ALT-BU-2023-5926-1
Branch sisyphus_mipsel update bulletin.
Package gnome-menus updated to version 3.36.0-alt2 for branch sisyphus_mipsel.
Closed bugs
У папки Утилиты в приложениях Gnome отсутствует лексикон
Package xrdp updated to version 0.9.23-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
Modified: 2025-02-13
CVE-2023-40184
xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
- https://github.com/neutrinolabs/xrdp/blame/9bbb2ec68f390504c32f2062847aa3d821a0089a/sesman/sesexec/session.c#L571C5-L571C19
- https://github.com/neutrinolabs/xrdp/blame/9bbb2ec68f390504c32f2062847aa3d821a0089a/sesman/sesexec/session.c#L571C5-L571C19
- https://github.com/neutrinolabs/xrdp/commit/a111a0fdfe2421ef600e40708b5f0168594cfb23
- https://github.com/neutrinolabs/xrdp/commit/a111a0fdfe2421ef600e40708b5f0168594cfb23
- https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-f489-557v-47jq
- https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-f489-557v-47jq
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SOT237TIHTHPX5YNIWLVNINOEYC7WMG2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SOT237TIHTHPX5YNIWLVNINOEYC7WMG2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5IXMQODV3OIJ7DRQBUQV7PUKNT7SH36/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5IXMQODV3OIJ7DRQBUQV7PUKNT7SH36/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URO3FKTFBPNKFARAQBEJLI4MH6YS35P5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URO3FKTFBPNKFARAQBEJLI4MH6YS35P5/
Package yara updated to version 4.4.0-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-40857
Buffer Overflow vulnerability in VirusTotal yara v.4.3.2 allows a remote attacker to execute arbtirary code via the yr_execute_cod function in the exe.c component.
Package bind updated to version 9.16.44-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
BDU:2023-06079
Уязвимость демона named DNS-сервера BIND, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2023-3341
The code that processes control channel messages sent to `named` calls certain functions recursively during packet parsing. Recursion depth is only limited by the maximum accepted packet size; depending on the environment, this may cause the packet-parsing code to run out of available stack memory, causing `named` to terminate unexpectedly. Since each incoming control channel message is fully parsed before its contents are authenticated, exploiting this flaw does not require the attacker to hold a valid RNDC key; only network access to the control channel's configured TCP port is necessary. This issue affects BIND 9 versions 9.2.0 through 9.16.43, 9.18.0 through 9.18.18, 9.19.0 through 9.19.16, 9.9.3-S1 through 9.16.43-S1, and 9.18.0-S1 through 9.18.18-S1.
- http://www.openwall.com/lists/oss-security/2023/09/20/2
- http://www.openwall.com/lists/oss-security/2023/09/20/2
- CVE-2023-3341
- CVE-2023-3341
- https://lists.debian.org/debian-lts-announce/2024/01/msg00021.html
- https://lists.debian.org/debian-lts-announce/2024/01/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IPJLLTJCSDJJII7IIZPLTBQNWP7MZH7F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U35OARLQCPMVCBBPHWBXY5M6XJLD2TZ5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSK5V4W4OHPM3JTJGWAQD6CZW7SFD75B/
- https://security.netapp.com/advisory/ntap-20231013-0003/
- https://security.netapp.com/advisory/ntap-20231013-0003/
- https://www.debian.org/security/2023/dsa-5504
- https://www.debian.org/security/2023/dsa-5504
Package docs-alt-kworkstation updated to version 10.2-alt9 for branch sisyphus_mipsel.
Closed bugs
Отсутствует скриншот в примечании документации для Workstation K
Обновить скриншот для KFind в документации ALT Workstation K
Документация docs-alt-kworkstation, п.62.4: указать о необходимости перезагрузки для появления модуля "Сервер обновлений" в веб-интерфейсе ЦУС