ALT-BU-2025-14544-1
Branch c10f2 update bulletin.
Package admx-firefox updated to version 7.0-alt1 for branch c10f2 in task 398434.
Closed bugs
Групповая политика для Mozilla - Firefox - Расширения: неверная ссылка на README в разделе Помощь
Групповая политика для Mozilla - Firefox - Расширения: отсутствует информация о поддерживаемых версиях
Package admx-chromium updated to version 138.0-alt1 for branch c10f2 in task 398434.
Closed bugs
Legacy Browser Support не переведен на русский
Closed vulnerabilities
No data currently available.
Closed bugs
samba + gpoa(gpupdate): Стал требовать авторизации, которая ему не нужна
Closed bugs
Опечатка в справкепз
Дублируются политики в выводе
gpresult некорректно показывает версию групповой политики
Package admx-basealt updated to version 0.6.0-alt1 for branch c10f2 in task 398434.
Closed bugs
Неправильно применяет параметр политики Режим работы для Хранитель экрана (MATE)
Политика отключения cifsacl не работает
Опечатка в описании политики "Служба Network Manager"
Предлагаю удалить политику "Шина системных сообщений D-Bus"
Опечатки в описании политик Gnome
Некорректная блокировка настройки контрастности в шаблоне групповых политик GNOME
Категория машинной и пользовательской политики "Меню специальных возможностей" в GNOME различаются
Пользовательские политики GNOME с заданным valueName в
Опечатки в описании политик LAPS
"Gnome" написано с помощью букв в нижнем регистре
Package java-21-openjdk updated to version 21.0.9.0.10-alt0.p10.1 for branch c10f2 in task 398821.
Closed vulnerabilities
BDU:2025-13795
Уязвимость компонента JAXP программных платформ Java SE, GraalVM for JDK, GraalVM Enterprise Edition, позволяющая нарушителю получить несанкционированный доступ к данным платформы
BDU:2025-14035
Уязвимость компонента Security виртуальных машин Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK и программной платформы Oracle Java SE, связанная с недостатками контроля доступа, позволяющая нарушителю получить доступ на чтение, изменение и удаление данных
BDU:2025-14036
Уязвимость компонента Libraries виртуальных машин Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK и программной платформы Oracle Java SE, позволяющая нарушителю оказать воздействие на целостность данных
Modified: 2025-11-03
CVE-2025-53057
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Modified: 2025-11-03
CVE-2025-53066
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Modified: 2025-10-28
CVE-2025-61748
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Closed bugs
/usr/share/zoneinfo/tzdata.zi
tzdata: -> 2024a
Package make-initrd updated to version 2.31.0-alt8 for branch c10f2 in task 399631.
Closed vulnerabilities
No data currently available.
Package postgresql16-1C updated to version 16.11-alt0.c10f2.1 for branch c10f2 in task 399906.
Closed vulnerabilities
Modified: 2025-11-14
CVE-2025-12817
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Modified: 2025-11-14
CVE-2025-12818
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Package postgresql13 updated to version 13.23-alt0.c10f2.1 for branch c10f2 in task 399906.
Closed vulnerabilities
Modified: 2025-11-14
CVE-2025-12817
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Modified: 2025-11-14
CVE-2025-12818
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Package postgresql16 updated to version 16.11-alt0.c10f2.1 for branch c10f2 in task 399906.
Closed vulnerabilities
Modified: 2025-11-14
CVE-2025-12817
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Modified: 2025-11-14
CVE-2025-12818
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Package postgresql15 updated to version 15.15-alt0.c10f2.1 for branch c10f2 in task 399906.
Closed vulnerabilities
Modified: 2025-11-14
CVE-2025-12817
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Modified: 2025-11-14
CVE-2025-12818
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Package postgresql14 updated to version 14.20-alt0.c10f2.1 for branch c10f2 in task 399906.
Closed vulnerabilities
Modified: 2025-11-14
CVE-2025-12817
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Modified: 2025-11-14
CVE-2025-12818
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Package local-policy updated to version 0.6.3-alt1 for branch c10f2 in task 398434.
Closed bugs
Излишний вывод в control
Package diag-domain-client updated to version 0.5-alt2 for branch c10f2 in task 398434.
Closed bugs
diag-domain-client: check_domain_controllers: ldapsearch: unrecognized option -h