ALT-BU-2023-8189-2
Branch sisyphus update bulletin.
Closed bugs
Убрать goverlay из зависимостей.
Package admx-basealt updated to version 0.1.13.4-alt1 for branch sisyphus in task 336672.
Closed bugs
Региональные и языковые параметры: бесполезный чекбокс Блокировать настройку языка системы
Closed bugs
Обои рабочего стола: не меняет картинку (неверное регулярное выражение для задания параметра)
Closed bugs
Ошибка "a2enmode: команда не найдена" при установке
Package php8.0-igbinary updated to version 3.2.15-alt2.8.0.30 for branch sisyphus in task 336739.
Closed bugs
igbinary: Неверно указано название ini-файла
Package php8.2-igbinary updated to version 3.2.15-alt2.8.2.13 for branch sisyphus in task 336739.
Closed bugs
igbinary: Неверно указано название ini-файла
Package php8.1-igbinary updated to version 3.2.15-alt2.8.1.26 for branch sisyphus in task 336739.
Closed bugs
igbinary: Неверно указано название ini-файла
Package python3-module-scipy updated to version 1.11.4-alt2 for branch sisyphus in task 336745.
Closed bugs
broken scipy.sparse.linalg._isolve
Package avidemux-qt updated to version 2.8.1-alt3 for branch sisyphus in task 336765.
Closed bugs
Исправить сборку avidemux-qt
Closed vulnerabilities
BDU:2024-02324
Уязвимость библиотеки SSL/TLS wolfSSL, связанная с раскрытием информации через несоответствие, позволяющая нарушителю расшифровывать зашифрованные тексты и подделывать подписи
Modified: 2024-11-21
CVE-2023-6935
wolfSSL SP Math All RSA implementation is vulnerable to the Marvin Attack, new variation of a timing Bleichenbacher style attack, when built with the following options to configure: --enable-all CFLAGS="-DWOLFSSL_STATIC_RSA" The define “WOLFSSL_STATIC_RSA” enables static RSA cipher suites, which is not recommended, and has been disabled by default since wolfSSL 3.6.6. Therefore the default build since 3.6.6, even with "--enable-all", is not vulnerable to the Marvin Attack. The vulnerability is specific to static RSA cipher suites, and expected to be padding-independent. The vulnerability allows an attacker to decrypt ciphertexts and forge signatures after probing with a large number of test observations. However the server’s private key is not exposed.
Modified: 2025-03-26
CVE-2023-6936
In wolfSSL prior to 5.6.6, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS client or network attacker can trigger a buffer over-read on the heap of 5 bytes (WOLFSSL_CALLBACKS is only intended for debugging).
Modified: 2025-02-21
CVE-2023-6937
wolfSSL prior to 5.6.6 did not check that messages in one (D)TLS record do not span key boundaries. As a result, it was possible to combine (D)TLS messages using different keys into one (D)TLS record. The most extreme edge case is that, in (D)TLS 1.3, it was possible that an unencrypted (D)TLS 1.3 record from the server containing first a ServerHello message and then the rest of the first server flight would be accepted by a wolfSSL client. In (D)TLS 1.3 the handshake is encrypted after the ServerHello but a wolfSSL client would accept an unencrypted flight from the server. This does not compromise key negotiation and authentication so it is assigned a low severity rating.
Modified: 2024-09-04
CVE-2024-1543
The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a controlled environment such as Intel SGX, an attacker can gain a per instruction sub-cache-line resolution allowing them to break the cache-line-level protection. For details on the attack refer to: https://doi.org/10.46586/tches.v2024.i1.457-500
Closed vulnerabilities
Modified: 2025-12-03
BDU:2023-03406
Уязвимость функции raw2image_ex() библиотеки для обработки изображений LibRaw, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-03-20
CVE-2023-1729
A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.
- https://bugzilla.redhat.com/show_bug.cgi?id=2188240
- https://github.com/LibRaw/LibRaw/issues/557
- https://lists.debian.org/debian-lts-announce/2023/05/msg00025.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ6XF5WTPJ4GLXQ62JVRDZSVSJHXNQU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E5ZJ3UBTJBZHNPJQFOSGM5L7WAHHE2GY/
- https://security.gentoo.org/glsa/202312-08
- https://www.debian.org/security/2023/dsa-5412
- https://bugzilla.redhat.com/show_bug.cgi?id=2188240
- https://github.com/LibRaw/LibRaw/issues/557
- https://lists.debian.org/debian-lts-announce/2023/05/msg00025.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGZ6XF5WTPJ4GLXQ62JVRDZSVSJHXNQU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E5ZJ3UBTJBZHNPJQFOSGM5L7WAHHE2GY/
- https://security.gentoo.org/glsa/202312-08
- https://www.debian.org/security/2023/dsa-5412
