ALT-BU-2025-13293-1
Branch sisyphus_loongarch64 update bulletin.
Package task-edu updated to version 1.7.13-alt1 for branch sisyphus_loongarch64.
Closed bugs
убрать vulkan-amdgpu из зависимостей
Package pcs updated to version 0.11.6-alt3 for branch sisyphus_loongarch64.
Closed bugs
Ошибка uninitialized constant Rack::Handler при запуске pcsd
Package clementine updated to version 1.4.1.58-alt1.gbae968a2f for branch sisyphus_loongarch64.
Closed bugs
Linkage with library under the license GPL
Package fastfetch updated to version 2.54.0-alt1 for branch sisyphus_loongarch64.
Closed bugs
interface 'kde_output_device_v2' has no event 27
Package alterator-kopidel updated to version 1.0.5-alt1 for branch sisyphus_loongarch64.
Closed bugs
Долгая обработка игнорируемых файлов при использовании регулярных выражений
[FR] Добавить информацию, что опция -s является тестовой
Package passwdqc updated to version 2.0.3-alt3 for branch sisyphus_loongarch64.
Closed bugs
Увеличить минимальную длину пин-кодов до 6 символов
Package alterator-l10n updated to version 2.9.171-alt1 for branch sisyphus_loongarch64.
Closed bugs
Опечатка в справке команды kopidel
Package mupdf updated to version 1.26.10-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
Modified: 2025-10-08
BDU:2025-11246
Уязвимость утилиты mutool clean программы просмотра PDF-файлов MuPDF, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-10-02
CVE-2025-46206
An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When processing a crafted PDF file containing cyclic /Next references in the outline structure, the `strip_outline()` function enters infinite recursion
Modified: 2025-10-08
CVE-2025-55780
A null pointer dereference occurs in the function break_word_for_overflow_wrap() in MuPDF 1.26.4 when rendering a malformed EPUB document. Specifically, the function calls fz_html_split_flow() to split a FLOW_WORD node, but does not check if node->next is valid before accessing node->next->overflow_wrap, resulting in a crash if the split fails or returns a partial node chain.
Package sane updated to version 1.4.0-alt1 for branch sisyphus_loongarch64.
Closed bugs
new version
Package gem-passenger updated to version 6.1.0-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
Modified: 2025-02-28
CVE-2025-26803
The http parser in Phusion Passenger 6.0.21 through 6.0.25 before 6.0.26 allows a denial of service during parsing of a request with an invalid HTTP method.
- https://blog.phusion.nl/2025/02/19/passenger-6-0-26/
- https://github.com/phusion/passenger/commit/bb15591646687064ab2d578d5f9660b2a4168017
- https://github.com/phusion/passenger/compare/release-6.0.25...release-6.0.26
- https://github.com/phusion/passenger/releases/tag/release-6.0.26
- https://www.phusionpassenger.com/support
Package inkscape updated to version 1.4.2-alt2 for branch sisyphus_loongarch64.
Closed bugs
Не собирается с poppler-25.07.0
Package ansible-core updated to version 2.19.3-alt1 for branch sisyphus_loongarch64.
Closed bugs
ansible-core: ошибка при вызове модуля package_facts
Package python3-module-PyMuPDF updated to version 1.26.5-alt1 for branch sisyphus_loongarch64.
Closed bugs
ModuleNotFoundError: No module named 'mupdf'
Package kernel-image-6.12 updated to version 6.12.53-alt1.port.la64.1 for branch sisyphus_loongarch64.
Closed bugs
Включить CONFIG_HID_UNIVERSAL_PIDFF
Package thunderbird updated to version 144.0.1-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
Modified: 2025-11-03
CVE-2025-11708
Use-after-free in MediaTrackGraphImpl::GetInstance() This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1988931
- https://www.mozilla.org/security/advisories/mfsa2025-81/
- https://www.mozilla.org/security/advisories/mfsa2025-83/
- https://www.mozilla.org/security/advisories/mfsa2025-84/
- https://www.mozilla.org/security/advisories/mfsa2025-85/
- https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html
Modified: 2025-11-03
CVE-2025-11709
A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability affects Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1989127
- https://www.mozilla.org/security/advisories/mfsa2025-81/
- https://www.mozilla.org/security/advisories/mfsa2025-82/
- https://www.mozilla.org/security/advisories/mfsa2025-83/
- https://www.mozilla.org/security/advisories/mfsa2025-84/
- https://www.mozilla.org/security/advisories/mfsa2025-85/
- https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html
Modified: 2025-11-03
CVE-2025-11710
A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability affects Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1989899
- https://www.mozilla.org/security/advisories/mfsa2025-81/
- https://www.mozilla.org/security/advisories/mfsa2025-82/
- https://www.mozilla.org/security/advisories/mfsa2025-83/
- https://www.mozilla.org/security/advisories/mfsa2025-84/
- https://www.mozilla.org/security/advisories/mfsa2025-85/
- https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html
Modified: 2025-11-03
CVE-2025-11711
There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability affects Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1989978
- https://www.mozilla.org/security/advisories/mfsa2025-81/
- https://www.mozilla.org/security/advisories/mfsa2025-82/
- https://www.mozilla.org/security/advisories/mfsa2025-83/
- https://www.mozilla.org/security/advisories/mfsa2025-84/
- https://www.mozilla.org/security/advisories/mfsa2025-85/
- https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html
Modified: 2025-11-03
CVE-2025-11712
A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a content-type header. This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1979536
- https://www.mozilla.org/security/advisories/mfsa2025-81/
- https://www.mozilla.org/security/advisories/mfsa2025-83/
- https://www.mozilla.org/security/advisories/mfsa2025-84/
- https://www.mozilla.org/security/advisories/mfsa2025-85/
- https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html
Modified: 2025-11-14
CVE-2025-11713
Insufficient escaping in the “Copy as cURL” feature could have been used to trick a user into executing unexpected code on Windows. This did not affect the application when running on other operating systems. This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.
Modified: 2025-11-03
CVE-2025-11714
Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1973699%2C1989945%2C1990970%2C1991040%2C1992113
- https://www.mozilla.org/security/advisories/mfsa2025-81/
- https://www.mozilla.org/security/advisories/mfsa2025-82/
- https://www.mozilla.org/security/advisories/mfsa2025-83/
- https://www.mozilla.org/security/advisories/mfsa2025-84/
- https://www.mozilla.org/security/advisories/mfsa2025-85/
- https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html
Modified: 2025-11-03
CVE-2025-11715
Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1983838%2C1987624%2C1988244%2C1988912%2C1989734%2C1990085%2C1991899
- https://www.mozilla.org/security/advisories/mfsa2025-81/
- https://www.mozilla.org/security/advisories/mfsa2025-83/
- https://www.mozilla.org/security/advisories/mfsa2025-84/
- https://www.mozilla.org/security/advisories/mfsa2025-85/
- https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html
- https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html
Modified: 2025-10-16
CVE-2025-11716
Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability affects Firefox < 144 and Thunderbird < 144.
Modified: 2025-11-14
CVE-2025-11719
Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability affects Firefox < 144 and Thunderbird < 144.
Modified: 2025-10-15
CVE-2025-11721
Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox < 144 and Thunderbird < 144.
Package spdk updated to version 25.05.1-alt1 for branch sisyphus_loongarch64.
Closed vulnerabilities
Modified: 2025-10-21
CVE-2025-57275
Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.
Package ngspice updated to version 45.2-alt2 for branch sisyphus_loongarch64.
Closed bugs
Linkage with library under the license GPL
Package branding-simply-linux updated to version 11.0.900-alt1 for branch sisyphus_loongarch64.
Closed bugs
branding-simply-linux: system-logo.png является симлинком