Branch t7 update bulletin.

Package kde4base-runtime updated to version 4.12.3-alt1.M70P.3 for branch t7 in task 117310.

Отсутствует kio_sftp

Package kernel-image-el-def updated to version 2.6.32-alt21 for branch t7 in task 117310.

Published: 2014-02-28

BDU:2014-00054

Уязвимость операционной системы Linux, позволяющая злоумышленнику вызвать отказ в обслуживании, повысить свои привилегии или выполнить произвольный код

Severity: MEDIUM (6.2)

References:

CVE-2014-0069

Published: 2014-03-26

BDU:2014-00061

Уязвимость операционной системы Linux, позволяющая злоумышленнику вызвать отказ в обслуживании

Severity: MEDIUM (5.5)

References:

CVE-2014-0055

Published: 2014-03-11

BDU:2014-00102

Уязвимость операционной системы Linux, позволяющая злоумышленнику вызвать отказ в обслуживании

Severity: HIGH (7.1)

References:

CVE-2014-0101

Published: 2013-01-22

BDU:2015-04307

Уязвимости операционной системы SUSE Linux Enterprise, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04308

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04309

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04310

Severity: CRITICAL (10.0)

References:

Published: 2013-03-22
Modified: 2024-11-21

CVE-2013-1860

Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device.

References:

Published: 2014-03-26
Modified: 2024-11-21

CVE-2014-0055

The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors.

Severity: MEDIUM (5.5)

References:

Published: 2014-02-28
Modified: 2024-11-21

CVE-2014-0069

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.

Severity: HIGH (7.2)

References:

Published: 2014-03-11
Modified: 2024-11-21

CVE-2014-0101

The sctp_sf_do_5_1D_ce function in net/sctp/sm_statefuns.c in the Linux kernel through 3.13.6 does not validate certain auth_enable and auth_capable fields before making an sctp_sf_authenticate call, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an SCTP handshake with a modified INIT chunk and a crafted AUTH chunk before a COOKIE_ECHO chunk.

Severity: HIGH (7.8)

References:

Published: 2014-03-24
Modified: 2024-11-21

CVE-2014-2523

net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function.

Severity: CRITICAL (10.0)

References:

Package kernel-image-std-def updated to version 3.10.34-alt1 for branch t7 in task 117310.

Published: 2014-03-11

BDU:2014-00102

Уязвимость операционной системы Linux, позволяющая злоумышленнику вызвать отказ в обслуживании

Severity: HIGH (7.1)

References:

CVE-2014-0101

Published: 2013-01-22

BDU:2015-04307

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04308

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04309

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04310

Severity: CRITICAL (10.0)

References:

Published: 2014-03-11
Modified: 2024-11-21

CVE-2014-0101

Severity: HIGH (7.8)

References:

Published: 2014-04-15
Modified: 2024-11-21

CVE-2014-2706

Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c.

Severity: HIGH (7.1)

References:

Package kernel-image-un-def updated to version 3.13.7-alt1 for branch t7 in task 117310.

Published: 2014-03-11

BDU:2014-00102

Уязвимость операционной системы Linux, позволяющая злоумышленнику вызвать отказ в обслуживании

Severity: HIGH (7.1)

References:

CVE-2014-0101

Published: 2013-01-22

BDU:2015-04307

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04308

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04309

Severity: CRITICAL (10.0)

References:

Published: 1970-01-01

BDU:2015-04310

Severity: CRITICAL (10.0)

References:

Published: 2014-03-11

BDU:2015-05685

Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05686

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05687

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05688

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05689

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05690

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05691

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05692

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05693

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05694

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05695

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05696

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05697

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05698

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05699

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05700

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05701

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05702

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05703

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05704

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05705

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05706

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05707

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05708

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05709

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05710

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05711

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05712

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05713

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05714

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05715

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05716

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05717

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05718

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05719

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05720

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05721

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05722

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05723

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05724

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05725

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05726

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05727

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05728

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05729

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05730

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05731

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05732

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05733

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05734

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05735

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05736

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05737

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05738

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05739

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05740

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05741

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05742

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05743

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05744

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05745

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05746

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05747

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05748

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05749

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05750

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05751

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05752

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05753

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05754

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05755

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05756

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05757

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05758

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05759

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05760

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05761

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05762

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05763

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05764

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05765

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05766

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05767

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05768

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05769

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05770

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05771

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05772

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05773

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05774

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05775

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05776

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05777

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05778

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05779

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05780

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05781

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05782

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05783

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05784

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05785

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05786

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05787

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05788

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05789

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05790

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05791

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05792

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05793

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05794

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05795

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05796

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05797

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05798

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05799

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05800

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05801

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05802

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05803

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05804

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05805

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05806

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05807

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05808

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05809

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05810

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05811

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05812

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05813

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05814

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05815

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05816

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05817

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05818

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05819

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05820

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05821

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05822

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05823

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05824

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05825

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05826

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05827

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05828

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05829

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05830

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05831

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05832

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05833

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05834

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05835

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05836

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05837

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05838

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05839

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05840

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05841

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05842

Severity: CRITICAL (9.3)

References:

Published: 1970-01-01

BDU:2015-05843

Severity: CRITICAL (9.3)

References:

Published: 2014-03-11
Modified: 2024-11-21

CVE-2014-0101

Severity: HIGH (7.8)

References:

Published: 2014-03-11
Modified: 2024-11-21

CVE-2014-0102

The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands.

Severity: MEDIUM (5.2)

References:

Published: 2014-03-24
Modified: 2024-11-21

CVE-2014-0131

Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.

Severity: LOW (2.9)

References:

Published: 2014-03-11
Modified: 2024-11-21

CVE-2014-2309

The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.

Severity: MEDIUM (6.1)

References:

Published: 2014-03-24
Modified: 2024-11-21

CVE-2014-2568

Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced.

Severity: LOW (2.9)

References:

Published: 2014-04-01
Modified: 2024-11-21

CVE-2014-2672

Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.

Severity: HIGH (7.1)

References:

Published: 2014-04-01
Modified: 2024-11-21

CVE-2014-2673

The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed with the processor in the Transactional state.

Severity: MEDIUM (4.7)

References:

Published: 2014-04-15
Modified: 2024-11-21

CVE-2014-2706

Severity: HIGH (7.1)

References:

Package libssh updated to version 0.6.3-alt0.M70P.1 for branch t7 in task 117310.

Published: 2014-08-10

BDU:2015-09759

Уязвимость операционной системы Gentoo Linux, позволяющая злоумышленнику нарушить конфиденциальность защищаемой информации

Severity: LOW (1.9)

References:

Published: 2014-03-14
Modified: 2024-11-21

CVE-2014-0017

The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.

Severity: LOW (1.9)

References:

Package mate-mplayer updated to version 1.0.8-alt0.M70P.1 for branch t7 in task 117310.

Новая версия 1.0.8 и конфликт с gnome-mplayer

Package mediawiki updated to version 1.22.4-alt1 for branch t7 in task 117310.

Published: 2010-04-20
Modified: 2024-11-21

CVE-2010-1150

MediaWiki before 1.15.3, and 1.6.x before 1.16.0beta2, does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to conduct phishing attacks by arranging for a victim to login to the attacker's account and then execute a crafted user script, related to a "login CSRF" issue.

Severity: MEDIUM (6.0)

References:

Published: 2010-06-08
Modified: 2024-11-21

CVE-2010-1647

Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer.

Severity: MEDIUM (4.3)

References:

Published: 2010-06-08
Modified: 2024-11-21

CVE-2010-1648

Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form.

Severity: MEDIUM (6.8)

References:

Published: 2011-01-11
Modified: 2024-11-21

CVE-2011-0003

MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.

Severity: MEDIUM (5.8)

References:

Published: 2011-02-04
Modified: 2024-11-21

CVE-2011-0047

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.2 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) comments, aka "CSS injection vulnerability."

Severity: MEDIUM (4.3)

References:

Published: 2011-04-27
Modified: 2024-11-21

CVE-2011-1579

The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information by using the \2f\2a and \2a\2f hex strings to surround CSS comments.

Severity: MEDIUM (5.8)

References:

Published: 2011-04-27
Modified: 2024-11-21

CVE-2011-1580

The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request.

Severity: LOW (3.5)

References:

Published: 2011-05-24
Modified: 2024-11-21

CVE-2011-1766

includes/User.php in MediaWiki before 1.16.5, when wgBlockDisablesLogin is enabled, does not clear certain cached data after verification of an auth token fails, which allows remote attackers to bypass authentication by creating crafted wikiUserID and wikiUserName cookies, or by leveraging an unattended workstation.

Severity: MEDIUM (5.8)

References:

Published: 2012-01-08
Modified: 2024-11-21

CVE-2011-4360

MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter.

Severity: MEDIUM (5.0)

References:

Published: 2012-01-08
Modified: 2024-11-21

CVE-2011-4361

MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions.

Severity: MEDIUM (5.0)

References:

Published: 2019-10-29
Modified: 2024-11-21

CVE-2012-0046

mediawiki allows deleted text to be exposed

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Published: 2012-06-29
Modified: 2024-11-21

CVE-2012-2698

Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page.

Severity: MEDIUM (4.3)

References:

Published: 2017-10-26
Modified: 2024-11-21

CVE-2012-4377

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image.

Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Published: 2017-10-26
Modified: 2024-11-21

CVE-2012-4378

Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.

Severity: MEDIUM (6.1) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Published: 2017-10-20
Modified: 2024-11-21

CVE-2012-4379

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References:

Published: 2017-10-20
Modified: 2024-11-21

CVE-2012-4380

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Published: 2020-02-08
Modified: 2024-11-21

CVE-2012-4381

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors.

Severity: HIGH (8.1) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Published: 2017-10-20
Modified: 2024-11-21

CVE-2012-4382

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason via a reblock attempt.

Severity: MEDIUM (4.9) Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References:

Published: 2014-06-02
Modified: 2024-11-21

CVE-2012-5391

Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the session_id.

Severity: MEDIUM (6.8)

References:

Published: 2013-12-13
Modified: 2024-11-21

CVE-2012-5394

Cross-site request forgery (CSRF) vulnerability in the CentralAuth extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to hijack the authentication of users for requests that login via vectors involving image loading.

Severity: MEDIUM (6.8)

References:

Published: 2014-06-02
Modified: 2024-11-21

CVE-2012-5395

Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the centralauth_Session cookie.

Severity: MEDIUM (6.8)

References:

Published: 2019-11-20
Modified: 2024-11-21

CVE-2013-1816

MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Published: 2019-11-20
Modified: 2024-11-21

CVE-2013-1817

MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Published: 2014-06-02
Modified: 2024-11-21

CVE-2013-1818

maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.

Severity: MEDIUM (5.0)

References:

Published: 2013-11-18
Modified: 2024-11-21

CVE-2013-2031

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.

Severity: MEDIUM (4.3)

References:

Published: 2013-11-18
Modified: 2024-11-21

CVE-2013-2032

MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.

Severity: MEDIUM (5.0)

References:

Published: 2013-12-13
Modified: 2024-11-21

CVE-2013-4567

Severity: MEDIUM (4.3)

References:

Published: 2013-12-13
Modified: 2024-11-21

CVE-2013-4568

Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.

Severity: MEDIUM (4.3)

References:

Published: 2013-12-13
Modified: 2024-11-21

CVE-2013-4569

The CleanChanges extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3, when "Group changes by page in recent changes and watchlist" is enabled, allows remote attackers to obtain sensitive information (revision-deleted IPs) via the Recent Changes page.

Severity: MEDIUM (4.3)

References:

Published: 2014-05-12
Modified: 2024-11-21

CVE-2013-4570

The zend_inline_hash_func function in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to converting Lua data structures to PHP, as demonstrated by passing { [{}] = 1 } to a module function.

Severity: MEDIUM (5.0)

References:

Published: 2014-05-12
Modified: 2024-11-21

CVE-2013-4571

Buffer overflow in php-luasandbox in the Scribuntu extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 has unspecified impact and remote vectors.

Severity: HIGH (7.5)

References:

Published: 2020-02-06
Modified: 2024-11-21

CVE-2013-4572

The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Published: 2014-05-12
Modified: 2024-11-21

CVE-2013-4574

Cross-site scripting (XSS) vulnerability in the TimeMediaHandler extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to videos.

Severity: MEDIUM (4.3)

References:

Published: 2014-05-12
Modified: 2024-11-21

CVE-2013-6452

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.

Severity: MEDIUM (4.3)

References:

Published: 2014-05-12
Modified: 2024-11-21

CVE-2013-6453

MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.

Severity: HIGH (7.5)

References:

Published: 2014-05-12
Modified: 2024-11-21

CVE-2013-6454

Severity: MEDIUM (4.3)

References:

Published: 2020-01-28
Modified: 2024-11-21

CVE-2013-6455

The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.

Severity: MEDIUM (5.3) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Published: 2014-05-12
Modified: 2024-11-21

CVE-2013-6472

MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via the (1) log API, (2) enhanced RecentChanges, and (3) user watchlists.

Severity: MEDIUM (5.0)

References:

Published: 2015-09-01
Modified: 2024-11-21

CVE-2013-7444

The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.

Severity: MEDIUM (5.0)

References:

Published: 2014-03-02
Modified: 2024-11-21

CVE-2014-2242

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.

Severity: MEDIUM (4.3)

References:

Published: 2014-03-02
Modified: 2024-11-21

CVE-2014-2243

includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.

Severity: MEDIUM (5.8)

References:

Published: 2014-03-02
Modified: 2024-11-21

CVE-2014-2244

Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.

Severity: MEDIUM (4.3)

References:

Published: 2014-05-12
Modified: 2024-11-21

CVE-2014-3454

Cross-site request forgery (CSRF) vulnerability in Special:CreateCategory in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to hijack the authentication of users for requests that create categories via unspecified vectors.

Severity: MEDIUM (6.8)

References:

Published: 2014-05-12
Modified: 2024-11-21

CVE-2014-3455

Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) CreateProperty, (2) CreateTemplate, (3) CreateForm, and (4) CreateClass special pages in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allow remote attackers to hijack the authentication of users for requests that have unspecified impact and vectors.

Severity: MEDIUM (6.8)

References:

Добавить зависимость на php5-dom

Некорректный mediawiki.ini

Package samba updated to version 4.0.16-alt0.M70P.1 for branch t7 in task 117310.

Published: 2014-03-14

BDU:2015-00388

Уязвимость программного обеспечения Samba, позволяющая удаленному злоумышленнику нарушить конфиденциальность защищаемой информации

Severity: MEDIUM (5.0)

References:

Published: 2014-03-14

BDU:2015-00389

Уязвимость программного обеспечения Samba, позволяющая удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации

Severity: MEDIUM (6.1) Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

Published: 2014-03-14

BDU:2015-04322

Уязвимость операционной системы SUSE Linux Enterprise, позволяющая злоумышленнику нарушить конфиденциальность защищаемой информации

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04323

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04324

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04325

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04326

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04327

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04328

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04329

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04330

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04331

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04332

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04333

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04334

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 2014-03-14

BDU:2015-04335

Severity: MEDIUM (5.3) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04336

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04337

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04338

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 1970-01-01

BDU:2015-04339

Severity: MEDIUM (5.0)

References:

CVE-2013-4496

Published: 2014-04-09

BDU:2015-06049

Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: HIGH (8.3)

References:

Published: 2014-04-09

BDU:2015-08932

Уязвимости операционной системы CentOS, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: HIGH (8.3)

References:

Published: 2014-03-14
Modified: 2024-11-21

CVE-2013-4496

Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts.

Severity: MEDIUM (5.0)

References:

Published: 2014-03-14
Modified: 2024-11-21

CVE-2013-6442

The owner_set function in smbcacls.c in smbcacls in Samba 4.0.x before 4.0.16 and 4.1.x before 4.1.6 removes an ACL during use of a --chown or --chgrp option, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging an unintended administrative change.

Severity: MEDIUM (5.8)

References:

Version: 2.1.0

ALT-BU-2014-2674-1

Closed bugs

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities