2016-03-13
ALT-BU-2016-2639-1
Branch sisyphus update bulletin.
Package libwebkitgtk4 updated to version 2.10.8-alt1 for branch sisyphus in task 161224.
Closed vulnerabilities
Published: 2016-03-02
Modified: 2021-03-23
Modified: 2021-03-23
BDU:2016-00447
Уязвимость браузера Safari и операционной системы iOS, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
Severity: CRITICAL (9.3)
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
Published: 2016-02-01
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2016-1726
WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-1723 and CVE-2016-1725.
Severity: CRITICAL (9.3)
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Severity: HIGH (8.8)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00004.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
- http://packetstormsecurity.com/files/136227/WebKitGTK-Memory-Corruption-Denial-Of-Service.html
- http://www.securityfocus.com/archive/1/537771/100/0/threaded
- http://www.securityfocus.com/bid/81263
- http://www.securitytracker.com/id/1034737
- https://security.gentoo.org/glsa/201706-15
- https://support.apple.com/HT205730
- https://support.apple.com/HT205732
- https://support.apple.com/HT206168
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00002.html
- http://lists.apple.com/archives/security-announce/2016/Jan/msg00004.html
- http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html
- http://packetstormsecurity.com/files/136227/WebKitGTK-Memory-Corruption-Denial-Of-Service.html
- http://www.securityfocus.com/archive/1/537771/100/0/threaded
- http://www.securityfocus.com/bid/81263
- http://www.securitytracker.com/id/1034737
- https://security.gentoo.org/glsa/201706-15
- https://support.apple.com/HT205730
- https://support.apple.com/HT205732
- https://support.apple.com/HT206168
Closed bugs
А где devel пакеты и есть ли они вообще?
Package altlinux-mime-defaults updated to version 0.35-alt1 for branch sisyphus in task 161250.
Closed bugs
Нет поддержки KDE5
Closed vulnerabilities
Published: 2016-07-19
Modified: 2021-03-23
Modified: 2021-03-23
BDU:2016-01656
Уязвимость библиотеки cURL, позволяющая нарушителю пройти аутентификацию от имени другого пользователя
Severity: MEDIUM (5.0)
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
References:
Published: 2016-01-29
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2016-0755
The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.
Severity: MEDIUM (5.0)
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Severity: HIGH (7.3)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
References:
- http://curl.haxx.se/docs/adv_20160127A.html
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176546.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177342.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177383.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176413.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00031.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00044.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00047.html
- http://packetstormsecurity.com/files/135695/Slackware-Security-Advisory-curl-Updates.html
- http://www.debian.org/security/2016/dsa-3455
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/82307
- http://www.securitytracker.com/id/1034882
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.519965
- http://www.ubuntu.com/usn/USN-2882-1
- https://security.gentoo.org/glsa/201701-47
- https://support.apple.com/HT207170
- http://curl.haxx.se/docs/adv_20160127A.html
- http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176546.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177342.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177383.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176413.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00031.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00044.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00047.html
- http://packetstormsecurity.com/files/135695/Slackware-Security-Advisory-curl-Updates.html
- http://www.debian.org/security/2016/dsa-3455
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/82307
- http://www.securitytracker.com/id/1034882
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.519965
- http://www.ubuntu.com/usn/USN-2882-1
- https://security.gentoo.org/glsa/201701-47
- https://support.apple.com/HT207170
Published: 2016-05-20
Modified: 2025-04-12
Modified: 2025-04-12
CVE-2016-3739
The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.
Severity: LOW (2.6)
Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N
Severity: MEDIUM (5.3)
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
References:
- http://www.openwall.com/lists/oss-security/2024/03/27/4
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/90726
- http://www.securitytracker.com/id/1035907
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.495349
- https://curl.haxx.se/CVE-2016-3739.patch
- https://curl.haxx.se/changes.html#7_49_0
- https://curl.haxx.se/docs/adv_20160518.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://security.gentoo.org/glsa/201701-47
- http://www.openwall.com/lists/oss-security/2024/03/27/4
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/90726
- http://www.securitytracker.com/id/1035907
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.495349
- https://curl.haxx.se/CVE-2016-3739.patch
- https://curl.haxx.se/changes.html#7_49_0
- https://curl.haxx.se/docs/adv_20160518.html
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05320149
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722
- https://security.gentoo.org/glsa/201701-47