ALT-BU-2024-12496-1
Branch c10f2 update bulletin.
Closed bugs
message file /var/lib/firebird/system/firebird.msg not found
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-4055
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
Closed bugs
Устарел, есть 1.2.1
Package protobuf-c updated to version 1.5.0-alt1 for branch c10f2 in task 356812.
Closed vulnerabilities
BDU:2023-03313
Уязвимость функции parse_required_member() протокола сериализации данных protobuf-c, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код и привести систему к полной компрометации
Modified: 2025-02-07
CVE-2022-48468
protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
- https://github.com/protobuf-c/protobuf-c/commit/ec3d900001a13ccdaa8aef996b34c61159c76217
- https://github.com/protobuf-c/protobuf-c/commit/ec3d900001a13ccdaa8aef996b34c61159c76217
- https://github.com/protobuf-c/protobuf-c/issues/499
- https://github.com/protobuf-c/protobuf-c/issues/499
- https://github.com/protobuf-c/protobuf-c/pull/513
- https://github.com/protobuf-c/protobuf-c/pull/513
- https://github.com/protobuf-c/protobuf-c/releases/tag/v1.4.1
- https://github.com/protobuf-c/protobuf-c/releases/tag/v1.4.1
- FEDORA-2023-4e094d5297
- FEDORA-2023-4e094d5297
- FEDORA-2023-8b0938312e
- FEDORA-2023-8b0938312e
- FEDORA-2023-6cfe134db6
- FEDORA-2023-6cfe134db6
Closed vulnerabilities
BDU:2024-04683
Уязвимость компонента userinfo URI менеджера загрузок GNU Wget, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации
Modified: 2025-04-21
CVE-2024-38428
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
- https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace
- https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace
- https://lists.debian.org/debian-lts-announce/2025/04/msg00029.html
- https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html
- https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html
- https://security.netapp.com/advisory/ntap-20241115-0005/
Closed bugs
Поломался wget
wget выдаёт "Неверный системный вызов" на aarch64