ALT Linux Team

Branch sisyphus update on 2014-09-15

2014-09-15

ALT-BU-2014-3193-1

Branch sisyphus update bulletin.

ALT-PU-2014-3192-1

Package apache-commons-fileupload updated to version 1.3-alt1_4jpp7 for branch sisyphus in task 129933.

Closed vulnerabilities

Published: 2014-04-01

BDU:2022-03337

Уязвимость файла MultipartStream.java библиотеки Apache Commons FileUpload, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (6.3) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References:
Published: 2013-03-16
Modified: 2024-11-21

CVE-2013-0248

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.

Severity: LOW (3.3)
References:
Published: 2014-04-01
Modified: 2024-11-21

CVE-2014-0050

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

Severity: HIGH (7.5)
References:
VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla
Version: 2.1.0
Back to top