ALT-BU-2025-8689-1
Branch sisyphus_riscv64 update bulletin.
Package linstor updated to version 1.31.1-alt0.port for branch sisyphus_riscv64.
Closed bugs
Не работает с Java 17 (java.lang.NoClassDefFoundError: jdk/nashorn/api/scripting/ClassFilter)
Ошибка 'JAVA_HOME is not set' при установке пакета linstor-controller
Ошибка 'JAVA_HOME is not set' при установке пакета linstor-controller
Package itop updated to version 3.2.1.1-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-08-01
CVE-2024-52601
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can have read access to objects they're not allowed to see by querying an unprotected route. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.
Modified: 2025-08-01
CVE-2024-56157
iTop is an web based IT Service Management tool. Prior to versions 3.1.3 and 3.2.1, by filling malicious code in a CSV content, a cross-site scripting attack can be performed when importing this content. The issue is fixed in versions 3.1.3 and 3.2.1. As a workaround, check CSV content before importing it.
Modified: 2025-08-22
CVE-2025-24021
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, anyone with an account having portal access can set value to object fields when they're not supposed to. Versions 2.7.12, 3.1.3, and 3.2.1 contain a fix for the issue.
Modified: 2025-08-01
CVE-2025-24022
iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1.
Modified: 2025-08-01
CVE-2025-24026
iTop is an web based IT Service Management tool. Versions prior to 3.2.1 are vulnerable to regular expression denial of service (ReDoS) that may, under some circumstances, affect iTop server. Version 3.2.1 doesn't use the affected variable in the regular expression. As a workaround, if iTop app_root_url is defined in the configuration file, then there is no possible way to exploit this ReDoS.
Package arm-none-eabi-binutils updated to version 2.44-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2025-03384
Уязвимость компонента objdump.c программного средства разработки GNU Binutils, позволяющая нарушителю выполнить произвольный код
Modified: 2025-03-04
CVE-2025-0840
A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.
- https://sourceware.org/bugzilla/attachment.cgi?id=15882
- https://sourceware.org/bugzilla/show_bug.cgi?id=32560
- https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893
- https://vuldb.com/?ctiid.293997
- https://vuldb.com/?id.293997
- https://vuldb.com/?submit.485255
- https://www.gnu.org/
Package greetd-regreet updated to version 0.2.0-alt4 for branch sisyphus_riscv64.
Closed bugs
Отсутсвуют необходимые директории или не хватает прав для кэширования и логирования.