ALT-BU-2024-15945-1
Branch sisyphus_loongarch64 update bulletin.
Package installer updated to version 1.15.14-alt1 for branch sisyphus_loongarch64.
Closed bugs
Требуется удалять вручную /etc/X11/xorg.conf после установки nvidia драйверов (nvidia-install-driver). Установка с fbdev.
Package graphviz updated to version 12.1.2-alt2 for branch sisyphus_loongarch64.
Closed bugs
dot не генерирует svg для больших графов
Package adguardhome updated to version 0.108.0-alt1.beta60 for branch sisyphus_loongarch64.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-32175
In AdGuardHome, versions v0.95 through v0.108.0-b.13 are vulnerable to Cross-Site Request Forgery (CSRF), in the custom filtering rules functionality. An attacker can persuade an authorized user to follow a malicious link, resulting in deleting/modifying the custom filtering rules.
- https://github.com/AdguardTeam/AdGuardHome/blob/v0.108.0-b.13/internal/home/controlfiltering.go#L265
- https://github.com/AdguardTeam/AdGuardHome/blob/v0.108.0-b.13/internal/home/controlfiltering.go#L265
- https://www.mend.io/vulnerability-database/CVE-2022-32175
- https://www.mend.io/vulnerability-database/CVE-2022-32175
Package python3-module-gunicorn updated to version 23.0.0-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
BDU:2024-03553
Уязвимость WSGI-сервера gunicorn, связанная с недостатками обработки HTTP-запросов, позволяющая нарушителю обойти существующие ограничения безопасности и выполнить атаку «контрабанда HTTP-запросов»
Modified: 2024-12-20
CVE-2024-1135
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
- https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
- https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
- https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00018.html
Closed bugs
Для закрытия CVE-2024-1135 необходимо обновить пакет
Package dconf-editor updated to version 45.0.1-alt2 for branch sisyphus_loongarch64.
Closed bugs
Опечатка в русском переводе слова default
Package plasma-workspace updated to version 6.2.3-alt3 for branch sisyphus_loongarch64.
Closed bugs
Настройка сохранения сеанса в KDE не работает
Package isync updated to version 1.4.4-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2021-3657
A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals, malicious or compromised IMAP servers, and hypothetically even external email senders, could cause several different buffer overflows, which could conceivably be exploited for remote code execution.
- https://bugzilla.redhat.com/show_bug.cgi?id=2028932
- https://bugzilla.redhat.com/show_bug.cgi?id=2028932
- [debian-lts-announce] 20220701 [SECURITY] [DLA 3066-1] isync security update
- [debian-lts-announce] 20220701 [SECURITY] [DLA 3066-1] isync security update
- GLSA-202208-15
- GLSA-202208-15
- https://www.openwall.com/lists/oss-security/2021/12/03/1
- https://www.openwall.com/lists/oss-security/2021/12/03/1
Package dnsdist updated to version 1.9.7-alt3 for branch sisyphus_loongarch64.
Closed bugs
Не запускается сервис по умолчанию dnsdist
Package cockpit updated to version 311.1-alt0.port for branch sisyphus_loongarch64.
Closed bugs
AttributeError: 'float' object has no attribute 'split' при работе cockpit-bridge
cockpit: FTBFS