ALT-BU-2024-7711-1
Branch sisyphus_e2k update bulletin.
Package freeipa updated to version 4.11.1-alt3 for branch sisyphus_e2k.
Closed bugs
freeipa-4.11.1-alt2 не собирается с новой samba-4.20
Package postfix updated to version 3.8.6-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2025-11-19
BDU:2024-00106
Уязвимость демона smtpd почтового сервера Postfix, позволяющая нарушителю обойти ограничения безопасности и осуществить подмену электронных писем (атака типа SMTP Smuggling)
Modified: 2025-11-04
CVE-2023-51764
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports
- http://www.openwall.com/lists/oss-security/2023/12/24/1
- http://www.openwall.com/lists/oss-security/2023/12/25/1
- http://www.openwall.com/lists/oss-security/2024/05/09/3
- https://access.redhat.com/security/cve/CVE-2023-51764
- https://bugzilla.redhat.com/show_bug.cgi?id=2255563
- https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html
- https://github.com/duy-31/CVE-2023-51764
- https://github.com/eeenvik1/CVE-2023-51764
- https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/
- https://lwn.net/Articles/956533/
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
- https://www.openwall.com/lists/oss-security/2024/01/22/1
- https://www.postfix.org/announcements/postfix-3.8.5.html
- https://www.postfix.org/smtp-smuggling.html
- https://www.youtube.com/watch?v=V8KPV96g1To
- http://www.openwall.com/lists/oss-security/2023/12/24/1
- http://www.openwall.com/lists/oss-security/2023/12/25/1
- http://www.openwall.com/lists/oss-security/2024/05/09/3
- https://access.redhat.com/security/cve/CVE-2023-51764
- https://bugzilla.redhat.com/show_bug.cgi?id=2255563
- https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html
- https://github.com/duy-31/CVE-2023-51764
- https://github.com/eeenvik1/CVE-2023-51764
- https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRLF5SOS7TP5N7FQSEK2NFNB44ISVTZC/
- https://lwn.net/Articles/956533/
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
- https://www.openwall.com/lists/oss-security/2024/01/22/1
- https://www.postfix.org/announcements/postfix-3.8.5.html
- https://www.postfix.org/smtp-smuggling.html
- https://www.youtube.com/watch?v=V8KPV96g1To
Closed bugs
Предупреждения о попытке чтения несуществующих библиотек
CVE-2023-51764 для закрытия необходимо обновление до версии 3.8.4 и старше
Package plasma5-sdk updated to version 5.27.11-alt2 for branch sisyphus_e2k.
Closed bugs
Не работает кнопка "Открыть во внешней программе" в cuttlefish
Двойное оповещение при создании нового оформления в lookandfeelexplorer
Package mkimage-profiles updated to version 1.6.4-alt1 for branch sisyphus_e2k.
Closed bugs
бессмысленный запуск ldconfig при загрузке с LiveCD
Package glib2 updated to version 2.80.2-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2025-11-04
CVE-2024-34397
An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.
- https://gitlab.gnome.org/GNOME/glib/-/issues/3268
- https://lists.debian.org/debian-lts-announce/2024/05/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/
- https://security.netapp.com/advisory/ntap-20240531-0008/
- https://www.openwall.com/lists/oss-security/2024/05/07/5
- https://gitlab.gnome.org/GNOME/glib/-/issues/3268
- https://lists.debian.org/debian-lts-announce/2024/05/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/
- https://security.netapp.com/advisory/ntap-20240531-0008/
- https://www.openwall.com/lists/oss-security/2024/05/07/5
Package dcmtk updated to version 3.6.8-alt2 for branch sisyphus_e2k.
Closed bugs
Неполный -devel ломает сборку