ALT-BU-2025-14890-1
Branch p11 update bulletin.
Package u-boot-rockchip updated to version 2025.10-alt1 for branch p11 in task 397455.
Closed bugs
Поддержка Powkiddy x35s
Package xkeyboard-config updated to version 2.45-alt3 for branch p11 in task 397499.
Closed bugs
xkeyboard-config: new version
Ошибки обновлении с версии xkeyboard-config-1:2.42-alt1 до xkeyboard-config-1:2.45-alt2
Package firefox-esr updated to version 140.5.0-alt1 for branch p11 in task 400131.
Closed vulnerabilities
Modified: 2025-11-19
CVE-2025-13012
Race condition in the Graphics component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1991458
- https://www.mozilla.org/security/advisories/mfsa2025-87/
- https://www.mozilla.org/security/advisories/mfsa2025-88/
- https://www.mozilla.org/security/advisories/mfsa2025-89/
- https://www.mozilla.org/security/advisories/mfsa2025-90/
- https://www.mozilla.org/security/advisories/mfsa2025-91/
Modified: 2025-11-19
CVE-2025-13013
Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1991945
- https://www.mozilla.org/security/advisories/mfsa2025-87/
- https://www.mozilla.org/security/advisories/mfsa2025-88/
- https://www.mozilla.org/security/advisories/mfsa2025-89/
- https://www.mozilla.org/security/advisories/mfsa2025-90/
- https://www.mozilla.org/security/advisories/mfsa2025-91/
Modified: 2025-11-19
CVE-2025-13014
Use-after-free in the Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1994241
- https://www.mozilla.org/security/advisories/mfsa2025-87/
- https://www.mozilla.org/security/advisories/mfsa2025-88/
- https://www.mozilla.org/security/advisories/mfsa2025-89/
- https://www.mozilla.org/security/advisories/mfsa2025-90/
- https://www.mozilla.org/security/advisories/mfsa2025-91/
Modified: 2025-11-19
CVE-2025-13015
Spoofing issue in Firefox. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Firefox ESR < 115.30, Thunderbird < 145, and Thunderbird < 140.5.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1994164
- https://www.mozilla.org/security/advisories/mfsa2025-87/
- https://www.mozilla.org/security/advisories/mfsa2025-88/
- https://www.mozilla.org/security/advisories/mfsa2025-89/
- https://www.mozilla.org/security/advisories/mfsa2025-90/
- https://www.mozilla.org/security/advisories/mfsa2025-91/
Modified: 2025-11-25
CVE-2025-13016
Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.
Modified: 2025-11-19
CVE-2025-13017
Same-origin policy bypass in the DOM: Notifications component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.
Modified: 2025-11-19
CVE-2025-13018
Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.
Modified: 2025-11-19
CVE-2025-13019
Same-origin policy bypass in the DOM: Workers component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.
Modified: 2025-11-19
CVE-2025-13020
Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 145, Firefox ESR < 140.5, Thunderbird < 145, and Thunderbird < 140.5.
Closed bugs
Не предоставляет x-www-browser
Closed bugs
Сбой программы Kleopatra после действия "Заверить"
Нельзя установить значение 0 для атрибута lockoutTime
Кнопка ОК доступна, если в поле "Имя для входа (до Windows 2000)" установлен пробел (окна создания объектов)
Опечатка в вопросе в окне подтверждения сброса учетной записи
Опечатка в окне ошибки при добавлении телефонных номеров
Нельзя изменить параметры на вкладке Безопасность без помощи мыши
Диалоговые окна при старте не являются модальными
В ADMC нет индикации отключенных компьютеров
Package open-vm-tools updated to version 13.0.5-alt1 for branch p11 in task 400436.
Closed vulnerabilities
Modified: 2025-11-26
BDU:2025-05681
Уязвимость набора утилит VMware Tools, связанная с неверным определением ссылки перед доступом к файлу, позволяющая нарушителю повысить свои привилегии
Modified: 2025-12-26
BDU:2025-12421
Уязвимость функции Service Discovery Management Pack (SDMP) инструмента мониторинга виртуальной инфраструктуры VMware Aria Operations и набора утилит VMware Tools, позволяющая нарушителю повысить свои привилегии до уровня root
Modified: 2025-11-18
CVE-2025-22247
VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM.
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25683
- http://www.openwall.com/lists/oss-security/2025/05/12/2
- http://www.openwall.com/lists/oss-security/2025/05/13/2
- http://www.openwall.com/lists/oss-security/2025/09/24/3
- http://www.openwall.com/lists/oss-security/2025/09/25/3
- http://www.openwall.com/lists/oss-security/2025/09/25/5
- http://www.openwall.com/lists/oss-security/2025/09/26/1
- https://lists.debian.org/debian-lts-announce/2025/05/msg00017.html
Modified: 2025-11-06
CVE-2025-41244
VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM.
- http://support.broadcom.com/group/ecx/support-content-view/-/support-content/Security%20Advisories/VMSA-2025-0015--VMware-Aria-Operations-and-VMware-Tools-updates-address-multiple-vulnerabilities--CVE-2025-41244-CVE-2025-41245--CVE-2025-41246-/36149
- http://www.openwall.com/lists/oss-security/2025/09/29/10
- https://lists.debian.org/debian-lts-announce/2025/10/msg00000.html
- https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/
- https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36149
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-41244
Package alt-mirror-switcher updated to version 0.4.4-alt1 for branch p11 in task 400380.
Closed bugs
Добавляется не верный репозиторий, если система была обновлена p11 -> Sisyphus
Package gnome-software updated to version 49.1-alt1 for branch p11 in task 400490.
Closed bugs
gnome-software: Убрать зависимость на fwupd
Package token-manager updated to version 5.3-alt1 for branch p11 in task 400513.
Closed vulnerabilities
No data currently available.
Closed vulnerabilities
Modified: 2025-10-16
CVE-2025-51495
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow.
Closed vulnerabilities
Modified: 2024-03-21
BDU:2023-05361
Уязвимость Java-библиотеки анализа, извлечения и управления данными в документах HTML jsoup, связанная с недостатками в обработке исключительных состояний, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2021-37714
jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
- https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c
- https://jsoup.org/news/release-1.14.1
- https://jsoup.org/news/release-1.14.2
- https://lists.apache.org/thread.html/r215009dbf7467a9f6506d0c0024cb36cad30071010e62c9352cfaaf0%40%3Cissues.maven.apache.org%3E
- https://lists.apache.org/thread.html/r377b93d79817ce649e9e68b3456e6f499747ef1643fa987b342e082e%40%3Cissues.maven.apache.org%3E
- https://lists.apache.org/thread.html/r3d71f18adb78e50f626dde689161ca63d3b7491bd9718fcddfaecba7%40%3Cissues.maven.apache.org%3E
- https://lists.apache.org/thread.html/r50e9c9466c592ca9d707a5dea549524d19e3287da08d8392f643960e%40%3Cissues.maven.apache.org%3E
- https://lists.apache.org/thread.html/r685c5235235ad0c26e86d0ee987fb802c9675de6081dbf0516464e0b%40%3Cnotifications.james.apache.org%3E
- https://lists.apache.org/thread.html/r97404676a5cf591988faedb887d64e278f522adcaa823d89ca69defe%40%3Cnotifications.james.apache.org%3E
- https://lists.apache.org/thread.html/rc3354080fc67fb50b45b3c2d12dc4ca2a3c1c78dad3d3ba012c038aa%40%3Cnotifications.james.apache.org%3E
- https://security.netapp.com/advisory/ntap-20220210-0022/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c
- https://jsoup.org/news/release-1.14.1
- https://jsoup.org/news/release-1.14.2
- https://lists.apache.org/thread.html/r215009dbf7467a9f6506d0c0024cb36cad30071010e62c9352cfaaf0%40%3Cissues.maven.apache.org%3E
- https://lists.apache.org/thread.html/r377b93d79817ce649e9e68b3456e6f499747ef1643fa987b342e082e%40%3Cissues.maven.apache.org%3E
- https://lists.apache.org/thread.html/r3d71f18adb78e50f626dde689161ca63d3b7491bd9718fcddfaecba7%40%3Cissues.maven.apache.org%3E
- https://lists.apache.org/thread.html/r50e9c9466c592ca9d707a5dea549524d19e3287da08d8392f643960e%40%3Cissues.maven.apache.org%3E
- https://lists.apache.org/thread.html/r685c5235235ad0c26e86d0ee987fb802c9675de6081dbf0516464e0b%40%3Cnotifications.james.apache.org%3E
- https://lists.apache.org/thread.html/r97404676a5cf591988faedb887d64e278f522adcaa823d89ca69defe%40%3Cnotifications.james.apache.org%3E
- https://lists.apache.org/thread.html/rc3354080fc67fb50b45b3c2d12dc4ca2a3c1c78dad3d3ba012c038aa%40%3Cnotifications.james.apache.org%3E
- https://security.netapp.com/advisory/ntap-20220210-0022/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html