ALT-BU-2014-2969-2
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2025-04-12
CVE-2013-0289
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099544.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099547.html
- http://secunia.com/advisories/55190
- http://security.gentoo.org/glsa/glsa-201310-02.xml
- http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb
- http://sourceforge.net/projects/isync/files/isync/1.0.6/
- http://www.openwall.com/lists/oss-security/2013/02/20/9
- http://www.securityfocus.com/bid/57423
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82232
- http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099544.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099547.html
- http://secunia.com/advisories/55190
- http://security.gentoo.org/glsa/glsa-201310-02.xml
- http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb
- http://sourceforge.net/projects/isync/files/isync/1.0.6/
- http://www.openwall.com/lists/oss-security/2013/02/20/9
- http://www.securityfocus.com/bid/57423
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82232
Closed vulnerabilities
Modified: 2025-04-12
CVE-2013-6401
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.
- http://comments.gmane.org/gmane.comp.security.oss.general/12099
- http://lists.opensuse.org/opensuse-updates/2014-03/msg00057.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1035538
- https://github.com/akheron/jansson/commit/8f80c2d83808150724d31793e6ade92749b1faa4
- http://comments.gmane.org/gmane.comp.security.oss.general/12099
- http://lists.opensuse.org/opensuse-updates/2014-03/msg00057.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1035538
- https://github.com/akheron/jansson/commit/8f80c2d83808150724d31793e6ade92749b1faa4
Package python-module-django-horizon updated to version 2014.1.2-alt2 for branch sisyphus in task 129213.
Closed vulnerabilities
Modified: 2025-04-12
CVE-2014-3594
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html
- http://rhn.redhat.com/errata/RHSA-2014-1335.html
- http://rhn.redhat.com/errata/RHSA-2014-1336.html
- http://seclists.org/oss-sec/2014/q3/413
- http://www.securityfocus.com/bid/69291
- https://bugs.launchpad.net/horizon/+bug/1349491
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95378
- https://review.openstack.org/#/c/115310
- https://review.openstack.org/#/c/115311
- https://review.openstack.org/#/c/115313/
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html
- http://rhn.redhat.com/errata/RHSA-2014-1335.html
- http://rhn.redhat.com/errata/RHSA-2014-1336.html
- http://seclists.org/oss-sec/2014/q3/413
- http://www.securityfocus.com/bid/69291
- https://bugs.launchpad.net/horizon/+bug/1349491
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95378
- https://review.openstack.org/#/c/115310
- https://review.openstack.org/#/c/115311
- https://review.openstack.org/#/c/115313/
Modified: 2024-05-14
GHSA-8g68-2hcj-h8vg
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface
- https://nvd.nist.gov/vuln/detail/CVE-2014-3594
- https://github.com/openstack/horizon/commit/ba2c98aea0db0d03200c811b86b3efe8367f3905
- https://github.com/openstack/horizon/commit/ba908ae88d5925f4f6783eb234cc4ea95017472b
- https://access.redhat.com/errata/RHSA-2014:1188
- https://access.redhat.com/errata/RHSA-2014:1335
- https://access.redhat.com/errata/RHSA-2014:1336
- https://access.redhat.com/security/cve/CVE-2014-3594
- https://bugs.launchpad.net/horizon/+bug/1349491
- https://bugzilla.redhat.com/show_bug.cgi?id=1129774
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95378
- https://review.openstack.org/#/c/115310
- https://review.openstack.org/#/c/115311
- https://review.openstack.org/#/c/115313
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html
- http://rhn.redhat.com/errata/RHSA-2014-1335.html
- http://rhn.redhat.com/errata/RHSA-2014-1336.html
- http://seclists.org/oss-sec/2014/q3/413
- http://www.securityfocus.com/bid/69291
Package thunderbird-lightning-ru updated to version 3.3-alt1 for branch sisyphus in task 129233.
Closed bugs
Дополнение Lightning для Thunderbird не работает после обновления Thunderbird.
Closed bugs
FR: обновить до свежей версии 0.1.21
Closed vulnerabilities
Modified: 2021-03-23
BDU:2015-11826
Уязвимость веб-приложения для синхронизации данных ownCloud, позволяющая нарушителю обойти существующие ограничения доступа и получить доступ к файлам пользователей
Modified: 2021-03-23
BDU:2015-11936
Уязвимость веб-приложения для синхронизации данных ownCloud, позволяющая нарушителю выполнить произвольные SMB-команды
Modified: 2021-03-23
BDU:2015-11937
Уязвимость веб-приложения для синхронизации данных ownCloud, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-04-12
CVE-2014-4929
Directory traversal vulnerability in the routing component in ownCloud Server before 5.0.17 and 6.0.x before 6.0.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a filename, related to index.php.
- http://advisories.mageia.org/MGASA-2014-0301.html
- http://owncloud.org/security/advisory/?id=oc-sa-2014-018
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:140
- http://www.securityfocus.com/bid/68975
- http://advisories.mageia.org/MGASA-2014-0301.html
- http://owncloud.org/security/advisory/?id=oc-sa-2014-018
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:140
- http://www.securityfocus.com/bid/68975
Modified: 2025-04-12
CVE-2014-5341
The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network.
Modified: 2025-04-12
CVE-2014-9045
The FTP backend in user_external in ownCloud Server before 5.0.18 and 6.x before 6.0.6 allows remote attackers to bypass intended authentication requirements via a crafted password.
Modified: 2025-03-31
CVE-2015-4715
The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ (at sign) character in unspecified POST values.
- http://www.securityfocus.com/bid/76158
- https://github.com/owncloud/core/commit/bf0f1a50926a75a26a42a3da4d62e84a489ee77a
- https://owncloud.org/security/advisories/mounted-dropbox-storage-allows-dropbox-com-access-file/
- https://owncloud.org/security/advisory/?id=oc-sa-2015-005
- http://www.securityfocus.com/bid/76158
- https://github.com/owncloud/core/commit/bf0f1a50926a75a26a42a3da4d62e84a489ee77a
- https://owncloud.org/security/advisories/mounted-dropbox-storage-allows-dropbox-com-access-file/
- https://owncloud.org/security/advisory/?id=oc-sa-2015-005
Modified: 2025-04-12
CVE-2015-4717
The filename sanitization component in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 does not properly handle $_GET parameters cast by PHP to an array, which allows remote attackers to cause a denial of service (infinite loop and log file consumption) via crafted endpoint file names.
Modified: 2025-04-12
CVE-2015-4718
The external SMB storage driver in ownCloud Server before 6.0.8, 7.0.x before 7.0.6, and 8.0.x before 8.0.4 allows remote authenticated users to execute arbitrary SMB commands via a ; (semicolon) character in a file.
Modified: 2025-04-12
CVE-2015-5954
The virtual filesystem in ownCloud Server before 6.0.9, 7.0.x before 7.0.7, and 8.0.x before 8.0.5 does not consider that NULL is a valid getPath return value, which allows remote authenticated users to bypass intended access restrictions and gain access to users files via a sharing link to a file with a deleted parent folder.
Package kernel-image-std-def updated to version 3.14.18-alt1 for branch sisyphus in task 129168.
Closed vulnerabilities
Modified: 2025-04-12
CVE-2014-3182
Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value.
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ad3e14d7c5268c2e24477c6ef54bbdf88add5d36
- http://rhn.redhat.com/errata/RHSA-2014-1318.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.2
- http://www.openwall.com/lists/oss-security/2014/09/11/21
- http://www.securityfocus.com/bid/69770
- https://bugzilla.redhat.com/show_bug.cgi?id=1141210
- https://code.google.com/p/google-security-research/issues/detail?id=89
- https://github.com/torvalds/linux/commit/ad3e14d7c5268c2e24477c6ef54bbdf88add5d36
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ad3e14d7c5268c2e24477c6ef54bbdf88add5d36
- http://rhn.redhat.com/errata/RHSA-2014-1318.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.2
- http://www.openwall.com/lists/oss-security/2014/09/11/21
- http://www.securityfocus.com/bid/69770
- https://bugzilla.redhat.com/show_bug.cgi?id=1141210
- https://code.google.com/p/google-security-research/issues/detail?id=89
- https://github.com/torvalds/linux/commit/ad3e14d7c5268c2e24477c6ef54bbdf88add5d36
Modified: 2025-04-12
CVE-2014-3185
Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6817ae225cd650fb1c3295d769298c38b1eba818
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
- http://rhn.redhat.com/errata/RHSA-2014-1318.html
- http://rhn.redhat.com/errata/RHSA-2015-0284.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.2
- http://www.openwall.com/lists/oss-security/2014/09/11/21
- http://www.securityfocus.com/bid/69781
- http://www.ubuntu.com/usn/USN-2374-1
- http://www.ubuntu.com/usn/USN-2375-1
- http://www.ubuntu.com/usn/USN-2376-1
- http://www.ubuntu.com/usn/USN-2377-1
- http://www.ubuntu.com/usn/USN-2378-1
- http://www.ubuntu.com/usn/USN-2379-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1141400
- https://code.google.com/p/google-security-research/issues/detail?id=98
- https://github.com/torvalds/linux/commit/6817ae225cd650fb1c3295d769298c38b1eba818
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6817ae225cd650fb1c3295d769298c38b1eba818
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
- http://rhn.redhat.com/errata/RHSA-2014-1318.html
- http://rhn.redhat.com/errata/RHSA-2015-0284.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.2
- http://www.openwall.com/lists/oss-security/2014/09/11/21
- http://www.securityfocus.com/bid/69781
- http://www.ubuntu.com/usn/USN-2374-1
- http://www.ubuntu.com/usn/USN-2375-1
- http://www.ubuntu.com/usn/USN-2376-1
- http://www.ubuntu.com/usn/USN-2377-1
- http://www.ubuntu.com/usn/USN-2378-1
- http://www.ubuntu.com/usn/USN-2379-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1141400
- https://code.google.com/p/google-security-research/issues/detail?id=98
- https://github.com/torvalds/linux/commit/6817ae225cd650fb1c3295d769298c38b1eba818
