ALT-BU-2025-15090-1
Branch sisyphus_riscv64 update bulletin.
Package candle updated to version 10.11.1-alt2 for branch sisyphus_riscv64.
Closed bugs
Ошибка работы окон открытия файла и выбора цвета визуализатора
Зависание после попытки открыть существующий файл или при попытке изменить цвет визуализатора
Package libmatio updated to version 1.5.29-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2022-01836
Уязвимость функции ReadInt32DataDouble библиотеки для чтения и записи файлов MATLAB MATIO, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2019-13107
Multiple integer overflows exist in MATIO before 1.5.16, related to mat.c, mat4.c, mat5.c, mat73.c, and matvar_struct.c
- https://github.com/tbeu/matio/compare/f8cd397...fabac6c
- https://github.com/tbeu/matio/pull/118
- https://github.com/tbeu/matio/releases/tag/v1.5.16
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7AE25FWDBPC7KLVMPLHT4G64O4GISQQ/
- https://github.com/tbeu/matio/compare/f8cd397...fabac6c
- https://github.com/tbeu/matio/pull/118
- https://github.com/tbeu/matio/releases/tag/v1.5.16
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7AE25FWDBPC7KLVMPLHT4G64O4GISQQ/
Modified: 2024-11-21
CVE-2020-36428
matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4).
Modified: 2024-11-21
CVE-2022-1515
A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This issue can potentially result in DoS.
Modified: 2025-08-26
CVE-2025-2337
A vulnerability, which was classified as critical, has been found in tbeu matio 1.5.28. This issue affects the function Mat_VarPrint of the file src/mat.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Modified: 2025-08-27
CVE-2025-2338
A vulnerability, which was classified as critical, was found in tbeu matio 1.5.28. Affected is the function strdup_vprintf of the file src/io.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Package java-17-openjdk updated to version 17.0.17.0.10-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-12-03
BDU:2025-13795
Уязвимость компонента JAXP программных платформ Java SE, GraalVM for JDK, GraalVM Enterprise Edition, позволяющая нарушителю получить несанкционированный доступ к данным платформы
Modified: 2025-12-03
BDU:2025-14035
Уязвимость компонента Security виртуальных машин Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK и программной платформы Oracle Java SE, связанная с недостатками контроля доступа, позволяющая нарушителю получить доступ на чтение, изменение и удаление данных
Modified: 2025-11-03
CVE-2025-53057
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Modified: 2025-11-03
CVE-2025-53066
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Package dqt6-tools updated to version 6.9.3-alt0.dde.1 for branch sisyphus_riscv64.
Closed bugs
Верните qdoc для Qt6
Package mkimage-profiles updated to version 1.8.8-alt1 for branch sisyphus_riscv64.
Closed bugs
Добавить firmware-nouveau
Package apt-gpgkeys-pki updated to version 0.2-alt1 for branch sisyphus_riscv64.
Closed bugs
Команда list показывает доступные, а не импортированные ключи
Filetrigger не является исполняемым файлом и поэтому не запускается
Package empty updated to version 0.6.23d-alt2 for branch sisyphus_riscv64.
Closed bugs
"empty" should require /dev/pts to work in hasher; like dejagnu does