ALT-BU-2016-2520-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2015-1038
p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive.
- FEDORA-2015-fadaa9953e
- FEDORA-2015-fadaa9953e
- FEDORA-2015-d5cc306730
- FEDORA-2015-d5cc306730
- openSUSE-SU-2015:1162
- openSUSE-SU-2015:1162
- DSA-3289
- DSA-3289
- [oss-security] 20150111 Re: CVE request for directory traversal flaw in p7zip
- [oss-security] 20150111 Re: CVE request for directory traversal flaw in p7zip
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- 71890
- 71890
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660
- https://bugzilla.redhat.com/show_bug.cgi?id=1179505
- https://bugzilla.redhat.com/show_bug.cgi?id=1179505
- p7zip-cve20151038-symlink(99970)
- p7zip-cve20151038-symlink(99970)
Closed bugs
Нерабочее и ненужное правило udev
Package freeradius updated to version 2.2.9-alt1 for branch sisyphus in task 155642.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2011-4966
modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.
- openSUSE-SU-2013:0137
- openSUSE-SU-2013:0191
- http://rhn.redhat.com/errata/RHBA-2012-0881.html
- RHSA-2013:0134
- https://github.com/alandekok/freeradius-server/commit/1b1ec5ce75e224bd1755650c18ccdaa6dc53e605
- openSUSE-SU-2013:0137
- https://github.com/alandekok/freeradius-server/commit/1b1ec5ce75e224bd1755650c18ccdaa6dc53e605
- RHSA-2013:0134
- http://rhn.redhat.com/errata/RHBA-2012-0881.html
- openSUSE-SU-2013:0191
Modified: 2024-11-21
CVE-2014-2015
Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password hash, as demonstrated by an SSHA hash.
- [freebsd-bugbusters] 20140212 freeradius denial of service in authentication flow
- [freebsd-bugbusters] 20140212 freeradius denial of service in authentication flow
- [freebsd-bugbusters] 20140213 freeradius denial of service in authentication flow
- [freebsd-bugbusters] 20140213 freeradius denial of service in authentication flow
- [freebsd-bugbusters] 20140214 freeradius denial of service in authentication flow
- [freebsd-bugbusters] 20140214 freeradius denial of service in authentication flow
- RHSA-2015:1287
- RHSA-2015:1287
- USN-2122-1
- USN-2122-1
- [oss-security] 20140216 Re: CVE request: freeradius denial of service in rlm_pap hash processing
- [oss-security] 20140216 Re: CVE request: freeradius denial of service in rlm_pap hash processing
- 65581
- 65581
- https://bugzilla.redhat.com/show_bug.cgi?id=1066761
- https://bugzilla.redhat.com/show_bug.cgi?id=1066761
Modified: 2024-11-21
CVE-2015-4680
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
- SUSE-SU-2017:0102
- SUSE-SU-2017:0102
- http://packetstormsecurity.com/files/132415/FreeRADIUS-Insufficient-CRL-Application.html
- http://packetstormsecurity.com/files/132415/FreeRADIUS-Insufficient-CRL-Application.html
- http://www.ocert.org/advisories/ocert-2015-008.html
- http://www.ocert.org/advisories/ocert-2015-008.html
- 20150622 [oCERT-2015-008] FreeRADIUS insufficent CRL application
- 20150622 [oCERT-2015-008] FreeRADIUS insufficent CRL application
- 75327
- 75327
- 1032690
- 1032690
- https://bugzilla.redhat.com/show_bug.cgi?id=1234975
- https://bugzilla.redhat.com/show_bug.cgi?id=1234975
Closed bugs
radclient неработоспособен без словаря
Некорректно ротируется лог