Branch sisyphus update bulletin.

Package kernel-image-un-def updated to version 3.11.7-alt1 for branch sisyphus in task 107830.

Published: 2013-10-24

BDU:2014-00091

Уязвимость операционной системы Linux, позволяющая злоумышленнику получить доступ к конфиденциальной информации из памяти ядра

Severity: MEDIUM (6.0)

References:

CVE-2013-4299

Published: 2013-01-22

BDU:2015-04307

Уязвимости операционной системы SUSE Linux Enterprise, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04308

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04309

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04310

Severity: CRITICAL (10.0)

References:

Published: 2013-11-04
Modified: 2024-11-21

CVE-2013-2058

The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming option, which allows local users to cause a denial of service (system crash) by sending a large amount of network traffic through a USB/Ethernet adapter.

Severity: MEDIUM (4.7)

References:

Published: 2013-10-24
Modified: 2024-11-21

CVE-2013-4299

Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.

Severity: MEDIUM (6.0)

References:

Published: 2013-12-09
Modified: 2024-11-21

CVE-2013-7027

The ieee80211_radiotap_iterator_init function in net/wireless/radiotap.c in the Linux kernel before 3.11.7 does not check whether a frame contains any data outside of the header, which might allow attackers to cause a denial of service (buffer over-read) via a crafted header.

Severity: MEDIUM (6.1)

References:

Published: 2019-04-23
Modified: 2024-11-21

CVE-2013-7470

cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.

Severity: MEDIUM (5.9) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Published: 2014-01-19
Modified: 2024-11-21

CVE-2014-1444

The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.

Severity: LOW (1.7)

References:

Published: 2014-01-19
Modified: 2024-11-21

CVE-2014-1445

The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call.

Severity: LOW (2.1)

References:

Package ghostscript updated to version 9.10-alt1 for branch sisyphus in task 107865.

Published: 2018-12-03
Modified: 2024-11-21

CVE-2018-16863

It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass the -dSAFER protection to, for example, execute arbitrary shell commands via a specially crafted PostScript document. This only affects ghostscript 9.07 as shipped with Red Hat Enterprise Linux 7.

Severity: HIGH (7.8) Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Package xulrunner updated to version 25.0-alt1 for branch sisyphus in task 107842.

No data currently available.

Package firefox updated to version 25.0-alt1 for branch sisyphus in task 107842.

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5590

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5591

Unspecified vulnerability in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5592

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5593

The SELECT element implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly restrict the nature or placement of HTML within a dropdown menu, which allows remote attackers to spoof the address bar or conduct clickjacking attacks via vectors that trigger navigation off of a page containing this element.

Severity: MEDIUM (4.3)

References:

Published: 2020-02-18
Modified: 2024-11-21

CVE-2013-5594

Mozilla Firefox before 25 allows modification of anonymous content of pluginProblem.xml binding

Severity: MEDIUM (4.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5595

The JavaScript engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly allocate memory for unspecified functions, which allows remote attackers to conduct buffer overflow attacks via a crafted web page.

Severity: MEDIUM (4.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5596

The cycle collection (CC) implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly determine the thread for release of an image object, which allows remote attackers to execute arbitrary code or cause a denial of service (race condition and application crash) via a large HTML document containing IMG elements, as demonstrated by the Never-Ending Reddit on reddit.com.

Severity: MEDIUM (6.8)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5597

Use-after-free vulnerability in the nsDocLoader::doStopDocumentLoad function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving a state-change event during an update of the offline cache.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5598

PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object.

Severity: HIGH (8.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5599

Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5600

Use-after-free vulnerability in the nsIOService::NewChannelFromURIWithProxyFlags function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors involving a blob: URL.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5601

Use-after-free vulnerability in the nsEventListenerManager::SetEventHandler function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors related to a memory allocation through the garbage collection (GC) API.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5602

The Worker::SetEventListener function in the Web workers implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to direct proxies.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5603

Use-after-free vulnerability in the nsContentUtils::ContentIsHostIncludingDescendantOf function in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving HTML document templates.

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5604

The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via crafted documents.

Severity: CRITICAL (9.3)

References:

No data currently available.

Package thunderbird updated to version 24.1.0-alt1 for branch sisyphus in task 107842.

Published: 2014-09-03

BDU:2015-00443

Уязвимость браузера Firefox, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: CRITICAL (9.3)

References:

CVE-2014-1567

Published: 2014-09-03

BDU:2015-00447

Severity: CRITICAL (10.0)

References:

CVE-2014-1562

Published: 2014-09-03

BDU:2015-00467

Уязвимость программного обеспечения Firefox ESR, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: CRITICAL (9.3)

References:

Published: 2014-09-03

BDU:2015-00470

Severity: CRITICAL (10.0)

References:

Published: 2014-09-03

BDU:2015-00706

Уязвимость программного обеспечения Thunderbird, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: CRITICAL (10.0)

References:

Published: 2014-09-03

BDU:2015-00714

Severity: CRITICAL (9.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5590

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5591

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5593

Severity: MEDIUM (4.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5595

Severity: MEDIUM (4.3)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5596

Severity: MEDIUM (6.8)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5597

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5599

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5600

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5601

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5602

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5603

Severity: CRITICAL (10.0)

References:

Published: 2013-10-30
Modified: 2024-11-21

CVE-2013-5604

Severity: CRITICAL (9.3)

References:

Published: 2014-09-03
Modified: 2024-11-21

CVE-2014-1562

Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity: CRITICAL (10.0)

References:

Published: 2014-09-03
Modified: 2024-11-21

CVE-2014-1567

Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.

Severity: CRITICAL (9.3)

References:

No data currently available.

Version: 2.1.1

ALT-BU-2013-1341-1

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities