ALT-BU-2016-2905-2
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2016-10134
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array parameter in latest.php.
- DSA-3802
- DSA-3802
- [oss-security] 20170112 CVE Request: Zabbix: SQL injection vulnerabilities in "Latest data"
- [oss-security] 20170112 CVE Request: Zabbix: SQL injection vulnerabilities in "Latest data"
- [oss-security] 20170112 Re: CVE Request: Zabbix: SQL injection vulnerabilities in "Latest data"
- [oss-security] 20170112 Re: CVE Request: Zabbix: SQL injection vulnerabilities in "Latest data"
- 95423
- 95423
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850936
- https://code610.blogspot.com/2017/10/zbx-11023-quick-autopsy.html
- https://code610.blogspot.com/2017/10/zbx-11023-quick-autopsy.html
- https://support.zabbix.com/browse/ZBX-11023
- https://support.zabbix.com/browse/ZBX-11023
Closed vulnerabilities
BDU:2017-02586
Уязвимость пакета программ для организации сеансов связи по протоколу SSH Dropbear, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
BDU:2017-02587
Уязвимость пакета программ для организации сеансов связи по протоколу SSH Dropbear, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2016-7406
Format string vulnerability in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via format string specifiers in the (1) username or (2) host argument.
- [oss-security] 20160915 Re: CVE request for Dropbear SSH <2016.74
- [oss-security] 20160915 Re: CVE request for Dropbear SSH <2016.74
- 92974
- 92974
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353
- https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb
- https://secure.ucc.asn.au/hg/dropbear/rev/b66a483f3dcb
- GLSA-201702-23
- GLSA-201702-23
Modified: 2024-11-21
CVE-2016-7407
The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.
- [oss-security] 20160915 Re: CVE request for Dropbear SSH <2016.74
- [oss-security] 20160915 Re: CVE request for Dropbear SSH <2016.74
- 92972
- 92972
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353
- https://secure.ucc.asn.au/hg/dropbear/rev/34e6127ef02e
- https://secure.ucc.asn.au/hg/dropbear/rev/34e6127ef02e
- GLSA-201702-23
- GLSA-201702-23
Modified: 2024-11-21
CVE-2016-7408
The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.
- [oss-security] 20160915 Re: CVE request for Dropbear SSH <2016.74
- [oss-security] 20160915 Re: CVE request for Dropbear SSH <2016.74
- 92970
- 92970
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353
- https://secure.ucc.asn.au/hg/dropbear/rev/eed9376a4ad6
- https://secure.ucc.asn.au/hg/dropbear/rev/eed9376a4ad6
- GLSA-201702-23
- GLSA-201702-23
Modified: 2024-11-21
CVE-2016-7409
The dbclient and server in Dropbear SSH before 2016.74, when compiled with DEBUG_TRACE, allows local users to read process memory via the -v argument, related to a failed remote ident.
- [oss-security] 20160915 Re: CVE request for Dropbear SSH <2016.74
- [oss-security] 20160915 Re: CVE request for Dropbear SSH <2016.74
- 92973
- 92973
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353
- https://bugzilla.redhat.com/show_bug.cgi?id=1376353
- https://secure.ucc.asn.au/hg/dropbear/rev/6a14b1f6dc04
- https://secure.ucc.asn.au/hg/dropbear/rev/6a14b1f6dc04
- GLSA-201702-23
- GLSA-201702-23
Closed vulnerabilities
Modified: 2024-11-21
CVE-2016-4994
Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file.
- openSUSE-SU-2016:1727
- openSUSE-SU-2016:1727
- RHSA-2016:2589
- RHSA-2016:2589
- DSA-3612
- DSA-3612
- 91425
- 91425
- 1036226
- 1036226
- SSA:2016-203-01
- SSA:2016-203-01
- USN-3025-1
- USN-3025-1
- https://bugzilla.gnome.org/show_bug.cgi?id=767873
- https://bugzilla.gnome.org/show_bug.cgi?id=767873
- https://git.gnome.org/browse/gimp/commit/?id=e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f
- https://git.gnome.org/browse/gimp/commit/?id=e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f
Closed bugs
Не создаёт архивы tar.*
Closed vulnerabilities
Modified: 2024-11-21
CVE-2016-2217
The OpenSSL address implementation in Socat 1.7.3.0 and 2.0.0-b8 does not use a prime number for the DH, which makes it easier for remote attackers to obtain the shared secret.
- http://www.dest-unreach.org/socat/contrib/socat-secadv7.html
- http://www.dest-unreach.org/socat/contrib/socat-secadv7.html
- [oss-security] 20160201 Socat security advisory 7 - Created new 2048bit DH modulus
- [oss-security] 20160201 Socat security advisory 7 - Created new 2048bit DH modulus
- [oss-security] 20160203 Re: Socat security advisory 7 - Created new 2048bit DH modulus
- [oss-security] 20160203 Re: Socat security advisory 7 - Created new 2048bit DH modulus
- GLSA-201612-23
- GLSA-201612-23
Closed vulnerabilities
BDU:2021-04643
Уязвимость функции lzo_decompress_buf компонента stream.c программы сжатия Lrzip, связанная с ошибками разыменования указателя, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-25467
A null pointer dereference was discovered lzo_decompress_buf in stream.c in Irzip 0.621 which allows an attacker to cause a denial of service (DOS) via a crafted compressed file.
- https://bugs.launchpad.net/ubuntu/+source/lrzip/+bug/1893641
- https://bugs.launchpad.net/ubuntu/+source/lrzip/+bug/1893641
- https://github.com/ckolivas/lrzip/issues/163
- https://github.com/ckolivas/lrzip/issues/163
- [debian-lts-announce] 20220413 [SECURITY] [DLA 2981-1] lrzip security update
- [debian-lts-announce] 20220413 [SECURITY] [DLA 2981-1] lrzip security update