ALT-BU-2025-8822-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-23901
A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.
Package winehelper updated to version 0.4.7-alt1 for branch sisyphus in task 388609.
Closed bugs
Во время установки CTM приложений поле "Comment" с кириллицей имеет не читаемые символы
Ошибка в приложении ВЭД-Платежи при запуске загрузка модуля comtls64.dll
Package amnezia-vpn updated to version 4.8.7.2-alt1 for branch sisyphus in task 388615.
Closed bugs
Не собирается с Qt 6.9
Package quick-usb-formatter updated to version 0.6-alt25 for branch sisyphus in task 388623.
Closed bugs
Не работает форматирование USB.
Closed bugs
Собрать с KF6
Closed bugs
z3.z3types.Z3Exception: libz3.so not found
Closed bugs
Некорректная работа драйвера донгла microsoft для беспроводных устройств XBox (пакет xone)
DKMS xone для ядра 6.15
Package librum-reader updated to version 0.12.2-alt4 for branch sisyphus in task 388655.
Closed bugs
После установки из репозитория приложение не запускается
Closed bugs
frrinit.sh: can't open logfile /var/log/frr/frr.log
Closed vulnerabilities
BDU:2025-07725
Уязвимость реализации протокола аутентификации OIDC сервера системы управления базами данных MongoDB, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-09-15
CVE-2025-6706
An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific combination of rarely-used aggregation pipeline expressions. This issue affects MongoDB Server v6.0 version prior to 6.0.21, MongoDB Server v7.0 version prior to 7.0.17 and MongoDB Server v8.0 version prior to 8.0.4 when the SBE engine is enabled.
Modified: 2025-09-15
CVE-2025-6707
Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.
Modified: 2025-09-15
CVE-2025-6709
The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.
Modified: 2025-09-15
CVE-2025-6710
MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which could occur pre-authorisation. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating.
Closed vulnerabilities
Modified: 2025-07-25
CVE-2025-32462
Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines.
- https://access.redhat.com/security/cve/cve-2025-32462
- https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32462
- https://explore.alas.aws.amazon.com/CVE-2025-32462.html
- https://lists.debian.org/debian-security-announce/2025/msg00118.html
- https://security-tracker.debian.org/tracker/CVE-2025-32462
- https://ubuntu.com/security/notices/USN-7604-1
- https://www.openwall.com/lists/oss-security/2025/06/30/2
- https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/
- https://www.stratascale.com/vulnerability-alert-CVE-2025-32462-sudo-host
- https://www.sudo.ws/releases/changelog/
- https://www.sudo.ws/security/advisories/
- https://www.sudo.ws/security/advisories/host_any/
- https://www.suse.com/security/cve/CVE-2025-32462.html
Modified: 2025-07-22
CVE-2025-32463
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
- https://access.redhat.com/security/cve/cve-2025-32463
- https://bugs.gentoo.org/show_bug.cgi?id=CVE-2025-32463
- https://explore.alas.aws.amazon.com/CVE-2025-32463.html
- https://security-tracker.debian.org/tracker/CVE-2025-32463
- https://ubuntu.com/security/notices/USN-7604-1
- https://www.openwall.com/lists/oss-security/2025/06/30/3
- https://www.secpod.com/blog/sudo-lpe-vulnerabilities-resolved-what-you-need-to-know-about-cve-2025-32462-and-cve-2025-32463/
- https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot
- https://www.sudo.ws/releases/changelog/
- https://www.sudo.ws/security/advisories/
- https://www.sudo.ws/security/advisories/chroot_bug/
- https://www.suse.com/security/cve/CVE-2025-32463.html
- https://www.suse.com/support/update/announcement/2025/suse-su-202502177-1/
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-detect-sudo-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2025-32463-mitigate-sudo-vulnerability
- https://iototsecnews.jp/2025/07/01/linux-sudo-chroot-vulnerability-enables-hackers-to-elevate-privileges-to-root/
Closed bugs
Closed vulnerabilities
Modified: 2025-07-16
CVE-2025-6554
Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High)