2015-11-18
ALT-BU-2015-2743-1
Branch sisyphus update bulletin.
Closed bugs
pid & logrotate fixes
Package mount-tray updated to version 1.2.5-alt3 for branch sisyphus in task 153367.
Closed bugs
add Requires: libqt4-svg
Closed vulnerabilities
Published: 2015-11-24
BDU:2015-12110
Уязвимость графического интерфейса GNOME Display Manager операционной системы Fedora, позволяющая нарушителю обойти экран блокировки
Severity: HIGH (7.2)
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2015-11-24
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2015-7496
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
Severity: HIGH (7.2)
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
References:
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172328.html
- http://www.openwall.com/lists/oss-security/2015/11/17/10
- http://www.openwall.com/lists/oss-security/2015/11/17/8
- https://access.redhat.com/errata/RHSA-2017:2128
- https://bugzilla.gnome.org/show_bug.cgi?id=758032
- https://download.gnome.org/sources/gdm/3.18/gdm-3.18.2.news
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172328.html
- http://www.openwall.com/lists/oss-security/2015/11/17/10
- http://www.openwall.com/lists/oss-security/2015/11/17/8
- https://access.redhat.com/errata/RHSA-2017:2128
- https://bugzilla.gnome.org/show_bug.cgi?id=758032
- https://download.gnome.org/sources/gdm/3.18/gdm-3.18.2.news
Closed vulnerabilities
Published: 2015-02-17
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2015-0247
Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image.
Severity: MEDIUM (4.6)
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
References:
- http://advisories.mageia.org/MGASA-2015-0061.html
- http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149434.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html
- http://packetstormsecurity.com/files/130283/e2fsprogs-Input-Sanitization.html
- http://www.debian.org/security/2015/dsa-3166
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:045
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:067
- http://www.ocert.org/advisories/ocert-2015-002.html
- http://www.securityfocus.com/archive/1/534633/100/0/threaded
- http://www.securityfocus.com/bid/72520
- http://www.ubuntu.com/usn/USN-2507-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1187032
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100740
- https://security.gentoo.org/glsa/201701-06
- http://advisories.mageia.org/MGASA-2015-0061.html
- http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4
- http://lists.fedoraproject.org/pipermail/package-announce/2015-February/149434.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html
- http://packetstormsecurity.com/files/130283/e2fsprogs-Input-Sanitization.html
- http://www.debian.org/security/2015/dsa-3166
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:045
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:067
- http://www.ocert.org/advisories/ocert-2015-002.html
- http://www.securityfocus.com/archive/1/534633/100/0/threaded
- http://www.securityfocus.com/bid/72520
- http://www.ubuntu.com/usn/USN-2507-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1187032
- https://exchange.xforce.ibmcloud.com/vulnerabilities/100740
- https://security.gentoo.org/glsa/201701-06
Published: 2015-02-24
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2015-1572
Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247.
Severity: MEDIUM (4.6)
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
References:
- http://advisories.mageia.org/MGASA-2015-0088.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00006.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html
- http://www.debian.org/security/2015/dsa-3166
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:067
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:068
- http://www.securityfocus.com/bid/72709
- http://www.ubuntu.com/usn/USN-2507-1
- https://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=49d0fe2a14f2a23da2fe299643379b8c1d37df73
- https://security.gentoo.org/glsa/201507-22
- http://advisories.mageia.org/MGASA-2015-0088.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150606.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/150805.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00019.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00006.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00010.html
- http://www.debian.org/security/2015/dsa-3166
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:067
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:068
- http://www.securityfocus.com/bid/72709
- http://www.ubuntu.com/usn/USN-2507-1
- https://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=49d0fe2a14f2a23da2fe299643379b8c1d37df73
- https://security.gentoo.org/glsa/201507-22
Package util-linux updated to version 2.27.1-alt1 for branch sisyphus in task 153318.
Closed vulnerabilities
Published: 2017-08-23
Modified: 2025-04-20
Modified: 2025-04-20
CVE-2015-5224
The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
Severity: HIGH (7.5)
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Severity: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- http://www.openwall.com/lists/oss-security/2015/08/24/3
- http://www.securityfocus.com/bid/76467
- https://bugzilla.redhat.com/show_bug.cgi?id=1256686
- https://github.com/karelzak/util-linux/commit/bde91c85bdc77975155058276f99d2e0f5eab5a9
- http://www.openwall.com/lists/oss-security/2015/08/24/3
- http://www.securityfocus.com/bid/76467
- https://bugzilla.redhat.com/show_bug.cgi?id=1256686
- https://github.com/karelzak/util-linux/commit/bde91c85bdc77975155058276f99d2e0f5eab5a9
Closed bugs
Remove explicit nfs-utils requirement