2015-11-28
ALT-BU-2015-2757-3
Branch sisyphus update bulletin.
Package smplayer-skins updated to version 15.2.0-alt2 for branch sisyphus in task 153864.
Closed bugs
Зависит от smplayer
Package python-module-django updated to version 1.8.7-alt1 for branch sisyphus in task 153866.
Closed vulnerabilities
Published: 2015-12-07
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2015-8213
The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.
Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
References:
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html
- http://rhn.redhat.com/errata/RHSA-2016-0129.html
- http://rhn.redhat.com/errata/RHSA-2016-0156.html
- http://rhn.redhat.com/errata/RHSA-2016-0157.html
- http://rhn.redhat.com/errata/RHSA-2016-0158.html
- http://www.debian.org/security/2015/dsa-3404
- http://www.securityfocus.com/bid/77750
- http://www.securitytracker.com/id/1034237
- http://www.ubuntu.com/usn/USN-2816-1
- https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4
- https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html
- http://rhn.redhat.com/errata/RHSA-2016-0129.html
- http://rhn.redhat.com/errata/RHSA-2016-0156.html
- http://rhn.redhat.com/errata/RHSA-2016-0157.html
- http://rhn.redhat.com/errata/RHSA-2016-0158.html
- http://www.debian.org/security/2015/dsa-3404
- http://www.securityfocus.com/bid/77750
- http://www.securitytracker.com/id/1034237
- http://www.ubuntu.com/usn/USN-2816-1
- https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4
- https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued/
Published: 2022-05-17
Modified: 2024-09-18
Modified: 2024-09-18
GHSA-6wcr-wcqm-3mfh
Django settings leak in date template filter
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References:
- https://nvd.nist.gov/vuln/detail/CVE-2015-8213
- https://github.com/django/django/commit/316bc3fc9437c5960c24baceb93c73f1939711e4
- https://github.com/django/django/commit/3ebbda0aef9e7a90ac6208bb8f9bc21228e2c7da
- https://github.com/django/django/commit/8a01c6b53169ee079cb21ac5919fdafcc8c5e172
- https://github.com/django/django/commit/9f83fc2f66f5a0bac7c291aec55df66050bb6991
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2015-11.yaml
- https://www.djangoproject.com/weblog/2015/nov/24/security-releases-issued
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/173375.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174770.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00014.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00017.html
- http://rhn.redhat.com/errata/RHSA-2016-0129.html
- http://rhn.redhat.com/errata/RHSA-2016-0156.html
- http://rhn.redhat.com/errata/RHSA-2016-0157.html
- http://rhn.redhat.com/errata/RHSA-2016-0158.html
- http://www.debian.org/security/2015/dsa-3404
- http://www.securityfocus.com/bid/77750
- http://www.securitytracker.com/id/1034237
- http://www.ubuntu.com/usn/USN-2816-1
Package xorg-server updated to version 1.18.0-alt1 for branch sisyphus in task 153823.
Closed vulnerabilities
Published: 2015-07-01
Modified: 2025-08-29
Modified: 2025-08-29
CVE-2015-3164
The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.
Severity: LOW (3.6)Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N
References:
- http://lists.freedesktop.org/archives/wayland-devel/2015-June/022548.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00044.html
- http://www.securityfocus.com/bid/75535
- https://security.gentoo.org/glsa/201701-64
- http://lists.freedesktop.org/archives/wayland-devel/2015-June/022548.html
- http://lists.opensuse.org/opensuse-updates/2015-06/msg00044.html
- http://www.securityfocus.com/bid/75535
- https://security.gentoo.org/glsa/201701-64
Closed bugs
Права на unit-файл должны быть 644