ALT-BU-2014-2982-2
Branch sisyphus update bulletin.
Package libkeybinder updated to version 0.3.0-alt2.git20120617 for branch sisyphus in task 130167.
Closed bugs
module is installed into wrong directory
Closed vulnerabilities
Modified: 2017-11-08
BDU:2015-04141
Уязвимость функционала для работ с аргументами переменной длины vararg интерпретатора скриптов Lua, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2017-11-08
BDU:2015-04142
Уязвимость функционала для работ с аргументами переменной длины vararg интерпретатора скриптов Lua, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-04-12
CVE-2014-5461
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
- http://advisories.mageia.org/MGASA-2014-0414.html
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00030.html
- http://secunia.com/advisories/59890
- http://secunia.com/advisories/60869
- http://secunia.com/advisories/61411
- http://www.debian.org/security/2014/dsa-3015
- http://www.debian.org/security/2014/dsa-3016
- http://www.lua.org/bugs.html#5.2.2-1
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:144
- http://www.openwall.com/lists/oss-security/2014/08/21/1
- http://www.openwall.com/lists/oss-security/2014/08/21/4
- http://www.openwall.com/lists/oss-security/2014/08/27/2
- http://www.securityfocus.com/bid/69342
- http://www.ubuntu.com/usn/USN-2338-1
- https://security.gentoo.org/glsa/201701-53
- https://security.gentoo.org/glsa/202305-23
- http://advisories.mageia.org/MGASA-2014-0414.html
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00030.html
- http://secunia.com/advisories/59890
- http://secunia.com/advisories/60869
- http://secunia.com/advisories/61411
- http://www.debian.org/security/2014/dsa-3015
- http://www.debian.org/security/2014/dsa-3016
- http://www.lua.org/bugs.html#5.2.2-1
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:144
- http://www.openwall.com/lists/oss-security/2014/08/21/1
- http://www.openwall.com/lists/oss-security/2014/08/21/4
- http://www.openwall.com/lists/oss-security/2014/08/27/2
- http://www.securityfocus.com/bid/69342
- http://www.ubuntu.com/usn/USN-2338-1
- https://security.gentoo.org/glsa/201701-53
- https://security.gentoo.org/glsa/202305-23
Package phpMyAdmin updated to version 4.2.8.1-alt1 for branch sisyphus in task 130195.
Closed vulnerabilities
Modified: 2025-04-12
CVE-2014-6300
Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php
- http://www.securityfocus.com/bid/69790
- https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac
- https://security.gentoo.org/glsa/201505-03
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php
- http://www.securityfocus.com/bid/69790
- https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac
- https://security.gentoo.org/glsa/201505-03
Modified: 2023-08-16
GHSA-6wfj-2mw7-p5cg
phpMyAdmin micro history Implementation XSS Vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2014-6300
- https://github.com/phpmyadmin/phpmyadmin/commit/33b39f9f1dd9a4d27856530e5ac004e23b30e8ac
- https://security.gentoo.org/glsa/201505-03
- https://web.archive.org/web/20200228081340/http://www.securityfocus.com/bid/69790
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00032.html
- http://www.phpmyadmin.net/home_page/security/PMASA-2014-10.php
Package apache-commons-fileupload updated to version 1.3-alt1_4jpp7 for branch sisyphus in task 129933.
Closed vulnerabilities
Modified: 2026-04-29
CVE-2013-0248
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
- http://archives.neohapsis.com/archives/bugtraq/2013-03/0035.html
- http://marc.info/?l=bugtraq&m=144050155601375&w=2
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.osvdb.org/90906
- http://www.securityfocus.com/bid/58326
- https://security.gentoo.org/glsa/202107-39
- http://archives.neohapsis.com/archives/bugtraq/2013-03/0035.html
- http://marc.info/?l=bugtraq&m=144050155601375&w=2
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.osvdb.org/90906
- http://www.securityfocus.com/bid/58326
- https://security.gentoo.org/glsa/202107-39
Modified: 2022-07-08
GHSA-vm69-474v-7q2w
Incorrect Default Permissions in Apache Commons FileUpload
- https://nvd.nist.gov/vuln/detail/CVE-2013-0248
- https://security.gentoo.org/glsa/202107-39
- http://archives.neohapsis.com/archives/bugtraq/2013-03/0035.html
- http://marc.info/?l=bugtraq&m=144050155601375&w=2
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.osvdb.org/90906