ALT-BU-2023-5443-1
Branch sisyphus_mipsel update bulletin.
Package php8.2 updated to version 8.2.10-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-3247
In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.
Modified: 2025-02-13
CVE-2023-3823
In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.
- https://github.com/php/php-src/security/advisories/GHSA-3qrf-m4j2-pcrr
- https://github.com/php/php-src/security/advisories/GHSA-3qrf-m4j2-pcrr
- https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/
- https://security.netapp.com/advisory/ntap-20230825-0001/
- https://security.netapp.com/advisory/ntap-20230825-0001/
Modified: 2025-02-13
CVE-2023-3824
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
- https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv
- https://github.com/php/php-src/security/advisories/GHSA-jqcx-ccgc-xwhv
- https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html
- https://lists.debian.org/debian-lts-announce/2023/09/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7NBF77WN6DTVTY2RE73IGPYD6M4PIAWA/
- https://security.netapp.com/advisory/ntap-20230825-0001/
- https://security.netapp.com/advisory/ntap-20230825-0001/
Package realmd updated to version 0.17.1-alt7 for branch sisyphus_mipsel.
Closed bugs
Не хватает необходимых пакетов для ввода в домен Active Directory
Package myconnector updated to version 2.4.4-alt2 for branch sisyphus_mipsel.
Closed bugs
На Kworkstation 10.1 при использовании SDDM не запускается режим KIOSK
Не создаётся пользователь kiosk с помощью MyConnector Kiosk для MATE
Требует xterm
Некорректно создается новый пользователь для режима киоск
Package gpui updated to version 0.2.34-alt1 for branch sisyphus_mipsel.
Closed bugs
Список языков интерфейса выглядит одинаково в любом варианте
Package redis updated to version 7.2.0-alt3 for branch sisyphus_mipsel.
Closed bugs
redis-sentinel не имеет прав на запись конфигурационного файла