ALT-BU-2017-3569-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2018-6797
An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.
- 1040681
- 1040681
- 1042004
- 1042004
- RHSA-2018:1192
- RHSA-2018:1192
- https://rt.perl.org/Public/Bug/Display.html?id=132227
- https://rt.perl.org/Public/Bug/Display.html?id=132227
- GLSA-201909-01
- GLSA-201909-01
- USN-3625-1
- USN-3625-1
- DSA-4172
- DSA-4172
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
Modified: 2024-11-21
CVE-2018-6798
An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.
- 1040681
- 1040681
- RHSA-2018:1192
- RHSA-2018:1192
- https://rt.perl.org/Public/Bug/Display.html?id=132063
- https://rt.perl.org/Public/Bug/Display.html?id=132063
- GLSA-201909-01
- GLSA-201909-01
- USN-3625-1
- USN-3625-1
- DSA-4172
- DSA-4172
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
Closed vulnerabilities
BDU:2018-01485
Уязвимость библиотеки International Components for Unicode, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
Modified: 2024-11-21
CVE-2017-15407
Out-of-bounds Write in the QUIC networking stack in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to gain code execution via a malicious server.
Modified: 2024-11-21
CVE-2017-15408
Heap buffer overflow in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file that is mishandled by PDFium.
Modified: 2024-11-21
CVE-2017-15409
Heap buffer overflow in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Modified: 2024-11-21
CVE-2017-15410
Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Modified: 2024-11-21
CVE-2017-15411
Use after free in PDFium in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Modified: 2024-11-21
CVE-2017-15412
Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 1040348
- 1040348
- RHSA-2017:3401
- RHSA-2017:3401
- RHSA-2018:0287
- RHSA-2018:0287
- https://bugzilla.gnome.org/show_bug.cgi?id=783160
- https://bugzilla.gnome.org/show_bug.cgi?id=783160
- https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
- https://crbug.com/727039
- https://crbug.com/727039
- [debian-lts-announce] 20171218 [SECURITY] [DLA 1211-1] libxml2 security update
- [debian-lts-announce] 20171218 [SECURITY] [DLA 1211-1] libxml2 security update
- GLSA-201801-03
- GLSA-201801-03
- DSA-4086
- DSA-4086
Modified: 2024-11-21
CVE-2017-15413
Type confusion in WebAssembly in V8 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Modified: 2024-11-21
CVE-2017-15415
Incorrect serialization in IPC in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the value of a pointer via a crafted HTML page.
Modified: 2024-11-21
CVE-2017-15416
Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read.
Modified: 2024-11-21
CVE-2017-15417
Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Modified: 2024-11-21
CVE-2017-15418
Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Modified: 2024-11-21
CVE-2017-15419
Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing history by triggering a leaked cross-origin URL via a crafted HTML page.
Modified: 2024-11-21
CVE-2017-15420
Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
- 1040282
- 1040282
- RHSA-2017:3401
- RHSA-2017:3401
- https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
- https://crbug.com/777419
- https://crbug.com/777419
- GLSA-201801-03
- GLSA-201801-03
- DSA-4064
- DSA-4064
- DSA-4103
- DSA-4103
Modified: 2024-11-21
CVE-2017-15422
Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- RHSA-2017:3401
- RHSA-2017:3401
- https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
- https://crbug.com/774382
- https://crbug.com/774382
- GLSA-201801-03
- GLSA-201801-03
- USN-3610-1
- USN-3610-1
- DSA-4150
- DSA-4150
Modified: 2024-11-21
CVE-2017-15423
Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bits of SHA512(password) by inspecting protocol traffic.
Modified: 2024-11-21
CVE-2017-15424
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Modified: 2024-11-21
CVE-2017-15425
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Modified: 2024-11-21
CVE-2017-15426
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Modified: 2024-11-21
CVE-2017-15427
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by dragging and dropping a javascript: URL into the URL bar.
Modified: 2024-11-21
CVE-2017-15428
Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior to 62.0.3202.94 and allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Modified: 2024-11-21
CVE-2017-15429
Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.
- 102196
- 102196
- RHSA-2017:3479
- RHSA-2017:3479
- https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html
- https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop_14.html
- https://crbug.com/788453
- https://crbug.com/788453
- GLSA-201801-03
- GLSA-201801-03
- DSA-4103
- DSA-4103
Modified: 2024-11-21
CVE-2017-15430
Insufficient data validation in Chromecast plugin in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.