ALT-BU-2015-2767-1
Branch p7 update bulletin.
Closed vulnerabilities
BDU:2015-11311
Уязвимость браузеров Firefox и Firefox ESR, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2015-4497
Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.
- SUSE-SU-2015:1504
- SUSE-SU-2015:1504
- SUSE-SU-2015:2081
- SUSE-SU-2015:2081
- openSUSE-SU-2015:1492
- openSUSE-SU-2015:1492
- RHSA-2015:1693
- RHSA-2015:1693
- DSA-3345
- DSA-3345
- http://www.mozilla.org/security/announce/2015/mfsa2015-94.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-94.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 76502
- 76502
- 1033397
- 1033397
- USN-2723-1
- USN-2723-1
- http://www.zerodayinitiative.com/advisories/ZDI-15-406
- http://www.zerodayinitiative.com/advisories/ZDI-15-406
- https://bugzilla.mozilla.org/show_bug.cgi?id=1164766
- https://bugzilla.mozilla.org/show_bug.cgi?id=1164766
- https://bugzilla.mozilla.org/show_bug.cgi?id=1175278
- https://bugzilla.mozilla.org/show_bug.cgi?id=1175278
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
Closed bugs
Добавить поддержку GStreamer 1.0
Closed vulnerabilities
BDU:2015-01741
Уязвимости операционной системы Debian GNU/Linux, позволяющие локальному злоумышленнику нарушить доступность защищаемой информации
BDU:2015-04278
Уязвимость операционной системы SUSE Linux Enterprise, позволяющая злоумышленнику нарушить доступность защищаемой информации
BDU:2015-04279
Уязвимость операционной системы SUSE Linux Enterprise, позволяющая злоумышленнику нарушить доступность защищаемой информации
BDU:2015-04280
Уязвимость операционной системы SUSE Linux Enterprise, позволяющая злоумышленнику нарушить доступность защищаемой информации
BDU:2015-04281
Уязвимость операционной системы SUSE Linux Enterprise, позволяющая злоумышленнику нарушить доступность защищаемой информации
BDU:2015-04282
Уязвимость операционной системы SUSE Linux Enterprise, позволяющая злоумышленнику нарушить доступность защищаемой информации
BDU:2015-09737
Уязвимость операционной системы Gentoo Linux, позволяющая злоумышленнику нарушить доступность защищаемой информации
BDU:2015-09788
Уязвимости операционной системы Gentoo Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
BDU:2020-04521
Уязвимость системы межпроцессорного взаимодействия D-Bus, вызванная ошибками синхронизации при использовании общего ресурса, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2013-2168
The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.
- http://cgit.freedesktop.org/dbus/dbus/commit/?id=954d75b2b64e4799f360d2a6bf9cff6d9fee37e7
- http://cgit.freedesktop.org/dbus/dbus/commit/?id=954d75b2b64e4799f360d2a6bf9cff6d9fee37e7
- FEDORA-2013-11198
- FEDORA-2013-11198
- FEDORA-2013-11142
- FEDORA-2013-11142
- [dbus] 20130613 CVE-2013-2168: dbus: DoS in system services caused by _dbus_printf_string_upper_bound
- [dbus] 20130613 CVE-2013-2168: dbus: DoS in system services caused by _dbus_printf_string_upper_bound
- openSUSE-SU-2013:1118
- openSUSE-SU-2013:1118
- openSUSE-SU-2014:1239
- openSUSE-SU-2014:1239
- 53317
- 53317
- 53832
- 53832
- DSA-2707
- DSA-2707
- MDVSA-2013:177
- MDVSA-2013:177
- [oss-security] 20130613 CVE-2013-2168: dbus: DoS in system services caused by _dbus_printf_string_upper_bound
- [oss-security] 20130613 CVE-2013-2168: dbus: DoS in system services caused by _dbus_printf_string_upper_bound
- 60546
- 60546
- 1028667
- 1028667
- USN-1874-1
- USN-1874-1
- https://bugzilla.redhat.com/show_bug.cgi?id=974109
- https://bugzilla.redhat.com/show_bug.cgi?id=974109
- oval:org.mitre.oval:def:16881
- oval:org.mitre.oval:def:16881
Modified: 2025-01-17
CVE-2014-3477
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.
- http://advisories.mageia.org/MGASA-2014-0266.html
- http://advisories.mageia.org/MGASA-2014-0266.html
- http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.8&id=24c590703ca47eb71ddef453de43126b90954567
- http://cgit.freedesktop.org/dbus/dbus/commit/?h=dbus-1.8&id=24c590703ca47eb71ddef453de43126b90954567
- openSUSE-SU-2014:0821
- openSUSE-SU-2014:0821
- openSUSE-SU-2014:0874
- openSUSE-SU-2014:0874
- openSUSE-SU-2014:1239
- openSUSE-SU-2014:1239
- [oss-security] 20140610 CVE-2014-3477 (fd.o#78979): local DoS in dbus-daemon
- [oss-security] 20140610 CVE-2014-3477 (fd.o#78979): local DoS in dbus-daemon
- 59428
- 59428
- 59611
- 59611
- 59798
- 59798
- DSA-2971
- DSA-2971
- MDVSA-2015:176
- MDVSA-2015:176
- 67986
- 67986
- https://bugs.freedesktop.org/show_bug.cgi?id=78979
- https://bugs.freedesktop.org/show_bug.cgi?id=78979
Modified: 2024-11-21
CVE-2014-3635
Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.
- http://advisories.mageia.org/MGASA-2014-0395.html
- http://advisories.mageia.org/MGASA-2014-0395.html
- openSUSE-SU-2014:1239
- openSUSE-SU-2014:1239
- 61378
- 61378
- DSA-3026
- DSA-3026
- MDVSA-2015:176
- MDVSA-2015:176
- [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8
- [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- 1030864
- 1030864
- USN-2352-1
- USN-2352-1
- https://bugs.freedesktop.org/show_bug.cgi?id=83622
- https://bugs.freedesktop.org/show_bug.cgi?id=83622
Modified: 2024-11-21
CVE-2014-3636
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.
- http://advisories.mageia.org/MGASA-2014-0395.html
- http://advisories.mageia.org/MGASA-2014-0395.html
- openSUSE-SU-2014:1239
- openSUSE-SU-2014:1239
- 61378
- 61378
- DSA-3026
- DSA-3026
- MDVSA-2015:176
- MDVSA-2015:176
- [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8
- [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8
- 1030864
- 1030864
- USN-2352-1
- USN-2352-1
- https://bugs.freedesktop.org/show_bug.cgi?id=82820
- https://bugs.freedesktop.org/show_bug.cgi?id=82820
Modified: 2024-11-21
CVE-2014-3637
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.
- http://advisories.mageia.org/MGASA-2014-0395.html
- http://advisories.mageia.org/MGASA-2014-0395.html
- openSUSE-SU-2014:1239
- openSUSE-SU-2014:1239
- 61378
- 61378
- DSA-3026
- DSA-3026
- MDVSA-2015:176
- MDVSA-2015:176
- [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8
- [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8
- [oss-security] 20190624 Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
- [oss-security] 20190624 Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
- [oss-security] 20190624 Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
- [oss-security] 20190624 Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
- 1030864
- 1030864
- USN-2352-1
- USN-2352-1
- https://bugs.freedesktop.org/show_bug.cgi?id=80559
- https://bugs.freedesktop.org/show_bug.cgi?id=80559
Modified: 2024-11-21
CVE-2014-3638
The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.
- http://advisories.mageia.org/MGASA-2014-0395.html
- http://advisories.mageia.org/MGASA-2014-0395.html
- SUSE-SU-2014:1146
- SUSE-SU-2014:1146
- openSUSE-SU-2014:1239
- openSUSE-SU-2014:1239
- 61378
- 61378
- 61431
- 61431
- DSA-3026
- DSA-3026
- MDVSA-2015:176
- MDVSA-2015:176
- [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8
- [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8
- 1030864
- 1030864
- USN-2352-1
- USN-2352-1
- https://bugs.freedesktop.org/show_bug.cgi?id=81053
- https://bugs.freedesktop.org/show_bug.cgi?id=81053
Modified: 2024-11-21
CVE-2014-3639
The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.
- http://advisories.mageia.org/MGASA-2014-0395.html
- http://advisories.mageia.org/MGASA-2014-0395.html
- SUSE-SU-2014:1146
- SUSE-SU-2014:1146
- openSUSE-SU-2014:1239
- openSUSE-SU-2014:1239
- 61378
- 61378
- 61431
- 61431
- DSA-3026
- DSA-3026
- MDVSA-2015:176
- MDVSA-2015:176
- [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8
- [oss-security] 20140916 CVE-2014-3635 to 3639: security issues in D-Bus < 1.8.8
- 1030864
- 1030864
- USN-2352-1
- USN-2352-1
- https://bugs.freedesktop.org/show_bug.cgi?id=80919
- https://bugs.freedesktop.org/show_bug.cgi?id=80919
Modified: 2024-11-21
CVE-2014-7824
D-Bus 1.3.0 through 1.6.x before 1.6.26, 1.8.x before 1.8.10, and 1.9.x before 1.9.2 allows local users to cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3636.1.
- http://advisories.mageia.org/MGASA-2014-0457.html
- http://advisories.mageia.org/MGASA-2014-0457.html
- 62603
- 62603
- DSA-3099
- DSA-3099
- MDVSA-2015:176
- MDVSA-2015:176
- [oss-security] 20141110 CVE-2014-7824: D-Bus denial of service via incomplete fix for CVE-2014-3636
- [oss-security] 20141110 CVE-2014-7824: D-Bus denial of service via incomplete fix for CVE-2014-3636
- 71012
- 71012
- USN-2425-1
- USN-2425-1
- https://bugs.freedesktop.org/show_bug.cgi?id=85105
- https://bugs.freedesktop.org/show_bug.cgi?id=85105
- dbus-cve20147824-dos(98576)
- dbus-cve20147824-dos(98576)
Modified: 2024-11-21
CVE-2015-0245
D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
- http://advisories.mageia.org/MGASA-2015-0071.html
- http://advisories.mageia.org/MGASA-2015-0071.html
- openSUSE-SU-2015:0300
- openSUSE-SU-2015:0300
- DSA-3161
- DSA-3161
- MDVSA-2015:176
- MDVSA-2015:176
- [oss-security] 20150209 CVE-2015-0245: denial of service in dbus >= 1.4 systemd activation
- [oss-security] 20150209 CVE-2015-0245: denial of service in dbus >= 1.4 systemd activation
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html