ALT-BU-2018-3504-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-12652
libpng before 1.6.32 does not properly check the length of chunks against the user limit.
- 109269
- 109269
- https://github.com/glennrp/libpng/blob/df7e9dae0c4aac63d55361e35709c864fa1b8363/ANNOUNCE
- https://github.com/glennrp/libpng/blob/df7e9dae0c4aac63d55361e35709c864fa1b8363/ANNOUNCE
- https://security.netapp.com/advisory/ntap-20220506-0003/
- https://security.netapp.com/advisory/ntap-20220506-0003/
- https://support.f5.com/csp/article/K88124225
- https://support.f5.com/csp/article/K88124225
- https://support.f5.com/csp/article/K88124225?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K88124225?utm_source=f5support&%3Butm_medium=RSS
Modified: 2024-11-21
CVE-2018-13785
In libpng 1.6.34, a wrong calculation of row_factor in the png_check_chunk_length function (pngrutil.c) may trigger an integer overflow and resultant divide-by-zero while processing a crafted PNG file, leading to a denial of service.
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- 105599
- 105599
- 1041889
- 1041889
- RHSA-2018:3000
- RHSA-2018:3000
- RHSA-2018:3001
- RHSA-2018:3001
- RHSA-2018:3002
- RHSA-2018:3002
- RHSA-2018:3003
- RHSA-2018:3003
- RHSA-2018:3007
- RHSA-2018:3007
- RHSA-2018:3008
- RHSA-2018:3008
- RHSA-2018:3533
- RHSA-2018:3533
- RHSA-2018:3534
- RHSA-2018:3534
- RHSA-2018:3671
- RHSA-2018:3671
- RHSA-2018:3672
- RHSA-2018:3672
- RHSA-2018:3779
- RHSA-2018:3779
- RHSA-2018:3852
- RHSA-2018:3852
- https://github.com/glennrp/libpng/commit/8a05766cb74af05c04c53e6c9d60c13fc4d59bf2
- https://github.com/glennrp/libpng/commit/8a05766cb74af05c04c53e6c9d60c13fc4d59bf2
- GLSA-201908-10
- GLSA-201908-10
- https://security.netapp.com/advisory/ntap-20181018-0001/
- https://security.netapp.com/advisory/ntap-20181018-0001/
- https://sourceforge.net/p/libpng/bugs/278/
- https://sourceforge.net/p/libpng/bugs/278/
- USN-3712-1
- USN-3712-1
Modified: 2024-11-21
CVE-2018-14048
An issue has been found in libpng 1.6.34. It is a SEGV in the function png_free_data in png.c, related to the recommended error handling for png_read_image.
- http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html
- http://packetstormsecurity.com/files/152561/Slackware-Security-Advisory-libpng-Updates.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://github.com/fouzhe/security/tree/master/libpng
- https://github.com/fouzhe/security/tree/master/libpng
- https://github.com/glennrp/libpng/issues/238
- https://github.com/glennrp/libpng/issues/238
- 20190417 [slackware-security] libpng (SSA:2019-107-01)
- 20190417 [slackware-security] libpng (SSA:2019-107-01)
- GLSA-201908-02
- GLSA-201908-02
Closed vulnerabilities
BDU:2019-00431
Уязвимость функции XListExtensions библиотеки предоставления клиентского API для X Window System libX11, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-04258
Уязвимость функциях XListExtensions библиотеки предоставления клиентского API для X Window System libX11, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
BDU:2019-04314
Уязвимость функции XListExtensions (ListExt.c) библиотеки предоставления клиентского API для X Window System libX11, позволяющая нарушителю позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2018-14598
An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault).
- [oss-security] 20180821 X.Org security advisory: August 21, 2018
- 105177
- 1041543
- RHSA-2019:2079
- https://bugzilla.suse.com/show_bug.cgi?id=1102073
- https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=e83722768fd5c467ef61fa159e8c6278770b45c2
- [debian-lts-announce] 20180829 [SECURITY] [DLA 1482-1] libx11 security update
- FEDORA-2019-6a756fe3a5
- [xorg-announce] 20180821 libX11 1.6.6
- GLSA-201811-01
- USN-3758-1
- USN-3758-2
- [oss-security] 20180821 X.Org security advisory: August 21, 2018
- USN-3758-2
- USN-3758-1
- GLSA-201811-01
- [xorg-announce] 20180821 libX11 1.6.6
- FEDORA-2019-6a756fe3a5
- [debian-lts-announce] 20180829 [SECURITY] [DLA 1482-1] libx11 security update
- https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=e83722768fd5c467ef61fa159e8c6278770b45c2
- https://bugzilla.suse.com/show_bug.cgi?id=1102073
- RHSA-2019:2079
- 1041543
- 105177
Modified: 2024-11-21
CVE-2018-14599
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact.
- [oss-security] 20180821 X.Org security advisory: August 21, 2018
- 105177
- 1041543
- RHSA-2019:2079
- https://bugzilla.suse.com/show_bug.cgi?id=1102062
- https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=b469da1430cdcee06e31c6251b83aede072a1ff0
- [debian-lts-announce] 20180829 [SECURITY] [DLA 1482-1] libx11 security update
- FEDORA-2019-6a756fe3a5
- [xorg-announce] 20180821 libX11 1.6.6
- GLSA-201811-01
- USN-3758-1
- USN-3758-2
- [oss-security] 20180821 X.Org security advisory: August 21, 2018
- USN-3758-2
- USN-3758-1
- GLSA-201811-01
- [xorg-announce] 20180821 libX11 1.6.6
- FEDORA-2019-6a756fe3a5
- [debian-lts-announce] 20180829 [SECURITY] [DLA 1482-1] libx11 security update
- https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=b469da1430cdcee06e31c6251b83aede072a1ff0
- https://bugzilla.suse.com/show_bug.cgi?id=1102062
- RHSA-2019:2079
- 1041543
- 105177
Modified: 2024-11-21
CVE-2018-14600
An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution.
- [oss-security] 20180821 X.Org security advisory: August 21, 2018
- 105177
- 1041543
- RHSA-2019:2079
- https://bugzilla.suse.com/show_bug.cgi?id=1102068
- https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=dbf72805fd9d7b1846fe9a11b46f3994bfc27fea
- [debian-lts-announce] 20180829 [SECURITY] [DLA 1482-1] libx11 security update
- [xorg-announce] 20180821 libX11 1.6.6
- GLSA-201811-01
- USN-3758-1
- USN-3758-2
- [oss-security] 20180821 X.Org security advisory: August 21, 2018
- USN-3758-2
- USN-3758-1
- GLSA-201811-01
- [xorg-announce] 20180821 libX11 1.6.6
- [debian-lts-announce] 20180829 [SECURITY] [DLA 1482-1] libx11 security update
- https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=dbf72805fd9d7b1846fe9a11b46f3994bfc27fea
- https://bugzilla.suse.com/show_bug.cgi?id=1102068
- RHSA-2019:2079
- 1041543
- 105177
Closed bugs
Рассмотреть вопрос об обновлении gnutls до версии 3.6.3 с поддержкой ГОСТ-овой криптографии