ALT-BU-2024-3074-1
Branch sisyphus_loongarch64 update bulletin.
Package admc updated to version 0.16.0-alt1 for branch sisyphus_loongarch64.
Closed bugs
Не показывается constucted атрибут
[admc] Некорректно меняется иконка связи групповой политики, привязанной домену
Package thunderbird updated to version 115.8.0-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
Modified: 2025-03-27
CVE-2024-1546
When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memory read. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1843752
- https://bugzilla.mozilla.org/show_bug.cgi?id=1843752
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-28
CVE-2024-1547
Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victim website's URL shown). This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1877879
- https://bugzilla.mozilla.org/show_bug.cgi?id=1877879
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-27
CVE-2024-1548
A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1832627
- https://bugzilla.mozilla.org/show_bug.cgi?id=1832627
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-27
CVE-2024-1549
If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in user confusion and unexpected granted permissions. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1833814
- https://bugzilla.mozilla.org/show_bug.cgi?id=1833814
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-27
CVE-2024-1550
A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-positioned unexpectedly, which could have led to user confusion and inadvertently granting permissions they did not intend to grant. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1860065
- https://bugzilla.mozilla.org/show_bug.cgi?id=1860065
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-04-02
CVE-2024-1551
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1864385
- https://bugzilla.mozilla.org/show_bug.cgi?id=1864385
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-27
CVE-2024-1552
Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1874502
- https://bugzilla.mozilla.org/show_bug.cgi?id=1874502
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Modified: 2025-03-27
CVE-2024-1553
Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.
- Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8
- Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00000.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2024/03/msg00001.html
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-05/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-06/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
- https://www.mozilla.org/security/advisories/mfsa2024-07/
Package cyrus-sasl2 updated to version 2.1.28-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
BDU:2020-01461
Уязвимость метода аунтефикации пользователей Cyrus SASL, связанная с записью за границами буфера памяти, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01443
Уязвимость реализации механизма аутентификации Cyrus SASL, связанная с непринятием мер по защите структуры SQL-запроса, позволяющая нарушителю выполнить произвольный SQL-запрос
Modified: 2024-11-21
CVE-2019-19906
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.
- 20200717 APPLE-SA-2020-07-15-1 iOS 13.6 and iPadOS 13.6
- 20200717 APPLE-SA-2020-07-15-1 iOS 13.6 and iPadOS 13.6
- 20200717 APPLE-SA-2020-07-15-2 macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
- 20200717 APPLE-SA-2020-07-15-2 macOS Catalina 10.15.6, Security Update 2020-004 Mojave, Security Update 2020-004 High Sierra
- [oss-security] 20220223 Fwd: Cyrus-SASL 2.1.28 released [fixes CVE-2022-24407 & CVE-2019-19906]
- [oss-security] 20220223 Fwd: Cyrus-SASL 2.1.28 released [fixes CVE-2022-24407 & CVE-2019-19906]
- https://github.com/cyrusimap/cyrus-sasl/issues/587
- https://github.com/cyrusimap/cyrus-sasl/issues/587
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8
- [debian-lts-announce] 20191220 [SECURITY] [DLA 2044-1] cyrus-sasl2 security update
- [debian-lts-announce] 20191220 [SECURITY] [DLA 2044-1] cyrus-sasl2 security update
- FEDORA-2020-51d591d035
- FEDORA-2020-51d591d035
- FEDORA-2020-bf829f9a84
- FEDORA-2020-bf829f9a84
- 20191225 [SECURITY] [DSA 4591-1] cyrus-sasl2 security update
- 20191225 [SECURITY] [DSA 4591-1] cyrus-sasl2 security update
- https://support.apple.com/kb/HT211288
- https://support.apple.com/kb/HT211288
- https://support.apple.com/kb/HT211289
- https://support.apple.com/kb/HT211289
- USN-4256-1
- USN-4256-1
- DSA-4591
- DSA-4591
- https://www.openldap.org/its/index.cgi/Incoming?id=9123
- https://www.openldap.org/its/index.cgi/Incoming?id=9123
Modified: 2024-11-21
CVE-2022-24407
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
- [oss-security] 20220223 Fwd: Cyrus-SASL 2.1.28 released [fixes CVE-2022-24407 & CVE-2019-19906]
- [oss-security] 20220223 Fwd: Cyrus-SASL 2.1.28 released [fixes CVE-2022-24407 & CVE-2019-19906]
- https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst
- https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst
- [debian-lts-announce] 20220306 [SECURITY] [DLA 2931-1] cyrus-sasl2 security update
- [debian-lts-announce] 20220306 [SECURITY] [DLA 2931-1] cyrus-sasl2 security update
- FEDORA-2022-e33e824d37
- FEDORA-2022-e33e824d37
- FEDORA-2022-8cc64f73d0
- FEDORA-2022-8cc64f73d0
- FEDORA-2022-f9642fab70
- FEDORA-2022-f9642fab70
- https://security.netapp.com/advisory/ntap-20221007-0003/
- https://security.netapp.com/advisory/ntap-20221007-0003/
- https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28
- https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28
- DSA-5087
- DSA-5087
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Closed bugs
При подготовке к Usrmerge сломался sssd
Package qt6-base updated to version 6.6.2-alt3 for branch sisyphus_loongarch64.
Closed bugs
segfaults
Package gwe updated to version 0.15.7-alt2 for branch sisyphus_loongarch64.
Closed bugs
ValueError: Namespace Notify not available
Package accountsservice updated to version 23.13.9-alt2 for branch sisyphus_loongarch64.
Closed bugs
Не отображается список пользователей при запуске системы | экран приветствие [GDM]
URL чужой