ALT-BU-2025-12577-1
Branch sisyphus_riscv64 update bulletin.
Package edbrowse updated to version 3.8.12-alt2 for branch sisyphus_riscv64.
Closed bugs
Manual page refer to non-existence file
Package LibreSSL updated to version 4.1.1-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-10-02
CVE-2025-9230
Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.
- https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45
- https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280
- https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def
- https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd
- https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482
- https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3
- https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba
- https://openssl-library.org/news/secadv/20250930.txt
Package ghostscript updated to version 10.06.0-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2025-11520
Уязвимость функции pdf_write_cmap набора программного обеспечения для обработки, преобразования и генерации документов Ghostscript, позволяющая нарушителю оказать воздействие на целостность защищаемой информации
BDU:2025-11521
Уязвимость функции pdfmark_coerce_dest набора программного обеспечения для обработки, преобразования и генерации документов Ghostscript, позволяющая нарушителю оказать воздействие на целостность защищаемой информации
BDU:2025-11522
Уязвимость функции ocr_begin_page набора программного обеспечения для обработки, преобразования и генерации документов Ghostscript, позволяющая нарушителю оказать воздействие на целостность защищаемой информации
Modified: 2025-09-25
CVE-2025-59798
Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.
Modified: 2025-09-25
CVE-2025-59799
Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size value.
Modified: 2025-09-25
CVE-2025-59800
In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.