ALT-BU-2025-11695-1
Branch sisyphus_riscv64 update bulletin.
Package edit updated to version 1.2.0-alt2 for branch sisyphus_riscv64.
Closed bugs
Ошибка при поиске текста без зависимого пакета libicu-devel
Package cups updated to version 2.4.14-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
CVE-2025-58060
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass. Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the issue.
CVE-2025-58364
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability available in local subnet in default configurations. It can cause the cups & cups-browsed to crash, on all the machines in local network who are listening for printers (so by default for all regular linux machines). On systems where the vulnerability CVE-2024-47176 (cups-filters 1.x/cups-browsed 2.x vulnerability) was not fixed, and the firewall on the machine does not reject incoming communication to IPP port, and the machine is set to be available to public internet, attack vector "Network" is possible. The current versions of CUPS and cups-browsed projects have the attack vector "Adjacent" in their default configurations. Version 2.4.13 contains a patch for CVE-2025-58364.
Package ImageMagick updated to version 7.1.2.3-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-09-10
CVE-2025-57807
ImageMagick is free and open-source software used for editing and manipulating digital images. ImageMagick versions lower than 14.8.2 include insecure functions: SeekBlob(), which permits advancing the stream offset beyond the current end without increasing capacity, and WriteBlob(), which then expands by quantum + length (amortized) instead of offset + length, and copies to data + offset. When offset ≫ extent, the copy targets memory beyond the allocation, producing a deterministic heap write on 64-bit builds. No 2⁶⁴ arithmetic wrap, external delegates, or policy settings are required. This is fixed in version 14.8.2.
Package wireshark updated to version 4.4.9-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-09-04
CVE-2025-9817
SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service
Package installer updated to version 1.16.25-alt1 for branch sisyphus_riscv64.
Closed bugs
Ошибка в dmesg от systemd-cryptsetup-generator при установке с зашифрованным brtfs