ALT-BU-2023-3101-1
Branch p10_e2k update bulletin.
Closed bugs
1.1.1
Package branding-alt-education updated to version 10.1-alt8 for branch p10_e2k.
Closed bugs
На панели xfce присутствует значок запуска Chromium, отсутствующего в p10/branch/i586
Closed bugs
Ошибка в связанных пакетах рушит работу системы
Closed bugs
Содержит файлы шрифтов, содержащиеся в пакете fonts-ttf-reduce или fonts-ttf-latex-xft
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-28100
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.
- https://github.com/flatpak/flatpak/commit/8e63de9a7d3124f91140fc74f8ca9ed73ed53be9
- https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp
- https://marc.info/?l=oss-security&m=167879021709955&w=2
- https://security.gentoo.org/glsa/202312-12
- https://github.com/flatpak/flatpak/commit/8e63de9a7d3124f91140fc74f8ca9ed73ed53be9
- https://security.gentoo.org/glsa/202312-12
- https://marc.info/?l=oss-security&m=167879021709955&w=2
- https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp
Modified: 2024-11-21
CVE-2023-28101
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
- https://github.com/flatpak/flatpak/commit/409e34187de2b2b2c4ef34c79f417be698830f6c
- https://github.com/flatpak/flatpak/commit/6cac99dafe6003c8a4bd5666341c217876536869
- https://github.com/flatpak/flatpak/commit/7fe63f2e8f1fd2dafc31d45154cf0b191ebec66c
- https://github.com/flatpak/flatpak/security/advisories/GHSA-h43h-fwqx-mpp8
- https://security.gentoo.org/glsa/202312-12
- https://github.com/flatpak/flatpak/commit/409e34187de2b2b2c4ef34c79f417be698830f6c
- https://security.gentoo.org/glsa/202312-12
- https://github.com/flatpak/flatpak/security/advisories/GHSA-h43h-fwqx-mpp8
- https://github.com/flatpak/flatpak/commit/7fe63f2e8f1fd2dafc31d45154cf0b191ebec66c
- https://github.com/flatpak/flatpak/commit/6cac99dafe6003c8a4bd5666341c217876536869
Closed vulnerabilities
BDU:2023-02265
Уязвимость DNS-сервера Dnsmasq. связанная с неограниченным распределением ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-02-27
CVE-2023-28450
An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.
- https://capec.mitre.org/data/definitions/495.html
- https://capec.mitre.org/data/definitions/495.html
- FEDORA-2023-eeca11a4df
- FEDORA-2023-eeca11a4df
- FEDORA-2023-828bf01834
- FEDORA-2023-828bf01834
- https://thekelleys.org.uk/dnsmasq/doc.html
- https://thekelleys.org.uk/dnsmasq/doc.html
- https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=blob%3Bf=CHANGELOG
- https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=blob%3Bf=CHANGELOG
- https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=eb92fb32b746f2104b0f370b5b295bb8dd4bd5e5
- https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=eb92fb32b746f2104b0f370b5b295bb8dd4bd5e5
Package perl-WWW-Curl updated to version 4.17-alt8 for branch p10_e2k.
Closed bugs
WWW::Curl::Multi broken
Package sisyphus-updates updated to version 0.2-alt1 for branch p10_e2k.
Closed bugs
Добавить ветку x86_64-i586