ALT Linux Team

Branch sisyphus update on 2017-06-22

2017-06-22

ALT-BU-2017-3193-1

Branch sisyphus update bulletin.

ALT-PU-2017-1766-1

Package openvpn updated to version 2.4.3-alt1 for branch sisyphus in task 184594.

Closed vulnerabilities

Published: 2017-06-06

BDU:2018-00021

Уязвимость пакета OpenVPN, существующая из-за неправильной обработки клиентских подключений к HTTP-прокси, позволяющая нарушителю выполнить произвольный код

Severity: HIGH (7.4) Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
References:
Published: 2017-06-27
Modified: 2024-11-21

CVE-2017-7508

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
Published: 2017-06-27
Modified: 2024-11-21

CVE-2017-7520

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.

Severity: HIGH (7.4) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
References:
Published: 2017-06-27
Modified: 2024-11-21

CVE-2017-7521

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks and double-free issue in extract_x509_extension().

Severity: MEDIUM (5.9) Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
Published: 2017-06-27
Modified: 2024-11-21

CVE-2017-7522

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certificate with an embedded NULL character.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References:
VKontakte | Telegram | YouTube | Forum | GitHub | Bugzilla
Version: 2.1.0
Back to top