[cyber] I: p10/branch packages: +5 (19058)
QA Team Robot
qa на altlinux.org
Чт Июл 3 03:22:36 MSK 2025
5 UPDATED packages
ffmpeg-plugin-browser - FFmpeg built specifically for codec support in special browser [11M]
* Thu Mar 06 2025 Sergey V Turchin <zerg на altlinux> 132-alt1
- new version
* Tue Feb 18 2025 Sergey V Turchin <zerg на altlinux> 130-alt2
- fix to build on old branches
* Fri Feb 14 2025 Sergey V Turchin <zerg на altlinux> 130-alt1
- new version
* Thu Dec 26 2024 Sergey V Turchin <zerg на altlinux> 128-alt1
- new version
* Fri Nov 15 2024 Sergey V Turchin <zerg на altlinux> 126-alt2
gimp - The GNU Image Manipulation Program [76M]
* Fri Feb 07 2025 Valery Inozemtsev <shrek на altlinux> 2.10.38-alt2
- upstream: plug-ins: Backport of fixes for gcc-14
* Wed May 08 2024 Valery Inozemtsev <shrek на altlinux> 2.10.38-alt1
- 2.10.38
* Tue Dec 26 2023 Valery Inozemtsev <shrek на altlinux> 2.10.36-alt2
- sets the browser used by the help system
* Thu Nov 09 2023 Valery Inozemtsev <shrek на altlinux> 2.10.36-alt1
- 2.10.36
* Mon Mar 06 2023 Valery Inozemtsev <shrek на altlinux> 2.10.34-alt1
- 2.10.34
* Wed Jun 15 2022 Valery Inozemtsev <shrek на altlinux> 2.10.32-alt1
- 2.10.32
* Fri Dec 24 2021 Valery Inozemtsev <shrek на altlinux> 2.10.30-alt1
libgegl - A graph based image processing framework [25M]
* Fri Jun 20 2025 Valery Inozemtsev <shrek на altlinux> 0.4.38-alt1
- 0.4.38
* Tue Dec 27 2022 Egor Ignatov <egori на altlinux> 0.4.34-alt2
sudo - Allows command execution as another user
* Tue Jul 01 2025 Evgeny Sinelnikov <sin на altlinux> 1:1.9.16p2-alt3
- Security release (fixes: CVE-2025-32462, CVE-2025-32463) (closes: 55007):
+ Sudo's -h (--host) option could be specified when running a command or
editing a file. This could enable a local privilege escalation attack if the
sudoers file allows the user to run commands on a different host.
For more information, see Local Privilege Escalation via host option:
https://www.sudo.ws/security/advisories/host_any/
+ An attacker can leverage sudo's -R (--chroot) option to run arbitrary
commands as root, even if they are not listed in the sudoers file. The chroot
support has been deprecated an will be removed entirely in a future release.
For more information, see Local Privilege Escalation via chroot option:
https://www.sudo.ws/security/advisories/chroot_bug/
* Tue Apr 15 2025 Evgeny Sinelnikov <sin на altlinux> 1:1.9.16p2-alt2
- Fixed segmentation fault in pty_cleanup() under low memory
conditions (closes: 53841).
* Fri Dec 27 2024 Evgeny Sinelnikov <sin на altlinux> 1:1.9.16p2-alt1
- Update to latest stable bugfix release:
+ Sudo now passes the terminal device number to the policy plugin even if it
cannot resolve it to a path name (GitHub#421).
+ On Linux systems, sudo will now attempt to use the symbolic links in
/proc/self/fd/{0,1,2} when resolving the terminal device number.
+ Fixed the date used by the exit record in sudo-format log files.
This was a regression introduced in sudo 1.9.16 and only affected
file-based logs, not syslog (GitHub#405).
+ When a duplicate alias is found in the sudoers file, the warning message now
includes the file and line number of the previous definition.
+ Sudo no longer sends mail when a user runs "sudo -nv" or "sudo -nl", even
if "mail_badpass" or "mail_always" are set.
* Fri Oct 25 2024 Evgeny Sinelnikov <sin на altlinux> 1:1.9.16-alt1
- Update to latest stable release:
+ Added the cmddenial_message sudoers option to provide additional information
to the user when a command is denied by the sudoers policy.
The default message is still displayed.
+ The time stamp used for file-based logs is now more consistent with the time
stamp produced by syslog (GitHub#327).
+ Sudo will now warn the user if it can detect the user's terminal but cannot
determine the path to the terminal device. The sudoers time stamp file will
now use the terminal device number directly (GitHub #329).
+ Added a json_compact value for the sudoers log_format option which can be
used when logging to a file (GitHub#357).
+ new pam_silent sudoers option has been added which may be negated to avoid
suppressing output from PAM authentication modules (GitHub#216).
+ Fixed several cvtsudoers JSON output problems (GitHub#369, GitHub#370,
GitHub#371, GitHub#373, GitHub#381).
+ When sudo runs a command in a pseudo-terminal and the user's terminal is
revoked, the pseudo-terminal's foreground process group will now receive
SIGHUP before the terminal is revoked. This emulates the behavior of the
session leader exiting and is consistent with what happens when, for example,
an ssh session is closed (GitHub#367).
+ Paths specified via a Chdir_Spec or Chroot_Spec in sudoers may now be
double-quoted.
+ The default sudoers file now enables the secure_path option by default
and preserves the EDITOR, VISUAL, and SUDO_EDITOR environment variables
when running visudo (GitHub#387).
* Thu Jan 04 2024 Evgeny Sinelnikov <sin на altlinux> 1:1.9.15p5-alt1
- Update to latest stable bugfix release:
+ Fixed evaluation of the "lecture", "listpw", "verifypw", and "fdexec"
sudoers Defaults settings when used without an explicit value.
+ Sudo will now transparently rename a user's lecture file from
the older name-based path to the newer user-ID-based path.
+ Memory allocation failure if sysconf(_SC_LOGIN_NAME_MAX) fails.
* Sat Dec 23 2023 Evgeny Sinelnikov <sin на altlinux> 1:1.9.15p4-alt1
- Update to stable release with fixing regression to change in sudo 1.9.15.
+ Bug that could prevent a user's privileges from being listed by "sudo -l"
if the sudoers entry in /etc/nsswitch.conf contains "[SUCCESS=return]".
* Thu Dec 14 2023 Evgeny Sinelnikov <sin на altlinux> 1:1.9.15p3-alt1
- Update to stable release with fixing regressions to changes in sudo 1.9.15.
* Thu Nov 23 2023 Evgeny Sinelnikov <sin на altlinux> 1:1.9.15p2-alt1
- Update to latest stable bugfix release.
* Wed Nov 08 2023 Evgeny Sinelnikov <sin на altlinux> 1:1.9.15p1-alt1
yandex-browser-stable - Yandex Browser [269M]
* Tue Apr 22 2025 yabro <yabro на altlinux> 25.2.4.1000-alt1
- Browser updated to 25.2.4.1000
+ High CVE-2025-2783: Incorrect handle provided in unspecified circumstances in Mojo on Windows
+ High CVE-2025-24201: Out of bounds write in GPU on Mac
* Thu Mar 06 2025 yabro <yabro на altlinux> 25.2.1.931-alt1
- Fixed Tab crushes bug (closes: 53162)
- Browser updated to 25.2.1.931
+ High CVE-2025-0998: Out of bounds memory access in V8
+ High CVE-2025-0997: Use after free in Navigation
+ High CVE-2025-0996: Inappropriate implementation in Browser UI
+ High CVE-2025-0995: Use after free in V8
+ High CVE-2025-0434: Out of bounds memory access in V8
+ High CVE-2025-0435: Inappropriate implementation in Navigation
+ High CVE-2025-0436: Integer overflow in Skia
+ High CVE-2025-0437: Out of bounds read in Metrics
+ High CVE-2025-0438: Stack buffer overflow in Tracing
+ High CVE-2025-0611: Object corruption in V8
+ High CVE-2025-0612: Out of bounds memory access in V8
+ Medium CVE-2025-0439: Race in Frames
+ Medium CVE-2025-0440: Inappropriate implementation in Fullscreen
+ Medium CVE-2025-0441: Inappropriate implementation in Fenced Frames
+ Medium CVE-2025-0442: Inappropriate implementation in Payments
+ Medium CVE-2025-0443: Insufficient data validation in Extensions
+ Medium CVE-2025-0762: Use after free in DevTools
+ Low CVE-2025-0446: Inappropriate implementation in Extensions
+ Low CVE-2025-0447: Inappropriate implementation in Navigation
+ Low CVE-2025-0448: Inappropriate implementation in Compositing
* Thu Feb 13 2025 yabro <yabro на altlinux> 24.12.4.1097-alt1
- Browser updated to 24.12.4.1097
+ Critical CVE-2024-10487: Out of bounds write in Dawn
+ High CVE-2024-10488: Use after free in WebRTC
+ High CVE-2024-12694: Use after free in Compositing
+ High CVE-2025-0291: Type Confusion in V8
+ High CVE-2024-10826: Use after free in Family Experiences
+ High CVE-2024-10827: Use after free in Serial
+ Medium CVE-2025-0762: Use after free in DevTools
* Fri Dec 27 2024 yabro <yabro на altlinux> 24.10.4.845-alt1
- Browser updated to 24.10.4.845
- Fixed local ffmpeg bug
* Tue Dec 17 2024 yabro <yabro на altlinux> 24.10.4.818-alt1
- Browser updated to 24.10.4.818
+ Critical CVE-2024-10487: Out of bounds write in Dawn
+ High CVE-2024-10229: Inappropriate implementation in Extensions
+ High CVE-2024-10488: Use after free in WebRTC
+ High CVE-2024-8636: Heap buffer overflow in Skia
+ High CVE-2024-8637: Use after free in Media Router
+ High CVE-2024-8638: Type Confusion in V8
+ High CVE-2024-8639: Use after free in Autofill
+ High CVE-2024-8362: Use after free in WebAudio
+ High CVE-2024-8193: Heap buffer overflow in Skia
+ High CVE-2024-8194: Type Confusion in V8
+ High CVE-2024-8198: Heap buffer overflow in Skia
+ High CVE-2024-7969: Type Confusion in V8
+ High CVE-2024-7964: Use after free in Passwords
+ High CVE-2024-7965: Inappropriate implementation in V8
+ High CVE-2024-7966: Out of bounds memory access in Skia
+ High CVE-2024-7967: Heap buffer overflow in Fonts
+ High CVE-2024-7968: Use after free in Autofill
+ High CVE-2024-7971: Type confusion in V8
+ High CVE-2024-7970: Out of bounds write in V8
+ Medium CVE-2024-7972: Inappropriate implementation in V8
+ Medium CVE-2024-7973: Heap buffer overflow in PDFium
+ Medium CVE-2024-7974: Insufficient data validation in V8 API
+ Medium CVE-2024-7975: Inappropriate implementation in Permissions
+ Medium CVE-2024-7976: Inappropriate implementation in FedCM
+ Medium CVE-2024-7977: Insufficient data validation in Installer
+ Medium CVE-2024-7978: Insufficient policy enforcement in Data Transfer
+ Medium CVE-2024-7979: Insufficient data validation in Installer
+ Medium CVE-2024-7980: Insufficient data validation in Installer
+ Low CVE-2024-7981: Inappropriate implementation in Views
+ Low CVE-2024-8033: Inappropriate implementation in WebApp Installs
+ Low CVE-2024-8034: Inappropriate implementation in Custom Tabs
+ Low CVE-2024-8035: Inappropriate implementation in Extensions
* Tue Oct 22 2024 yabro <yabro на altlinux> 24.7.6.1018-alt1
Total 19058 source packages.
Подробная информация о списке рассылки Sisyphus-cybertalk