ALT-BU-2023-4034-1
Branch sisyphus update bulletin.
Package lightdm-kde-greeter updated to version 0.4.12-alt1 for branch sisyphus in task 323743.
Closed bugs
Виртуальная клавиатура пропадает после ввода 1 символа, ввести пароль невозможно при подключении к сети через виджет на экране входа
В случае длинного имени пользователя или пароля буквы наползают на значок "виртуальная клавиатура"
[usability] Настроенная на экране входа сеть недоступна после входа в систему
[usability] Отсутствует пользовательское сообщение при вводе некорректного пароля для подключения к сети
Не осуществляется подключение ко второй сети
guest отображается со звездочкой на экране входа
Некорректное сообщение "Неверный пароль, повторите попытку" в случае, если срок действия аккаунта истек или аккаунт заблокирован
Не выполняется автологин
Некорректное отображение темы Классическая при подключенном втором мониторе
Некорректная работа всех элементов навигации в Классической теме при подключенном втором мониторе
Не запускает сессию wayland при автологине, если при установке создать пользователя с опцией "Автоматический вход в систему"
Package u-boot-qemu updated to version 2023.04-alt2 for branch sisyphus in task 323801.
Closed bugs
u-boot-qemu не может загрузить regular-jeos-systemd-aarch64.img в QEMU
Closed vulnerabilities
BDU:2023-03200
Уязвимость языка программирования Go, связанная с небезопасным внешним контролем за критическими данными состояния, позволяющая нарушителю повысить свои привилегии и получить доступ на чтение, изменение или удаление данных
BDU:2023-03201
Уязвимость модуля Cgo языка программирования Go, позволяющая нарушителю выполнить произвольный код
Modified: 2025-01-07
CVE-2023-29402
The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via "go get", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).
- https://go.dev/cl/501226
- https://go.dev/cl/501226
- https://go.dev/issue/60167
- https://go.dev/issue/60167
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://pkg.go.dev/vuln/GO-2023-1839
- https://pkg.go.dev/vuln/GO-2023-1839
- https://security.gentoo.org/glsa/202311-09
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20241213-0004/
Modified: 2025-01-06
CVE-2023-29403
On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.
- https://go.dev/cl/501223
- https://go.dev/cl/501223
- https://go.dev/issue/60272
- https://go.dev/issue/60272
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://pkg.go.dev/vuln/GO-2023-1840
- https://pkg.go.dev/vuln/GO-2023-1840
- https://security.gentoo.org/glsa/202311-09
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20241220-0009/
Modified: 2025-01-06
CVE-2023-29404
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.
- https://go.dev/cl/501225
- https://go.dev/cl/501225
- https://go.dev/issue/60305
- https://go.dev/issue/60305
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://pkg.go.dev/vuln/GO-2023-1841
- https://pkg.go.dev/vuln/GO-2023-1841
- https://security.gentoo.org/glsa/202311-09
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20241115-0009/
Modified: 2025-01-06
CVE-2023-29405
The go command may execute arbitrary code at build time when using cgo. This may occur when running "go get" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a "#cgo LDFLAGS" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.
- https://go.dev/cl/501224
- https://go.dev/cl/501224
- https://go.dev/issue/60306
- https://go.dev/issue/60306
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://groups.google.com/g/golang-announce/c/q5135a9d924/m/j0ZoAJOHAwAJ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZ2O6YCO2IZMZJELQGZYR2WAUNEDLYV6/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBS3IIK6ADV24C5ULQU55QLT2UE762ZX/
- https://pkg.go.dev/vuln/GO-2023-1842
- https://pkg.go.dev/vuln/GO-2023-1842
- https://security.gentoo.org/glsa/202311-09
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20241206-0003/
Package clickhouse-cpp updated to version 2.4.0-alt2 for branch sisyphus in task 323807.
Closed bugs
Файловый конфликт с пакетом libclickhouse-cpp-devel