From: Henrik.Carlqvist@deadspam.com   
      
   On Fri, 23 May 2025 16:56:29 +0200, Thomas Zajic wrote:   
   > Just be patient, the update for 15.0 will come eventually (I'm also   
   > running 15.0 multilib).   
      
   And until then, be careful about CVE-2025-4802 which basically means   
   don't set the setuid bit on any statically linked 32-bit binary which   
   calls dlopen for some kind of plug-in functionality.   
      
   This is kind of a teoretical vulnerability. Not many binaries are   
   installed with the setuid flag. Not many binaries are statically linked.   
   Some binaries call, but most don't call dlopen. And even on a multilib   
   system, most installed binaries are 64 bit. However, if you do happen to   
   have any such installed 32 bit binaries you will need to be careful with   
   local and remote users who can tamper with their LD_LIBRARY_PATH variable   
   before running that binary.   
      
   regards Henrik   
      
   --- SoupGate-DOS v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)