Branch sisyphus update bulletin.

Package curl updated to version 7.50.2-alt1 for branch sisyphus in task 169297.

Published: 2016-10-04
Modified: 2024-11-21

CVE-2016-7141

curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Package gnutls30 updated to version 3.4.15-alt1 for branch sisyphus in task 169296.

Published: 2016-09-27
Modified: 2024-11-21

CVE-2016-7444

The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Package firefox-gost updated to version 45.3.0-alt1 for branch sisyphus in task 166803.

No data currently available.

Package openvpn updated to version 2.3.12-alt1 for branch sisyphus in task 169304.

Хорошо бы паковать openvpn-plugin.h

Отсутствует /var/run/openvpn

Broken systemd integration

Package libgtk+2 updated to version 2.24.31-alt1 for branch sisyphus in task 169305.

Published: 2016-02-17
Modified: 2024-11-21

CVE-2013-7447

Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoint, and possibly other applications, allows remote attackers to cause a denial of service (crash) via a large image file, which triggers a large memory allocation.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

Version: 2.1.0

Branch sisyphus update on 2016-09-10

ALT-BU-2016-2983-1

ALT-PU-2016-1956-1

Closed vulnerabilities

CVE-2016-7141

ALT-PU-2016-1957-1

Closed vulnerabilities

CVE-2016-7444

ALT-PU-2016-1958-1

Closed vulnerabilities

MFSA 2016-63

MFSA 2016-64

MFSA 2016-65

MFSA 2016-67

MFSA 2016-70

MFSA 2016-72

MFSA 2016-73

MFSA 2016-76

MFSA 2016-77

MFSA 2016-78

MFSA 2016-79

MFSA 2016-80

ALT-PU-2016-1962-1

Closed bugs

Bug #31085

Bug #31145

Bug #32204

ALT-PU-2016-1964-1

Closed vulnerabilities

CVE-2013-7447