Branch c6 update bulletin.

Package kernel-image-el-smp updated to version 2.6.32-alt45.M60C.3 for branch c6 in task 171433.

Published: 2016-10-18

BDU:2017-00758

Уязвимость компонента mm/gup.c операционной системы Linux, позволяющая нарушителю повысить свои привилегии

Severity: HIGH (7.0) Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Published: 2016-11-11
Modified: 2025-04-08

CVE-2016-5195

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."

Severity: HIGH (7.0) Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Package glibc updated to version 2.11.3-alt8.M60C.4 for branch c6 in task 178323.

Published: 2014-08-29

BDU:2015-04284

Уязвимость операционной системы SUSE Linux Enterprise, позволяющая злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04285

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04286

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04287

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04288

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04289

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04290

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04291

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04292

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04293

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04294

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 1970-01-01

BDU:2015-04295

Severity: HIGH (7.5)

References:

CVE-2014-5119

Published: 2014-07-29

BDU:2015-05856

Уязвимости операционной системы openSUSE, позволяющие злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05857

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05858

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05859

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05860

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05861

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05862

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05863

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05864

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05865

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05866

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05867

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05868

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05869

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05870

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05871

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05872

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05873

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05874

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05875

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05876

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05877

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05878

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05879

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05880

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05881

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05882

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05883

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05884

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05885

Severity: HIGH (7.5)

References:

Published: 1970-01-01

BDU:2015-05886

Severity: HIGH (7.5)

References:

Published: 2014-09-02

BDU:2015-07218

Уязвимость операционной системы Red Hat Enterprise Linux, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Severity: CRITICAL (10.0)

References:

Published: 2014-09-02

BDU:2015-07220

Severity: CRITICAL (10.0)

References:

Published: 2014-09-02

BDU:2015-07222

Severity: CRITICAL (10.0)

References:

Published: 2014-09-02

BDU:2015-07224

Severity: CRITICAL (10.0)

References:

Published: 2014-09-02

BDU:2015-07226

Severity: CRITICAL (10.0)

References:

Published: 2014-09-02

BDU:2015-07228

Severity: CRITICAL (10.0)

References:

Published: 2014-09-02

BDU:2015-07231

Severity: CRITICAL (10.0)

References:

Published: 2016-05-18

BDU:2022-04623

Уязвимость функции clntudp_call (sunrpc/clnt_udp.c) в библиотеке GNU C (glibc или libc6), связанная с записью за границами буфера в памяти, позволяющая нарушителю вводить и выполнять произвольные команды или вызвать отказ в обслуживании

Severity: MEDIUM (5.9) Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

CVE-2016-4429

Published: 2014-10-07
Modified: 2024-11-21

CVE-2014-4043

The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.

Severity: HIGH (7.5)

References:

Published: 2014-08-29
Modified: 2024-11-21

CVE-2014-5119

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.

Severity: HIGH (7.5)

References:

Published: 2015-02-24
Modified: 2024-11-21

CVE-2014-9402

The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process.

Severity: HIGH (7.8)

References:

Published: 2016-04-20
Modified: 2024-11-21

CVE-2014-9761

Multiple stack-based buffer overflows in the GNU C Library (aka glibc or libc6) before 2.23 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long argument to the (1) nan, (2) nanf, or (3) nanl function.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Published: 2016-04-20
Modified: 2024-11-21

CVE-2015-8778

Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the size argument to the __hcreate_r function, which triggers out-of-bounds heap-memory access.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

Published: 2016-06-10
Modified: 2024-11-21

CVE-2016-4429

Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.

Severity: MEDIUM (5.9) Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Package libgcrypt updated to version 1.4.6-alt3.M60C.3 for branch c6 in task 177839.

Published: 2016-08-17

BDU:2019-01635

Уязвимость генератора псевдослучайных чисел библиотеки криптографии Libgcrypt, связанная с раскрытием информации, позволяющая нарушителю прогнозировать выходные данные

Severity: MEDIUM (5.3) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

CVE-2016-6313

Published: 2016-12-13
Modified: 2024-11-21

CVE-2016-6313

The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.

Severity: MEDIUM (5.3) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References:

Package libidn updated to version 1.24-alt1.M60C.3 for branch c6 in task 177910.

Published: 2016-09-07
Modified: 2024-11-21

CVE-2015-8948

idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Published: 2016-09-07
Modified: 2024-11-21

CVE-2016-6261

The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via 64 bytes of input.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Published: 2016-09-07
Modified: 2024-11-21

CVE-2016-6262

idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read, a different vulnerability than CVE-2015-8948.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

Published: 2016-09-07
Modified: 2024-11-21

CVE-2016-6263

The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Package tar updated to version 1.23-alt5.M60C.2 for branch c6 in task 177921.

Published: 2016-09-12

BDU:2019-03749

Уязвимость функции safer_name_suffix архиватора GNU Tar, позволяющая нарушителю обойти предполагаемый механизм защиты и произвести запись в произвольные файлы

Severity: HIGH (7.5) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

CVE-2016-6321

Published: 2016-12-10
Modified: 2024-11-21

CVE-2016-6321

Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

Package bash updated to version 3.2.54-alt0.M60C.2 for branch c6 in task 178296.

Published: 2017-01-24
Modified: 2024-11-21

CVE-2016-9401

popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address.

Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Package file updated to version 4.26-alt7.M60C.2 for branch c6 in task 178298.

Published: 2015-03-30

BDU:2015-10226

Уязвимость интерпретатора PHP, позволяющая удалённому нарушителю вызвать отказ в обслуживании или оказать иное воздействие на систему

Severity: HIGH (7.5)

References:

CVE-2014-9653

Published: 2015-03-30
Modified: 2024-11-21

CVE-2014-9653

readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.

Severity: HIGH (7.5)

References:

Package bzip2 updated to version 1.0.6-alt3.M60C.2 for branch c6 in task 178300.

Published: 2016-06-30

BDU:2021-01720

Уязвимость функции bzip2recover программного обеспечения для сжатия данных Bzip2, связанная с использованием после освобождения, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (6.5) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

CVE-2016-3189

Published: 2016-06-30
Modified: 2024-11-21

CVE-2016-3189

Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

Version: 2.1.0

ALT-BU-2017-2939-1

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities