ALT-BU-2025-15382-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2025-12-27
CVE-2025-12819
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
Closed vulnerabilities
Modified: 2025-12-16
CVE-2025-66293
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the png_sRGB_base[512] array when processing valid palette PNG images with partial transparency and gamma correction. The PNG files that trigger this vulnerability are valid per the PNG specification; the bug is in libpng's internal state management. Upgrade to libpng 1.6.52 or later.
- https://github.com/pnggroup/libpng/commit/788a624d7387a758ffd5c7ab010f1870dea753a1
- https://github.com/pnggroup/libpng/commit/a05a48b756de63e3234ea6b3b938b8f5f862484a
- https://github.com/pnggroup/libpng/issues/764
- https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f
- http://www.openwall.com/lists/oss-security/2025/12/03/6
- http://www.openwall.com/lists/oss-security/2025/12/03/7
- http://www.openwall.com/lists/oss-security/2025/12/03/8
- https://github.com/pnggroup/libpng/issues/764
Closed bugs
broken pc-files
Package libwebkitgtk6.0 updated to version 2.50.3-alt1 for branch sisyphus in task 391238.
Closed vulnerabilities
Modified: 2025-11-20
CVE-2025-43342
A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26, iOS 18.7 and iPadOS 18.7. Processing maliciously crafted web content may lead to an unexpected process crash.
- https://support.apple.com/en-us/125108
- https://support.apple.com/en-us/125109
- https://support.apple.com/en-us/125113
- https://support.apple.com/en-us/125114
- https://support.apple.com/en-us/125115
- https://support.apple.com/en-us/125116
- http://seclists.org/fulldisclosure/2025/Sep/49
- http://seclists.org/fulldisclosure/2025/Sep/53
- http://seclists.org/fulldisclosure/2025/Sep/57
- http://seclists.org/fulldisclosure/2025/Sep/59
- http://www.openwall.com/lists/oss-security/2025/09/22/3
Modified: 2025-12-17
CVE-2025-43343
The issue was addressed with improved memory handling. This issue is fixed in Safari 26, tvOS 26, watchOS 26, iOS 26 and iPadOS 26, visionOS 26. Processing maliciously crafted web content may lead to an unexpected process crash.
- https://support.apple.com/en-us/125108
- https://support.apple.com/en-us/125113
- https://support.apple.com/en-us/125114
- https://support.apple.com/en-us/125115
- https://support.apple.com/en-us/125116
- http://seclists.org/fulldisclosure/2025/Sep/49
- http://seclists.org/fulldisclosure/2025/Sep/53
- http://seclists.org/fulldisclosure/2025/Sep/57
- http://seclists.org/fulldisclosure/2025/Sep/59
- http://www.openwall.com/lists/oss-security/2025/10/13/4
- https://access.redhat.com/errata/RHSA-2025:19946
- https://security-tracker.debian.org/tracker/CVE-2025-43343
- https://ubuntu.com/security/CVE-2025-43343
- https://webkitgtk.org/security/WSA-2025-0007.html
Package checksumgen updated to version 0.4.2-alt1.1 for branch sisyphus in task 401813.
Closed vulnerabilities
No data currently available.