000000000000000000000000000..ffffffffffffffffffffffffffffffff(hex)>"
+#
+# "sci 0 sa 0 key 00 00000000000000000000000000000000"
+# "sci 32 sa 1 pn 1 key 01 f00f00f00f00f00f00f00f00f00f00f0"
+# "sci 451 sa 2 on key de de00de00de00de00de00de00de00de00"
+# "sci 7438f sa 3 pn 16345 off key a1 fca1fca1fca1fca1fca1fca1fca1fca1"
+# "port 1 address 00:00:00:00:00:00 sa 0 key 00 00000000000000000000000000000000"
+# "port 2 address ff:ff:ff:ff:ff:ff sa 1 pn 1 key 01 f00f00f00f00f00f00f00f00f00f00f0"
+# "port 3 address 00:00:00:ff:ff:ff sa 2 on key de de00de00de00de00de00de00de00de00"
+# "port 4 address ff:ff:ff:00:00:00 sa 3 pn 16345 off key a1 fca1fca1fca1fca1fca1fca1fca1fca1"
+#
+# IFRSC=("port 1 address 00:00:00:00:00:00 on"
+#        "port 1 address 00:00:00:00:00:00 sa 0 pn 1 on key 00 00000000000000000000000000000000"
+#        "sci ffffffffffff0001 on"
+#        "sci ffffffffffff0001 sa 0 pn 1 on key 00 ffffffffffffffffffffffffffffffff")
 IFRSC=()

-# Add trasmition association keys (TXSC) , examples:
-# sa_<0..3(dec)>_[pn_<1..4294967295(dec)>_][<on/off>_]key_<00..ff(hex)>_<00000000000000000000000000000000..ffffffffffffffffffffffffffffffff(hex)>
-#
-# sa_0_key_00_00000000000000000000000000000000
-# sa_1_key_pn_1_01_f00f00f00f00f00f00f00f00f00f00f0
-# sa_2_key_on_32_de_de00de00de00de00de00de00de00de00
-# sa_3_key_pn_16345_off_a1_fca1fca1fca1fca1fca1fca1fca1fca1
+# Add trasmition association keys (TXSC) , examples:
+# "sa <0..3(dec)> [pn <1..4294967295(dec)> ][<on/off> ]key <00..ff(hex)> <00000000000000000000000000000000..ffffffffffffffffffffffffffffffff(hex)>"
+#
+# "sa 0 key 00 00000000000000000000000000000000"
+# "sa 1 pn 1 key 01 f00f00f00f00f00f00f00f00f00f00f0"
+# "sa 2 on key de de00de00de00de00de00de00de00de00"
+# "sa 3 pn 16345 off key a1 fca1fca1fca1fca1fca1fca1fca1fca1"
+#
+# IFTSC=("sa 0 pn 1 on key 00 00000000000000000000000000000000")
 IFTSC=()

/etc/init.d/net_macsec

                         if [[ $IFRSC ]]; then
-                                for mac_rxsc in ${IFRSC[@]}; do
-                                        ip macsec add $IFDST rx ${mac_rxsc/_/ }
+                                for mac_rxsc in "${IFRSC[@]}"; do
+                                        ip macsec add $IFDST rx $mac_rxsc
                                 done
                         fi
                         if [[ $IFTSC ]]; then
-                                for mac_txsc in ${IFTSC[@]}; do
-                                        ip macsec add $IFDST tx ${mac_txsc/_/ }
+                                for mac_txsc in "${IFTSC[@]}"; do
+                                        ip macsec add $IFDST tx $mac_txsc
                                 done
                         fi

$ pacman -Si netifrc
Repository      : core
Name            : netifrc
Version         : 0.6.0-2.backports1
Description     : Network interface management scripts
Architecture    : x86_64
URL             : https://wiki.gentoo.org/wiki/Netifrc
Licenses        : BSD2
Groups          : base
Provides        : None
Depends On      : eudev
Optional Deps   : iproute2: for interface handler, VPN, bridging and tunneling support (recommended)
                  net-tools: for interface handler support
                  bridge-utils: for bridging support
                  linux-atm: for CLIP and RFC 2684 bridge support
                  wpa_supplicant: for wireless networking support (recommended)
                  wireless_tools: for wireless networking support
                  dhcpcd: for DHCP support (recommended)
                  dhclient: for DHCP support
                  busybox: for DHCP support
                  iputils: for APIPA support
                  ifenslave: for bonding interfaces
                  ppp: for PPP and ADSL support (recommended)
                  rp-pppoe: for ADSL support
                  macchanger: for changing MAC addresses
                  ifplugd: for cable in/out detection
Conflicts With  : None
Replaces        : None
Download Size   : 66.18 KiB
Installed Size  : 373.00 KiB
Packager        : André Silva <emulatorman@hyperbola.info>
Build Date      : Tue 03 Jul 2018 12:16:13 AM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Steps to reproduce:

• Boot “openrc” and/or start “net_{veth,macsec}” initscripts.

Description:

• “net.lo” initscript is forced to load in “boot” runlevel by default.
• “loopback” interface doesn’t need changes.
• “net.lo” initscript conflicts with another network services, like: NetworkManager.
• “net.lo” initscript takes extra processor and memory resources when is useless.

Additional info:

• netifrc 0.6.0-2.backports1

This file needs be removed:
* /etc/runlevels/boot/net.lo

$ pacman -Si netifrc
Repository      : core
Name            : netifrc
Version         : 0.6.0-2.backports1
Description     : Network interface management scripts
Architecture    : x86_64
URL             : https://wiki.gentoo.org/wiki/Netifrc
Licenses        : BSD2
Groups          : base
Provides        : None
Depends On      : eudev
Optional Deps   : iproute2: for interface handler, VPN, bridging and tunneling support (recommended)
                  net-tools: for interface handler support
                  bridge-utils: for bridging support
                  linux-atm: for CLIP and RFC 2684 bridge support
                  wpa_supplicant: for wireless networking support (recommended)
                  wireless_tools: for wireless networking support
                  dhcpcd: for DHCP support (recommended)
                  dhclient: for DHCP support
                  busybox: for DHCP support
                  iputils: for APIPA support
                  ifenslave: for bonding interfaces
                  ppp: for PPP and ADSL support (recommended)
                  rp-pppoe: for ADSL support
                  macchanger: for changing MAC addresses
                  ifplugd: for cable in/out detection
Conflicts With  : None
Replaces        : None
Download Size   : 66.18 KiB
Installed Size  : 373.00 KiB
Packager        : André Silva <emulatorman@hyperbola.info>
Build Date      : Tue 03 Jul 2018 12:16:13 AM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Steps to reproduce:

• Boot “openrc”.
• Install and update [netifrc] package.

Description:

• “udev” initscript is loaded by “udev-trigger”.
• “udev-trigger” is needed load on “boot” runlevel, not”sysinit” one.
• “udev-trigger” initscript is forced to be added in the sysinit runlevel through upgrading package process
• It avoids use “eudev” side-by-side with “vdev”.

Additional info:

• eudev 3.2.5-2

This file need be removed:
* /etc/runlevels/sysinit/udev

This file needs to be changed in "boot" runlevel, not "sysinit" runlevel;
This file needs be included only in the installing process not updating one.
- /etc/runlevels/sysinit/udev-trigger
+ /etc/runlevels/boot/udev-trigger

$ pacman -Si eudev
Repository      : core
Name            : eudev
Version         : 3.2.5-2
Description     : The userspace dev tools (udev) forked by Gentoo, with OpenRC support
Architecture    : x86_64
URL             : https://wiki.gentoo.org/wiki/Project:Eudev
Licenses        : GPL
Groups          : None
Provides        : udev
Depends On      : libeudev  kbd  kmod  hwids  util-linux
Optional Deps   : None
Conflicts With  : udev
Replaces        : udev
Download Size   : 931.20 KiB
Installed Size  : 7072.00 KiB
Packager        : André Silva <emulatorman@hyperbola.info>
Build Date      : Sun 01 Jul 2018 01:26:17 AM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Steps to reproduce:

• Boot “openrc”.
• Install and update [eudev] package.

Description:

• “sysctl” initscript doesn’t set sysctl parameters on network interfaces.
• “sysctl” initscript needs run “sysctl” initscript after “net” initscript.

Additional info:

• openrc 0.28-18

/etc/init.d/sysctl

-        after clock
+        after clock net

$ pacman -Si openrc
Repository      : core
Name            : openrc
Version         : 0.28-18
Description     : A dependency based init system that works with the system provided init program
Architecture    : x86_64
URL             : https://wiki.gentoo.org/wiki/Project:OpenRC
Licenses        : BSD2
Groups          : None
Provides        : None
Depends On      : psmisc  pam
Optional Deps   : netifrc: network interface management scripts
                  networkmanager: network connection manager and user applications
Conflicts With  : None
Replaces        : None
Download Size   : 193.18 KiB
Installed Size  : 1720.00 KiB
Packager        : André Silva <emulatorman@hyperbola.info>
Build Date      : Sun 08 Jul 2018 01:28:16 AM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Steps to reproduce:

• Boot “openrc”

Description:

Hi dear developers of Hyperbola. I work in the field of web development. I use a lot of javascript and nodejs to compile.
Could they do the nodejs update?. I also mention this because Hyperbola works with LTS packages.

Additional info:

* package version(s)

$ sudo pacman -Si nodejs
Repositorio               : community
Nombre                    : nodejs
Versión                   : 7.10.0-1
Descripción               : Evented I/O for V8 javascript
Arquitectura              : x86_64
URL                       : http://nodejs.org/
Licencias                 : MIT
Grupos                    : Nada
Provee                    : Nada
Depende de                : openssl-1.0  zlib  icu  libuv  http-parser  c-ares
Dependencias opcionales   : npm: nodejs package manager
En conflicto con          : Nada
Remplaza a                : Nada
Tamaño de la descarga     : 4,55 MiB
Tamaño de la instalación  : 18,49 MiB
Encargado                 : Felix Yan <felixonmars@archlinux.org>
Fecha de creación         : mié 03 may 2017 09:50:26 -05
Validado por              : Suma MD5  Suma SHA-256  Firma

$ sudo pacman -Si npm
Repositorio               : community
Nombre                    : npm
Versión                   : 4.5.0-1
Descripción               : A package manager for javascript
Arquitectura              : any
URL                       : https://www.npmjs.com/
Licencias                 : custom:Artistic
Grupos                    : Nada
Provee                    : nodejs-node-gyp
Depende de                : nodejs  semver
Dependencias opcionales   : python2: for node-gyp
En conflicto con          : Nada
Remplaza a                : Nada
Tamaño de la descarga     : 2,72 MiB
Tamaño de la instalación  : 13,98 MiB
Encargado                 : Felix Yan <felixonmars@archlinux.org>
Fecha de creación         : mié 12 abr 2017 22:08:06 -05
Validado por              : Suma MD5  Suma SHA-256  Firma

- NodeJS LTS (includes npm 5.6.0):

* https://nodejs.org/dist/v8.11.3/node-v8.11.3.tar.gz

* https://nodejs.org/dist/v8.11.3/SHASUMS256.txt.asc

Some errors that I suffer when compiling:
- https://stackoverflow.com/questions/46476741/nodejs-util-promisify-is-not-a-function

OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

https://security-tracker.debian.org/tracker/CVE-2018-15473

Patch: https://salsa.debian.org/ssh-team/openssh/commit/4641c58a3279f6b118f9562babaa0ee050a38619

Technical analysis: https://blog.nviso.be/2018/08/21/openssh-user-enumeration-vulnerability-a-close-look/

Since Hyperbola follows the Init Freedom Campaign, systemd unit files removal is required or add OpenRC init scripts to replace it.

Additional info:
* package version(s)

extra/gpsd 3.16-3 [installed]

   GPS daemon and library to support USB/serial GPS devices

* config and/or log files etc.

Additional info:

Steps to reproduce: install it

User enumeration in Dropbear 2018.76 and earlier
http://lists.ucc.gu.uwa.edu.au/pipermail/dropbear/2018q3/002108.html

Patch: https://secure.ucc.asn.au/hg/dropbear/rev/5d2d1021ca00

An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16. They allow remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscription or unsubscription.

https://security-tracker.debian.org/tracker/CVE-2018-14354

Description:

NoScript zero-day allows script execution even with scripts blocked by default.

https://www.zdnet.com/article/exploit-vendor-drops-tor-browser-zero-day-on-twitter/

https://twitter.com/ma1/status/1039163003034324992

Additional info:
* package version(s) < 5.1.8.7

Steps to reproduce:
Set the Content-Type of your html/js page to “text/html;json” and enjoy full JS pwnage”

Description:

Hiawatha contains only systemd files.

It shall be removed and openrc shall be provided

Description:
In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.

https://blog.grimm-co.com/post/malicious-command-execution-via-bash-completion-cve-2018-7738/

Description:

• needs OpenRC init script and contains systemd file

Additional info:

• umurmur 0.2.16_a-6

umurmur /usr/lib/systemd/system/umurmur.service

Steps to reproduce:

• none

Description:

• OpenRC needs a minor fix (remount proc)

Additional info:

• openrc 0.28-19

openrc /usr/lib/rc/sh/init.sh

—

-        mount -n -t proc -o noexec,nosuid,nodev,gid=proc,hidepid=2 proc /proc
+        mount -n -t proc -o noexec,nosuid,nodev proc /proc
+        mount -n /proc -o remount,gid=26,hidepid=2

Steps to reproduce:

• Boot OpenRC in chroot with unshare

Description:

• Remove Schrödinger in Hyperbola because it’s unmaintained and unsupportable. [0] [1]

• Note: It requires [ffmpeg], [ffmpeg2.8] and [gst-plugins-bad] rebuilding

Additional info:

• schroedinger 1.0.11-3

$ pacman -Si schroedinger
Repository      : extra
Name            : schroedinger
Version         : 1.0.11-3
Description     : An implemenation of the Dirac video codec in ANSI C code
Architecture    : x86_64
URL             : https://launchpad.net/schroedinger
Licenses        : GPL2  LGPL2.1  MPL  MIT
Groups          : None
Provides        : None
Depends On      : orc  gcc-libs
Optional Deps   : None
Conflicts With  : None
Replaces        : None
Download Size   : 331.64 KiB
Installed Size  : 1676.00 KiB
Packager        : Evangelos Foutras <evangelos@foutrelis.com>
Build Date      : Sat 05 Dec 2015 12:28:01 PM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Steps to reproduce:

• Contains security holes.

Description:

• In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the type of a box may be changed between a read operation and a free operation.

Additional info:
* package version(s)

• 2.2.6-1.hyperbola1

* config and/or log files etc.

• None

Steps to reproduce:

• Run VLC

Description:

• VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files. Failed exploit attempts will likely result in denial of service conditions.

Additional info:
* package version(s)

• 2.2.6-1.hyperbola1

* config and/or log files etc.

• None

Steps to reproduce:

• Run VLC

Description:
As stated on the home page of the project (https://qtpass.org/):
<quote>
All passwords generated with QtPass’ built-in password generator prior to 1.2.1 are possibly predictable and enumerable by hackers.
</quote>

When running QtEmu for the first time and running the new machine wizard, the software lists non-free operating systems and refers to GNU/Linux as Linux.

It would be nice to list LibertyBSD in the list of distros in this software in addition to GNU/Linux and GNU/Hurd (which are listed in aqemu).

Description:

A memory leak bug was discovered in Toxcore that can be triggered remotely to exhaust one’s system memory, resulting in a denial of service attack... As a general reminder, if you are still using irungentoo’s toxcore, we strongly encourage you to switch to using TokTok c-toxcore instead as it’s a lot more actively developed and maintained. In fact, irungentoo’s toxcore is neither being developed nor maintained for some time now, aside from merging only the most critical fixes from TokTok c-toxcore from time to time, missing all other important fixes.

Additional info:
* package version(s): < 2.8

https://blog.tox.chat/2018/10/memory-leak-bug-and-new-toxcore-release-fixing-it/

Description:
libssh versions 0.6 and above have an authentication bypass vulnerability in
the server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS message
in place of the SSH2_MSG_USERAUTH_REQUEST message which the server would expect
to initiate authentication, the attacker could successfully authentciate
without any credentials.

Additional info:
* package version(s) : extra/libssh 0.7.5-1

CVE

Description:
Changelog

2.4.46 is fixing a huge quantity of issues (TLS related & memory leak)

Additional info:
* package version(s) : 2.4.44

Description:

• “consolefont” and “keymap” hooks is adapted to systemd using /etc/vconsole.conf file, those hooks are needed to adapt to [openrc] with /etc/conf.d/consolefont and /etc/conf.d/keymaps

Additional info:

• mkinitcpio 23-1.hyperbola3.1

/usr/lib/initcpio/install/consolefont
---
-        [[ -s /etc/vconsole.conf ]] && . /etc/vconsole.conf
+        [[ -s /etc/conf.d/consolefont ]] && . /etc/conf.d/consolefont

-        if [[ $FONT ]]; then
-            for file in "/usr/share/kbd/consolefonts/$FONT".@(fnt|psf?(u))?(.gz); do
+        if [[ $consolefont ]]; then
+            for file in "/usr/share/kbd/consolefonts/$consolefont".@(fnt|psf?(u))?(.gz); do

-            error "consolefont: requested font not found: \`%s'" "$FONT"
+            error "consolefont: requested font not found: \`%s'" "$consolefont"

-This hook loads consolefont specified in vconsole.conf during early 
-userspace.
+This hook loads consolefont specified in /etc/conf.d/consolefont during 
+early userspace.

/usr/lib/initcpio/install/keymap
---
-        for cfg in /etc/{vconsole,locale}.conf; do
+        for cfg in /etc/{conf.d/keymaps,locale}.conf; do

-        loadkeys -q $uc ${KEYMAP:-us} -b > "$BUILDROOT/keymap.bin"
+        loadkeys -q $uc ${keymap:-us} -b > "$BUILDROOT/keymap.bin"

-This hook loads keymap(s) specified in vconsole.conf during early 
-userspace.
+This hook loads keymap(s) specified in /etc/conf.d/keymaps during 
+early userspace.

Repository      : core
Name            : mkinitcpio
Version         : 23-1.hyperbola3.1
Description     : Modular initramfs image creation utility, with eudev support
Architecture    : any
URL             : https://projects.archlinux.org/mkinitcpio.git/
Licenses        : GPL
Groups          : None
Provides        : None
Depends On      : awk  mkinitcpio-busybox>=1.19.4-2  kmod  util-linux>=2.23  libarchive  coreutils  bash  findutils  grep  filesystem>=2011.10-1  gzip  eudev
Optional Deps   : xz: Use lzma or xz compression for the initramfs image
                  bzip2: Use bzip2 compression for the initramfs image
                  lzop: Use lzo compression for the initramfs image
                  lz4: Use lz4 compression for the initramfs image
                  mkinitcpio-nfs-utils: Support for root filesystem on NFS
Conflicts With  : None
Replaces        : None
Download Size   : 38.40 KiB
Installed Size  : 186.00 KiB
Packager        : André Silva <emulatorman@hyperbola.info>
Build Date      : Fri 05 Oct 2018 03:28:32 AM -03
Validated By    : MD5 Sum  SHA-256 Sum  Signature

Steps to reproduce:

• Use “consolefont” and “keymap” hooks from mkinitcpio

Description:

PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.

Additional info:
* package version(s)

$ pacman -Si php
Repositorio               : extra
Nombre                    : php
Versión                   : 7.1.4-3.hyperbola3
Descripción               : A general-purpose scripting language that is especially suited to web development, without systemd support
Arquitectura              : x86_64
URL                       : http://www.php.net
Licencias                 : PHP
Grupos                    : Nada
Provee                    : php-ldap=7.1.4
Depende de                : libxml2  curl  libzip  pcre
Dependencias opcionales   : Nada
En conflicto con          : php-ldap
Remplaza a                : php-ldap
Tamaño de la descarga     : 3,02 MiB
Tamaño de la instalación  : 15,94 MiB
Encargado                 : André Silva <emulatorman@hyperbola.info>
Fecha de creación         : mié 27 dic 2017 19:15:03 -05
Validado por              : Suma MD5  Suma SHA-256  Firma

* config and/or log files etc.

Last update of php be v7.1.x is v7.1.23:

- https://secure.php.net/ChangeLog-7.php#7.1.23

Patch availabble from v7.1.5
https://bugs.php.net/bug.php?id=74544

Steps to reproduce:

- Install php