ALT-BU-2025-13704-1
Branch sisyphus_riscv64 update bulletin.
Package rear updated to version 2.9-alt3 for branch sisyphus_riscv64.
Closed bugs
Requires: syslinux syslinux-extlinux
sshd.service failed
Cannot migrate network interface because there is no usable MAC address on this system
Package spice-vdagent updated to version 0.23.0-alt2 for branch sisyphus_riscv64.
Closed bugs
Циклическая зависимость сервисов systemd (spice-vdagent)
Package ktouch updated to version 25.08.2-alt2 for branch sisyphus_riscv64.
Closed bugs
Не запускается KTouch установленный через Альт Центр
Package fractal updated to version 12.1-alt1 for branch sisyphus_riscv64.
Closed bugs
Прошу обновить Fractal до 11.1 версии
Package atuin updated to version 18.10.0-alt1 for branch sisyphus_riscv64.
Closed bugs
Не работает корректно в bash
Package installer-distro-virtualization-one updated to version 11.0.0-alt0.3 for branch sisyphus_riscv64.
Closed bugs
installer-steps не завершается пустой строкой
Package ImageMagick updated to version 7.1.2.8-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-11-03
CVE-2025-62171
ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exists in the BMP decoder on 32-bit systems. The vulnerability occurs in coders/bmp.c when calculating the extent value by multiplying image columns by bits per pixel. On 32-bit systems with size_t of 4 bytes, a malicious BMP file with specific dimensions can cause this multiplication to overflow and wrap to zero. The overflow check added to address CVE-2025-57803 is placed after the overflow occurs, making it ineffective. A specially crafted 58-byte BMP file with width set to 536,870,912 and 32 bits per pixel can trigger this overflow, causing the bytes_per_line calculation to become zero. This vulnerability only affects 32-bit builds of ImageMagick where default resource limits for width, height, and area have been manually increased beyond their defaults. 64-bit systems with size_t of 8 bytes are not vulnerable, and systems using default ImageMagick resource limits are not vulnerable. The vulnerability is fixed in versions 7.1.2-7 and 6.9.13-32.
Package paper-plane updated to version 0.1.0.beta.5-alt2.20.gab48a3e for branch sisyphus_riscv64.
Closed bugs
paper-plane падает при открытии программы
Package ntp updated to version 4.2.8p18-alt2 for branch sisyphus_riscv64.
Closed bugs
Не проходит тесты с openssl 3.5 и блокирует обновление openssl
Package samba updated to version 4.21.9-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-10-22
BDU:2025-13037
Уязвимость реализации сервера разрешения имён WINS пакета программ сетевого взаимодействия Samba, позволяющая нарушителю выполнить произвольный код
Modified: 2025-11-12
CVE-2025-10230
A flaw was found in Samba, in the front-end WINS hook handling: NetBIOS names from registration packets are passed to a shell without proper validation or escaping. Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as the Samba process.
Modified: 2025-11-04
CVE-2025-9640
A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability.
Package audit updated to version 4.1.2-alt2 for branch sisyphus_riscv64.
Closed bugs
Невозможно установить audit на систему без systemd
Package git-lfs updated to version 3.7.1-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-11-05
BDU:2025-13253
Уязвимость функций checkout() и pull() расширения Git для управления версиями больших файлов Git LFS, позволяющая нарушителю получить доступ на запись произвольных файлов
Modified: 2025-10-21
CVE-2025-26625
Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS. The git lfs checkout and git lfs pull commands do not check for symbolic links before writing to files in the working tree, allowing an attacker to craft a repository containing symbolic or hard links that cause Git LFS to write to arbitrary file system locations accessible to the user running these commands. As well, when the git lfs checkout and git lfs pull commands are run in a bare repository, they could write to files visible outside the repository. The vulnerability is fixed in version 3.7.1. As a workaround, support for symlinks in Git may be disabled by setting the core.symlinks configuration option to false, after which further clones and fetches will not create symbolic links. However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.
- https://github.com/git-lfs/git-lfs/commit/0cffe93176b870055c9dadbb3cc9a4a440e98396
- https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095ff356bc781e2a031abb46c1a8
- https://github.com/git-lfs/git-lfs/commit/d02bd13f02ef76f6807581cd6b34709069cb3615
- https://github.com/git-lfs/git-lfs/releases/tag/v3.7.1
- https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5
Package rdesktop updated to version 1.9.0-alt2 for branch sisyphus_riscv64.
Closed bugs
1.9.0-alt1: Segmentation fault при попытке подключиться к Win2003
Package libxslt updated to version 1.1.43-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-10-29
BDU:2025-03640
Уязвимость файла numbers.ct библиотеки libxslt, позволяющая нарушителю выполнить произвольный код
Modified: 2025-10-29
BDU:2025-03641
Уязвимость функции xsltGetInheritedNsList библиотеки libxslt, позволяющая нарушителю оказать влияние на целостность и доступность защищаемой информации
Modified: 2025-11-03
CVE-2024-55549
xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result prefixes.
Modified: 2025-11-03
CVE-2025-24855
numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath context node can be modified but never restored. This is related to xsltNumberFormatGetValue, xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal.
Package nginx updated to version 1.28.0-alt2 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-11-04
CVE-2025-53859
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Package wireshark updated to version 4.4.10-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2025-13330
Уязвимость компонента MONGO Dissector анализатора трафика компьютерных сетей Wireshark, позволяющая нарушителю вызывать отказ в обслуживании
Modified: 2025-10-14
CVE-2025-11626
MONGO dissector infinite loop in Wireshark 4.4.0 to 4.4.9 and 4.2.0 to 4.2.13 allows denial of service
Package templates updated to version 1.3-alt1 for branch sisyphus_riscv64.
Closed bugs
В контекстном меню "Создать документ" неверное написание слова "Файл" (со строчной, а не заглавной буквы)
Изменение названий шаблонов