ALT-BU-2017-3338-1
Branch p8 update bulletin.
Closed bugs
Steam нет соединения с сервером
Closed vulnerabilities
BDU:2019-00226
Уязвимость функции oup_body_input_stream_read_chunked библиотеки libsoup графического интерфейса GNOME операционных систем Linux, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2017-2885
An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.
- http://packetstormsecurity.com/files/160388/ProCaster-LE-32F430-GStreamer-souphttpsrc-libsoup-2.51.3-Stack-Overflow.html
- http://packetstormsecurity.com/files/160388/ProCaster-LE-32F430-GStreamer-souphttpsrc-libsoup-2.51.3-Stack-Overflow.html
- 20201204 ProCaster LE-32F430 SmartTV RCE via libsoup/2.51.3 stack overflow (CVE-2017-2885)
- 20201204 ProCaster LE-32F430 SmartTV RCE via libsoup/2.51.3 stack overflow (CVE-2017-2885)
- 100258
- 100258
- RHSA-2017:2459
- RHSA-2017:2459
- DSA-3929
- DSA-3929
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0392
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0392
Package gstreamer1.0 updated to version 1.12.2-alt0.M80P.1 for branch p8 in task 187858.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2016-9446
The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1 frame vmnc movie that does not draw to the allocated render canvas.
- [oss-security] 20161118 CVE Request: gstreamer plugins
- [oss-security] 20161118 CVE Request: gstreamer plugins
- [oss-security] 20161118 Re: CVE Request: gstreamer plugins
- [oss-security] 20161118 Re: CVE Request: gstreamer plugins
- 94423
- 94423
- RHSA-2017:2060
- RHSA-2017:2060
- https://bugzilla.gnome.org/show_bug.cgi?id=774533
- https://bugzilla.gnome.org/show_bug.cgi?id=774533
- https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe
- https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/gst/vmnc/vmncdec.c?id=4cb1bcf1422bbcd79c0f683edb7ee85e3f7a31fe
- FEDORA-2021-ed54b1128a
- FEDORA-2021-ed54b1128a
- https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html
- https://scarybeastsecurity.blogspot.de/2016/11/0day-poc-risky-design-decisions-in.html
- GLSA-201705-10
- GLSA-201705-10
Modified: 2024-11-21
CVE-2017-5847
The gst_asf_demux_process_ext_content_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers to cause a denial of service (out-of-bounds heap read) via vectors involving extended content descriptors.
- DSA-3821
- DSA-3821
- [oss-security] 20170201 Multiple memory access issues in gstreamer
- [oss-security] 20170201 Multiple memory access issues in gstreamer
- [oss-security] 20170202 Re: Multiple memory access issues in gstreamer
- [oss-security] 20170202 Re: Multiple memory access issues in gstreamer
- 96001
- 96001
- https://bugzilla.gnome.org/show_bug.cgi?id=777955#c3
- https://bugzilla.gnome.org/show_bug.cgi?id=777955#c3
- https://github.com/GStreamer/gst-plugins-ugly/commit/d21017b52a585f145e8d62781bcc1c5fefc7ee37
- https://github.com/GStreamer/gst-plugins-ugly/commit/d21017b52a585f145e8d62781bcc1c5fefc7ee37
- [debian-lts-announce] 20200530 [SECURITY] [DLA 2226-1] gst-plugins-ugly0.10 security update
- [debian-lts-announce] 20200530 [SECURITY] [DLA 2226-1] gst-plugins-ugly0.10 security update
- GLSA-201705-10
- GLSA-201705-10
Modified: 2024-11-21
CVE-2017-5848
The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and crash) via vectors involving PSM parsing.
- DSA-3818
- DSA-3818
- [oss-security] 20170201 Multiple memory access issues in gstreamer
- [oss-security] 20170201 Multiple memory access issues in gstreamer
- [oss-security] 20170202 Re: Multiple memory access issues in gstreamer
- [oss-security] 20170202 Re: Multiple memory access issues in gstreamer
- 96001
- 96001
- RHSA-2017:2060
- RHSA-2017:2060
- https://bugzilla.gnome.org/show_bug.cgi?id=777957#c3
- https://bugzilla.gnome.org/show_bug.cgi?id=777957#c3
- [debian-lts-announce] 20200331 [SECURITY] [DLA 2164-1] gst-plugins-bad0.10 security update
- [debian-lts-announce] 20200331 [SECURITY] [DLA 2164-1] gst-plugins-bad0.10 security update
- GLSA-201705-10
- GLSA-201705-10
Closed vulnerabilities
Modified: 2024-11-21
CVE-2016-9085
Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.
- [oss-security] 20161027 Re: CVE requests: some issues in gif2webp
- [oss-security] 20161027 Re: CVE requests: some issues in gif2webp
- 93928
- 93928
- https://bugzilla.redhat.com/show_bug.cgi?id=1389338
- https://bugzilla.redhat.com/show_bug.cgi?id=1389338
- https://chromium.googlesource.com/webm/libwebp/+/e2affacc35f1df6cc3b1a9fa0ceff5ce2d0cce83
- https://chromium.googlesource.com/webm/libwebp/+/e2affacc35f1df6cc3b1a9fa0ceff5ce2d0cce83
- [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar
- [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar
- FEDORA-2016-00d2f5c19f
- FEDORA-2016-00d2f5c19f
- FEDORA-2016-160ec6525e
- FEDORA-2016-160ec6525e
- FEDORA-2016-26ef59f03d
- FEDORA-2016-26ef59f03d
- GLSA-201701-61
- GLSA-201701-61
Package libwebkitgtk4 updated to version 2.16.6-alt0.M80P.1 for branch p8 in task 187858.
Closed vulnerabilities
BDU:2017-01740
Уязвимость компонента WebKit браузера Safari, операционной системы iOS и мультимедийного проигрывателя iTunes, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код в привилегированном контексте
BDU:2018-00197
Уязвимость функции IPC::Connection::processMessage UNIX IPC ядра отображения веб-страниц WebKitGTK+, позволяющая нарушителю вызвать переполнение буфера
Modified: 2024-11-21
CVE-2017-1000121
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process. This vulnerability does not affect Apple products.
Modified: 2024-11-21
CVE-2017-1000122
The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service (release assertion) of the UI process. This vulnerability does not affect Apple products.
Modified: 2024-11-21
CVE-2017-2350
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
Modified: 2024-11-21
CVE-2017-2354
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 95736
- 95736
- 1037668
- 1037668
- GLSA-201706-15
- GLSA-201706-15
- https://support.apple.com/HT207481
- https://support.apple.com/HT207481
- https://support.apple.com/HT207482
- https://support.apple.com/HT207482
- https://support.apple.com/HT207484
- https://support.apple.com/HT207484
- https://support.apple.com/HT207485
- https://support.apple.com/HT207485
- https://support.apple.com/HT207486
- https://support.apple.com/HT207486
Modified: 2024-11-21
CVE-2017-2355
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access and application crash) via a crafted web site.
- 95736
- 95736
- 1037668
- 1037668
- GLSA-201706-15
- GLSA-201706-15
- https://support.apple.com/HT207481
- https://support.apple.com/HT207481
- https://support.apple.com/HT207482
- https://support.apple.com/HT207482
- https://support.apple.com/HT207484
- https://support.apple.com/HT207484
- https://support.apple.com/HT207485
- https://support.apple.com/HT207485
- https://support.apple.com/HT207486
- https://support.apple.com/HT207486
Modified: 2024-11-21
CVE-2017-2356
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 95736
- 95736
- 1037668
- 1037668
- GLSA-201706-15
- GLSA-201706-15
- https://support.apple.com/HT207481
- https://support.apple.com/HT207481
- https://support.apple.com/HT207482
- https://support.apple.com/HT207482
- https://support.apple.com/HT207484
- https://support.apple.com/HT207484
- https://support.apple.com/HT207485
- https://support.apple.com/HT207485
- https://support.apple.com/HT207486
- https://support.apple.com/HT207486
Modified: 2024-11-21
CVE-2017-2360
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app.
- 95729
- 95729
- 95731
- 95731
- 1037668
- 1037668
- https://support.apple.com/HT207482
- https://support.apple.com/HT207482
- https://support.apple.com/HT207483
- https://support.apple.com/HT207483
- https://support.apple.com/HT207485
- https://support.apple.com/HT207485
- https://support.apple.com/HT207487
- https://support.apple.com/HT207487
- 41165
- 41165
Modified: 2024-11-21
CVE-2017-2363
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
- 95728
- 95728
- 1037668
- 1037668
- GLSA-201706-15
- GLSA-201706-15
- https://support.apple.com/HT207482
- https://support.apple.com/HT207482
- https://support.apple.com/HT207484
- https://support.apple.com/HT207484
- https://support.apple.com/HT207485
- https://support.apple.com/HT207485
- https://support.apple.com/HT207487
- https://support.apple.com/HT207487
- 41449
- 41449
Modified: 2024-11-21
CVE-2017-2365
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.
Modified: 2024-11-21
CVE-2017-2369
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Modified: 2024-11-21
CVE-2017-2373
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Modified: 2024-11-21
CVE-2017-2496
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Modified: 2024-11-21
CVE-2017-2510
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with pageshow events.
Modified: 2024-11-21
CVE-2017-2538
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Modified: 2024-11-21
CVE-2017-2539
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
Modified: 2024-11-21
CVE-2017-7018
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 99885
- 99885
- 1038950
- 1038950
- GLSA-201710-14
- GLSA-201710-14
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207924
- https://support.apple.com/HT207924
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
- 42373
- 42373
Modified: 2024-11-21
CVE-2017-7030
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 99885
- 99885
- 1038950
- 1038950
- GLSA-201710-14
- GLSA-201710-14
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207924
- https://support.apple.com/HT207924
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
Modified: 2024-11-21
CVE-2017-7034
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 99885
- 99885
- 1038950
- 1038950
- GLSA-201710-14
- GLSA-201710-14
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207924
- https://support.apple.com/HT207924
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
Modified: 2024-11-21
CVE-2017-7037
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 99885
- 99885
- 1038950
- 1038950
- GLSA-201710-14
- GLSA-201710-14
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207924
- https://support.apple.com/HT207924
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
- 42378
- 42378
Modified: 2024-11-21
CVE-2017-7039
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 99885
- 99885
- 1038950
- 1038950
- GLSA-201710-14
- GLSA-201710-14
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207924
- https://support.apple.com/HT207924
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
- 42362
- 42362
Modified: 2024-11-21
CVE-2017-7046
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 99885
- 99885
- 1038950
- 1038950
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207924
- https://support.apple.com/HT207924
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
- 42365
- 42365
Modified: 2024-11-21
CVE-2017-7048
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 99885
- 99885
- 1038950
- 1038950
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207924
- https://support.apple.com/HT207924
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
- 42360
- 42360
Modified: 2024-11-21
CVE-2017-7055
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 99885
- 99885
- 1038950
- 1038950
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207924
- https://support.apple.com/HT207924
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
Modified: 2024-11-21
CVE-2017-7056
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 99885
- 99885
- 1038950
- 1038950
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207924
- https://support.apple.com/HT207924
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
- 42376
- 42376
Modified: 2024-11-21
CVE-2017-7061
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- 99885
- 99885
- 1038950
- 1038950
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207924
- https://support.apple.com/HT207924
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
- 42666
- 42666
Modified: 2024-11-21
CVE-2017-7064
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. The issue involves the "WebKit" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
- 99890
- 99890
- 1038950
- 1038950
- https://support.apple.com/HT207921
- https://support.apple.com/HT207921
- https://support.apple.com/HT207923
- https://support.apple.com/HT207923
- https://support.apple.com/HT207927
- https://support.apple.com/HT207927
- https://support.apple.com/HT207928
- https://support.apple.com/HT207928
- 42375
- 42375
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-14604
GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.
- DSA-3994
- DSA-3994
- 101012
- 101012
- RHSA-2018:0223
- RHSA-2018:0223
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860268
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860268
- https://bugzilla.gnome.org/show_bug.cgi?id=777991
- https://bugzilla.gnome.org/show_bug.cgi?id=777991
- https://github.com/freedomofpress/securedrop/issues/2238
- https://github.com/freedomofpress/securedrop/issues/2238
- https://github.com/GNOME/nautilus/commit/1630f53481f445ada0a455e9979236d31a8d3bb0
- https://github.com/GNOME/nautilus/commit/1630f53481f445ada0a455e9979236d31a8d3bb0
- https://github.com/GNOME/nautilus/commit/bc919205bf774f6af3fa7154506c46039af5a69b
- https://github.com/GNOME/nautilus/commit/bc919205bf774f6af3fa7154506c46039af5a69b
- https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/
- https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/
Closed vulnerabilities
BDU:2018-00111
Уязвимость программного средства просмотра документов Evince, связанная с непринятием мер по нейтрализации специальных элементов, позволяющая нарушителю выполнить произвольные команды
Modified: 2024-11-21
CVE-2017-1000083
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
- http://seclists.org/oss-sec/2017/q3/128
- http://seclists.org/oss-sec/2017/q3/128
- DSA-3911
- DSA-3911
- 99597
- 99597
- RHSA-2017:2388
- RHSA-2017:2388
- https://bugzilla.gnome.org/show_bug.cgi?id=784630
- https://bugzilla.gnome.org/show_bug.cgi?id=784630
- https://github.com/GNOME/evince/commit/717df38fd8509bf883b70d680c9b1b3cf36732ee
- https://github.com/GNOME/evince/commit/717df38fd8509bf883b70d680c9b1b3cf36732ee
- 45824
- 45824
- 46341
- 46341
Package gnome-shell updated to version 3.24.3-alt0.M80P.1 for branch p8 in task 187858.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-8288
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
- 98070
- 98070
- https://bugs.kali.org/view.php?id=2513
- https://bugs.kali.org/view.php?id=2513
- https://bugzilla.gnome.org/show_bug.cgi?id=781728
- https://bugzilla.gnome.org/show_bug.cgi?id=781728
- https://github.com/EasyScreenCast/EasyScreenCast/issues/46
- https://github.com/EasyScreenCast/EasyScreenCast/issues/46
- https://github.com/GNOME/gnome-shell/commit/ff425d1db7082e2755d2a405af53861552acf2a1
- https://github.com/GNOME/gnome-shell/commit/ff425d1db7082e2755d2a405af53861552acf2a1
Package libwebkitgtk2 updated to version 2.4.11-alt2.M80P.1 for branch p8 in task 187858.
Closed bugs
SIGILL, llegal instruction (i586 на P-III)
Package gnome-music updated to version 3.24.2-alt1.M80P.1 for branch p8 in task 187858.
Closed bugs
Не хватает зависимости на libmediaart2.0-gir
Closed bugs
Не запускается. gstgtk not found
Package ConsoleKit2 updated to version 1.2.0-alt1.M80P.1 for branch p8 in task 187959.
Closed bugs
Неверные Obsoletes