ALT-BU-2018-3283-1
Branch sisyphus update bulletin.
Package kernel-image-un-def updated to version 4.16.12-alt1 for branch sisyphus in task 207339.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2018-11412
In the Linux kernel 4.13 through 4.16.11, ext4_read_inline_data() in fs/ext4/inline.c performs a memcpy with an untrusted length value in certain circumstances involving a crafted filesystem that stores the system.data extended attribute value in a dedicated inode.
- 104291
- 104291
- RHSA-2019:0525
- RHSA-2019:0525
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1580
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1580
- https://bugzilla.kernel.org/show_bug.cgi?id=199803
- https://bugzilla.kernel.org/show_bug.cgi?id=199803
- USN-3752-1
- USN-3752-1
- USN-3752-2
- USN-3752-2
- USN-3752-3
- USN-3752-3
- 44832
- 44832
Modified: 2024-11-21
CVE-2018-5814
In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4.133, multiple race condition errors when handling probe, disconnect, and rebind operations can be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets.
- openSUSE-SU-2019:1407
- openSUSE-SU-2019:1407
- 1041050
- 1041050
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.43
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.43
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.11
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.16.11
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.133
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.133
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.102
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.102
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=22076557b07c12086eeb16b8ce2b0b735f7a27e7
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=22076557b07c12086eeb16b8ce2b0b735f7a27e7
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=c171654caa875919be3c533d3518da8be5be966e
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?id=c171654caa875919be3c533d3518da8be5be966e
- [debian-lts-announce] 20180714 [SECURITY] [DLA 1422-1] linux security update
- [debian-lts-announce] 20180714 [SECURITY] [DLA 1422-1] linux security update
- [debian-lts-announce] 20180715 [SECURITY] [DLA 1422-2] linux security update
- [debian-lts-announce] 20180715 [SECURITY] [DLA 1422-2] linux security update
- [debian-lts-announce] 20180718 [SECURITY] [DLA 1423-1] linux-4.9 new package
- [debian-lts-announce] 20180718 [SECURITY] [DLA 1423-1] linux-4.9 new package
- 81540
- 81540
- https://secuniaresearch.flexerasoftware.com/secunia_research/2018-8/
- https://secuniaresearch.flexerasoftware.com/secunia_research/2018-8/
- USN-3696-1
- USN-3696-1
- USN-3696-2
- USN-3696-2
- USN-3752-1
- USN-3752-1
- USN-3752-2
- USN-3752-2
- USN-3752-3
- USN-3752-3
Closed bugs
dblatex: new version
Closed vulnerabilities
BDU:2019-04280
Уязвимость реализации класса FileSessionDataStore HTTP-сервера Jetty, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Modified: 2024-11-21
CVE-2018-12538
In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
- 1041194
- 1041194
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=536018
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Closed vulnerabilities
Modified: 2024-11-21
CVE-2016-5407
The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.
- [oss-security] 20161004 X.Org security advisory: Protocol handling issues in X Window System client libraries
- [oss-security] 20161004 X.Org security advisory: Protocol handling issues in X Window System client libraries
- [oss-security] 20161004 Re: X.Org security advisory: Protocol handling issues in X Window System client libraries
- [oss-security] 20161004 Re: X.Org security advisory: Protocol handling issues in X Window System client libraries
- 93368
- 93368
- 1036945
- 1036945
- https://cgit.freedesktop.org/xorg/lib/libXv/commit/?id=d9da580b46a28ab497de2e94fdc7b9ff953dab17
- https://cgit.freedesktop.org/xorg/lib/libXv/commit/?id=d9da580b46a28ab497de2e94fdc7b9ff953dab17
- FEDORA-2016-f71cc44cf8
- FEDORA-2016-f71cc44cf8
- FEDORA-2016-5aa206bd16
- FEDORA-2016-5aa206bd16
- [xorg-announce] 20161004 X.Org security advisory: Protocol handling issues in X Window System client libraries
- [xorg-announce] 20161004 X.Org security advisory: Protocol handling issues in X Window System client libraries
- GLSA-201704-03
- GLSA-201704-03
Closed vulnerabilities
Modified: 2024-11-21
CVE-2016-7953
Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.
- [oss-security] 20161004 X.Org security advisory: Protocol handling issues in X Window System client libraries
- [oss-security] 20161004 X.Org security advisory: Protocol handling issues in X Window System client libraries
- [oss-security] 20161004 Re: X.Org security advisory: Protocol handling issues in X Window System client libraries
- [oss-security] 20161004 Re: X.Org security advisory: Protocol handling issues in X Window System client libraries
- 93371
- 93371
- 1036945
- 1036945
- https://cgit.freedesktop.org/xorg/lib/libXvMC/commit/?id=2cd95e7da8367cccdcdd5c9b160012d1dec5cbdb
- https://cgit.freedesktop.org/xorg/lib/libXvMC/commit/?id=2cd95e7da8367cccdcdd5c9b160012d1dec5cbdb
- FEDORA-2016-a236cb3315
- FEDORA-2016-a236cb3315
- FEDORA-2016-37b9932690
- FEDORA-2016-37b9932690
- [xorg-announce] 20161004 X.Org security advisory: Protocol handling issues in X Window System client libraries
- [xorg-announce] 20161004 X.Org security advisory: Protocol handling issues in X Window System client libraries
- GLSA-201704-03
- GLSA-201704-03
Package ImageMagick updated to version 6.9.9.47-alt1 for branch sisyphus in task 206803.
Closed vulnerabilities
BDU:2021-03345
Уязвимость функции ReadOneJNGImage компонента coders/png.c консольного графического редактора ImageMagick, связанная с разыменованием нулевого указателя, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2018-16749
In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file.
- https://github.com/ImageMagick/ImageMagick/issues/1119
- https://github.com/ImageMagick/ImageMagick/issues/1119
- https://github.com/ImageMagick/ImageMagick6/commit/1007b98f8795ad4bea6bc5f68a32d83e982fdae4
- https://github.com/ImageMagick/ImageMagick6/commit/1007b98f8795ad4bea6bc5f68a32d83e982fdae4
- [debian-lts-announce] 20181003 [SECURITY] [DLA 1530-1] imagemagick security update
- [debian-lts-announce] 20181003 [SECURITY] [DLA 1530-1] imagemagick security update
- [debian-lts-announce] 20200907 [SECURITY] [DLA 2366-1] imagemagick security update
- [debian-lts-announce] 20200907 [SECURITY] [DLA 2366-1] imagemagick security update
- USN-3785-1
- USN-3785-1
Modified: 2024-11-21
CVE-2018-16750
In ImageMagick 7.0.7-29 and earlier, a memory leak in the formatIPTCfromBuffer function in coders/meta.c was found.
Closed bugs
Обновить leocad до актуальной версии 18.01