Branch sisyphus update bulletin.

Package fluidsynth updated to version 1.1.8-alt1.1 for branch sisyphus in task 195266.

Молчит

Package thrift updated to version 0.10.0-alt1_4jpp8 for branch sisyphus in task 195295.

Published: 2017-06-17
Modified: 2024-11-21

CVE-2015-3254

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

Published: 2018-02-12
Modified: 2024-11-21

CVE-2016-5397

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

Severity: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References:

Version: 2.1.0

Branch sisyphus update on 2017-11-24

ALT-BU-2017-3518-1

ALT-PU-2017-2691-1

Closed bugs

Bug #32137

ALT-PU-2017-2692-1

Closed vulnerabilities

CVE-2015-3254

CVE-2016-5397