ALT-BU-2023-7880-1
Branch sisyphus_loongarch64 update bulletin.
Package libwebkitgtk6.0 updated to version 2.42.3-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
BDU:2023-08366
Уязвимость операционных систем iOS, iPadOS, macOS и браузера Safari, связанная с недостатками контроля доступа, позволяющая нарушителю раскрыть защищаемую информацию
BDU:2023-08367
Уязвимость модуля отображения веб-страниц WebKit операционных систем iOS, iPadOS, macOS и браузера Safari, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-29
CVE-2023-42916
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://security.gentoo.org/glsa/202401-04
- https://security.gentoo.org/glsa/202401-04
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214062
- https://support.apple.com/kb/HT214062
- https://www.debian.org/security/2023/dsa-5575
- https://www.debian.org/security/2023/dsa-5575
Modified: 2025-02-10
CVE-2023-42917
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://security.gentoo.org/glsa/202401-04
- https://security.gentoo.org/glsa/202401-04
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214062
- https://support.apple.com/kb/HT214062
- https://www.debian.org/security/2023/dsa-5575
- https://www.debian.org/security/2023/dsa-5575
Package libwebkitgtk4.1 updated to version 2.42.3-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
BDU:2023-08366
Уязвимость операционных систем iOS, iPadOS, macOS и браузера Safari, связанная с недостатками контроля доступа, позволяющая нарушителю раскрыть защищаемую информацию
BDU:2023-08367
Уязвимость модуля отображения веб-страниц WebKit операционных систем iOS, iPadOS, macOS и браузера Safari, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-29
CVE-2023-42916
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://security.gentoo.org/glsa/202401-04
- https://security.gentoo.org/glsa/202401-04
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214062
- https://support.apple.com/kb/HT214062
- https://www.debian.org/security/2023/dsa-5575
- https://www.debian.org/security/2023/dsa-5575
Modified: 2025-02-10
CVE-2023-42917
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://security.gentoo.org/glsa/202401-04
- https://security.gentoo.org/glsa/202401-04
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214062
- https://support.apple.com/kb/HT214062
- https://www.debian.org/security/2023/dsa-5575
- https://www.debian.org/security/2023/dsa-5575
Package libwebkitgtk4 updated to version 2.42.3-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
BDU:2023-08366
Уязвимость операционных систем iOS, iPadOS, macOS и браузера Safari, связанная с недостатками контроля доступа, позволяющая нарушителю раскрыть защищаемую информацию
BDU:2023-08367
Уязвимость модуля отображения веб-страниц WebKit операционных систем iOS, iPadOS, macOS и браузера Safari, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-29
CVE-2023-42916
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://security.gentoo.org/glsa/202401-04
- https://security.gentoo.org/glsa/202401-04
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214062
- https://support.apple.com/kb/HT214062
- https://www.debian.org/security/2023/dsa-5575
- https://www.debian.org/security/2023/dsa-5575
Modified: 2025-02-10
CVE-2023-42917
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/12
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/13
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/3
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/4
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/5
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2023/Dec/8
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://seclists.org/fulldisclosure/2024/Jan/35
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- http://www.openwall.com/lists/oss-security/2023/12/05/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AD2KIHHCUBQC2YYH3FJWAHI5BG3QETOH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/
- https://security.gentoo.org/glsa/202401-04
- https://security.gentoo.org/glsa/202401-04
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214031
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214032
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/en-us/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214033
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214034
- https://support.apple.com/kb/HT214062
- https://support.apple.com/kb/HT214062
- https://www.debian.org/security/2023/dsa-5575
- https://www.debian.org/security/2023/dsa-5575
Package inxi updated to version 3.3.31.2-alt1.1 for branch sisyphus_loongarch64.
Closed bugs
При использовании утилиты, уведомление: Use of uninitialized value $platform in hash element at /usr/bin/inxi line 16284
Package fish updated to version 3.6.4-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-49284
fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. While this may cause unexpected behavior with direct input (for example, echo \UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if the output is being fed from an external program into a command substitution where this output may not be expected. This design flaw was introduced in very early versions of fish, predating the version control system, and is thought to be present in every version of fish released in the last 15 years or more, although with different characters. Code execution does not appear to be possible, but denial of service (through large brace expansion) or information disclosure (such as variable expansion) is potentially possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- http://www.openwall.com/lists/oss-security/2023/12/08/1
- http://www.openwall.com/lists/oss-security/2023/12/08/1
- https://github.com/fish-shell/fish-shell/commit/09986f5563e31e2c900a606438f1d60d008f3a14
- https://github.com/fish-shell/fish-shell/commit/09986f5563e31e2c900a606438f1d60d008f3a14
- https://github.com/fish-shell/fish-shell/security/advisories/GHSA-2j9r-pm96-wp4f
- https://github.com/fish-shell/fish-shell/security/advisories/GHSA-2j9r-pm96-wp4f
Package IMSProg updated to version 1.1.2-alt1 for branch sisyphus_loongarch64.
Closed bugs
Доступна новая версия 1.1.2
Package curl updated to version 8.5.0-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
Modified: 2025-02-13
CVE-2023-46218
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
- https://curl.se/docs/CVE-2023-46218.html
- https://curl.se/docs/CVE-2023-46218.html
- https://hackerone.com/reports/2212193
- https://hackerone.com/reports/2212193
- https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
- https://security.netapp.com/advisory/ntap-20240125-0007/
- https://security.netapp.com/advisory/ntap-20240125-0007/
- https://www.debian.org/security/2023/dsa-5587
- https://www.debian.org/security/2023/dsa-5587
Modified: 2025-02-13
CVE-2023-46219
When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use.
- https://curl.se/docs/CVE-2023-46219.html
- https://curl.se/docs/CVE-2023-46219.html
- https://hackerone.com/reports/2236133
- https://hackerone.com/reports/2236133
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
- https://security.netapp.com/advisory/ntap-20240119-0007/
- https://security.netapp.com/advisory/ntap-20240119-0007/
- https://www.debian.org/security/2023/dsa-5587
- https://www.debian.org/security/2023/dsa-5587
Package pyLinuxWheel updated to version 0.6.1-alt4 for branch sisyphus_loongarch64.
Closed bugs
html код в разделе настроек "о программе"
Package golang updated to version 1.21.5-alt0.port for branch sisyphus_loongarch64.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-39326
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.
- https://go.dev/cl/547335
- https://go.dev/cl/547335
- https://go.dev/issue/64433
- https://go.dev/issue/64433
- https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
- https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/
- https://pkg.go.dev/vuln/GO-2023-2382
- https://pkg.go.dev/vuln/GO-2023-2382
Modified: 2024-11-21
CVE-2023-45283
The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a path beginning with \\?\. Paths with a \??\ prefix may be used to access arbitrary locations on the system. For example, the path \??\c:\x is equivalent to the more common path c:\x. Before fix, Clean could convert a rooted path such as \a\..\??\b into the root local device path \??\b. Clean will now convert this to .\??\b. Similarly, Join(\, ??, b) could convert a seemingly innocent sequence of path elements into the root local device path \??\b. Join will now convert this to \.\??\b. In addition, with fix, IsAbs now correctly reports paths beginning with \??\ as absolute, and VolumeName correctly reports the \??\ prefix as a volume name. UPDATE: Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the volume name in Windows paths starting with \?, resulting in filepath.Clean(\?\c:) returning \?\c: rather than \?\c:\ (among other effects). The previous behavior has been restored.
- http://www.openwall.com/lists/oss-security/2023/12/05/2
- http://www.openwall.com/lists/oss-security/2023/12/05/2
- https://go.dev/cl/540277
- https://go.dev/cl/540277
- https://go.dev/cl/541175
- https://go.dev/cl/541175
- https://go.dev/issue/63713
- https://go.dev/issue/63713
- https://go.dev/issue/64028
- https://go.dev/issue/64028
- https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY
- https://groups.google.com/g/golang-announce/c/4tU8LZfBFkY
- https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
- https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
- https://pkg.go.dev/vuln/GO-2023-2185
- https://pkg.go.dev/vuln/GO-2023-2185
- https://security.netapp.com/advisory/ntap-20231214-0008/
- https://security.netapp.com/advisory/ntap-20231214-0008/
Modified: 2024-11-21
CVE-2023-45285
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
- https://go.dev/cl/540257
- https://go.dev/cl/540257
- https://go.dev/issue/63845
- https://go.dev/issue/63845
- https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
- https://groups.google.com/g/golang-dev/c/6ypN5EjibjM/m/KmLVYH_uAgAJ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UIU6HOGV6RRIKWM57LOXQA75BGZSIH6G/
- https://pkg.go.dev/vuln/GO-2023-2383
- https://pkg.go.dev/vuln/GO-2023-2383
Package python3-module-numpy updated to version 1.25.2-alt3 for branch sisyphus_loongarch64.
Closed bugs
При обновлении устанавливаются 58 лишних пакетов