ALT-BU-2025-14221-1
Branch sisyphus_riscv64 update bulletin.
Package docs-alt-workstation updated to version 11.1-alt5 for branch sisyphus_riscv64.
Closed bugs
Исправления в описании утилиты chmod
Package kea updated to version 3.0.2-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-11-04
CVE-2025-11232
To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9.-]"; "hostname-char-replacement" must be empty (the default); and "ddns-qualifying-suffix" must *NOT* be empty (the default is empty). DDNS updates do not need to be enabled for this issue to manifest. A client that sends certain option content would then cause kea-dhcp4 to exit unexpectedly. This issue affects Kea versions 3.0.1 through 3.0.1 and 3.1.1 through 3.1.2.
Package python3 updated to version 3.13.9-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-10-29
BDU:2025-03332
Уязвимость модуля cpython языка программирования Python, позволяющая нарушителю нарушить выполнить произвольный код
Modified: 2025-11-03
CVE-2024-9287
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren't activated before being used (ie "./venv/bin/python") are not affected.
- https://github.com/python/cpython/commit/633555735a023d3e4d92ba31da35b1205f9ecbd7
- https://github.com/python/cpython/commit/8450b2482586857d689b6658f08de9c8179af7db
- https://github.com/python/cpython/commit/9286ab3a107ea41bd3f3c3682ce2512692bdded8
- https://github.com/python/cpython/commit/ae961ae94bf19c8f8c7fbea3d1c25cc55ce8ae97
- https://github.com/python/cpython/commit/d48cc82ed25e26b02eb97c6263d95dcaa1e9111b
- https://github.com/python/cpython/commit/e52095a0c1005a87eed2276af7a1f2f66e2b6483
- https://github.com/python/cpython/issues/124651
- https://github.com/python/cpython/pull/124712
- https://mail.python.org/archives/list/security-announce@python.org/thread/RSPJ2B5JL22FG3TKUJ7D7DQ4N5JRRBZL/
- https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
- https://security.netapp.com/advisory/ntap-20250425-0006/
Package installer updated to version 1.16.29-alt1 for branch sisyphus_riscv64.
Closed bugs
При установке на RAID не создан mdadm.conf, в результате система в состоянии degraded
Package alterator-users updated to version 10.27-alt1 for branch sisyphus_riscv64.
Closed bugs
Не сохраняет реальное имя
Package libopencv updated to version 4.12.0-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-10-17
CVE-2025-53644
OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap buffer write when reading crafted JPEG images. Version 4.12.0 fixes the vulnerability.
Closed bugs
libopencv собрана без gstreamer