ALT Linux Team

Branch sisyphus update on 2016-03-15

2016-03-15

ALT-BU-2016-2642-2

Branch sisyphus update bulletin.

ALT-PU-2016-1230-1

Package virtualbox updated to version 5.0.14-alt2 for branch sisyphus in task 161164.

Closed vulnerabilities

Published: 2015-11-05
Modified: 2021-03-23

BDU:2015-11847

Уязвимость виртуальной машины Oracle VM VirtualBox, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-11-05
Modified: 2021-03-23

BDU:2015-11913

Уязвимость виртуальной машины Oracle VM VirtualBox, позволяющая нарушителю вызвать отказ в обслуживании

Severity: LOW (2.1)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-12-14
Modified: 2021-03-23

BDU:2015-12123

Уязвимость гипервизора Xen, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (4.7)Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C
References:
Published: 2016-07-19
Modified: 2024-11-28

BDU:2016-01654

Уязвимость реализации ASN1_TFLG_COMBINE библиотеки OpenSSL, позволяющая нарушителю получить защищаемую информацию из памяти процесса

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2016-07-19
Modified: 2021-03-23

BDU:2016-01655

Уязвимость библиотеки OpenSSL, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (4.3)Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
References:
Published: 2015-12-06
Modified: 2025-04-12

CVE-2015-3195

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Severity: MEDIUM (5.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References:
Published: 2015-12-06
Modified: 2025-04-12

CVE-2015-3196

ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.

Severity: MEDIUM (4.3)Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
References:
Published: 2015-10-21
Modified: 2025-04-12

CVE-2015-4813

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local users to affect availability via unknown vectors related to Core.

Severity: LOW (2.1)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-10-21
Modified: 2025-04-12

CVE-2015-4896

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-11-16
Modified: 2025-04-23

CVE-2015-8104

The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.

Severity: MEDIUM (4.7)Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C
Severity: CRITICAL (10.0)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References:
Published: 2016-01-21
Modified: 2025-04-12

CVE-2016-0495

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and 5.0.14 allows remote attackers to affect availability via unknown vectors related to Core.

Severity: MEDIUM (4.3)Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
References:
Published: 2016-01-21
Modified: 2025-04-12

CVE-2016-0592

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and before 5.0.14 allows local users to affect availability via unknown vectors related to Core.

Severity: LOW (2.1)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2016-01-21
Modified: 2025-04-12

CVE-2016-0602

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.14 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Windows Installer. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."

Severity: MEDIUM (6.2)Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
References:

ALT-PU-2016-1231-1

Package kernel-modules-virtualbox-std-def updated to version 5.0.14-alt1.262419.1 for branch sisyphus in task 161164.

Closed vulnerabilities

Published: 2015-11-05
Modified: 2021-03-23

BDU:2015-11847

Уязвимость виртуальной машины Oracle VM VirtualBox, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-11-05
Modified: 2021-03-23

BDU:2015-11913

Уязвимость виртуальной машины Oracle VM VirtualBox, позволяющая нарушителю вызвать отказ в обслуживании

Severity: LOW (2.1)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-12-14
Modified: 2021-03-23

BDU:2015-12123

Уязвимость гипервизора Xen, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (4.7)Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C
References:
Published: 2016-07-19
Modified: 2024-11-28

BDU:2016-01654

Уязвимость реализации ASN1_TFLG_COMBINE библиотеки OpenSSL, позволяющая нарушителю получить защищаемую информацию из памяти процесса

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2016-07-19
Modified: 2021-03-23

BDU:2016-01655

Уязвимость библиотеки OpenSSL, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (4.3)Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
References:
Published: 2015-12-06
Modified: 2025-04-12

CVE-2015-3195

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Severity: MEDIUM (5.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References:
Published: 2015-12-06
Modified: 2025-04-12

CVE-2015-3196

ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.

Severity: MEDIUM (4.3)Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
References:
Published: 2015-10-21
Modified: 2025-04-12

CVE-2015-4813

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local users to affect availability via unknown vectors related to Core.

Severity: LOW (2.1)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-10-21
Modified: 2025-04-12

CVE-2015-4896

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-11-16
Modified: 2025-04-23

CVE-2015-8104

The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.

Severity: MEDIUM (4.7)Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C
Severity: CRITICAL (10.0)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References:
Published: 2016-01-21
Modified: 2025-04-12

CVE-2016-0495

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and 5.0.14 allows remote attackers to affect availability via unknown vectors related to Core.

Severity: MEDIUM (4.3)Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
References:
Published: 2016-01-21
Modified: 2025-04-12

CVE-2016-0592

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and before 5.0.14 allows local users to affect availability via unknown vectors related to Core.

Severity: LOW (2.1)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2016-01-21
Modified: 2025-04-12

CVE-2016-0602

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.14 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Windows Installer. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."

Severity: MEDIUM (6.2)Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
References:

ALT-PU-2016-1232-1

Package kernel-modules-virtualbox-un-def updated to version 5.0.14-alt1.263173.1 for branch sisyphus in task 161164.

Closed vulnerabilities

Published: 2015-11-05
Modified: 2021-03-23

BDU:2015-11847

Уязвимость виртуальной машины Oracle VM VirtualBox, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-11-05
Modified: 2021-03-23

BDU:2015-11913

Уязвимость виртуальной машины Oracle VM VirtualBox, позволяющая нарушителю вызвать отказ в обслуживании

Severity: LOW (2.1)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-12-14
Modified: 2021-03-23

BDU:2015-12123

Уязвимость гипервизора Xen, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (4.7)Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C
References:
Published: 2016-07-19
Modified: 2024-11-28

BDU:2016-01654

Уязвимость реализации ASN1_TFLG_COMBINE библиотеки OpenSSL, позволяющая нарушителю получить защищаемую информацию из памяти процесса

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2016-07-19
Modified: 2021-03-23

BDU:2016-01655

Уязвимость библиотеки OpenSSL, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (4.3)Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
References:
Published: 2015-12-06
Modified: 2025-04-12

CVE-2015-3195

The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Severity: MEDIUM (5.3)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References:
Published: 2015-12-06
Modified: 2025-04-12

CVE-2015-3196

ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.

Severity: MEDIUM (4.3)Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
References:
Published: 2015-10-21
Modified: 2025-04-12

CVE-2015-4813

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when using a Windows guest, allows local users to affect availability via unknown vectors related to Core.

Severity: LOW (2.1)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-10-21
Modified: 2025-04-12

CVE-2015-4896

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.0.34, 4.1.42, 4.2.34, 4.3.32, and 5.0.8, when a VM has the Remote Display feature (RDP) enabled, allows remote attackers to affect availability via unknown vectors related to Core.

Severity: MEDIUM (5.0)Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2015-11-16
Modified: 2025-04-23

CVE-2015-8104

The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.

Severity: MEDIUM (4.7)Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C
Severity: CRITICAL (10.0)Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References:
Published: 2016-01-21
Modified: 2025-04-12

CVE-2016-0495

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and 5.0.14 allows remote attackers to affect availability via unknown vectors related to Core.

Severity: MEDIUM (4.3)Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
References:
Published: 2016-01-21
Modified: 2025-04-12

CVE-2016-0592

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.3.36 and before 5.0.14 allows local users to affect availability via unknown vectors related to Core.

Severity: LOW (2.1)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2016-01-21
Modified: 2025-04-12

CVE-2016-0602

Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 5.0.14 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Windows Installer. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is an untrusted search path issue that allows local users to gain privileges via a Trojan horse dll in the "application directory."

Severity: MEDIUM (6.2)Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C
References:

ALT-PU-2016-1242-1

Package bacula updated to version 5.2.13-alt5 for branch sisyphus in task 161322.

Closed bugs

Bug #31884

Разные имена логфайла в конфигах /etc/bacula/messages и /etc/logrotate.d/bacula

ALT-PU-2016-1243-1

Package perl-Gear-Rules updated to version 0.18-alt1 for branch sisyphus in task 161388.

Closed bugs

Bug #31882

empty/absent .gear/rules should be allowed perhaps?

VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: 2.1.2
Back to top