ALT-BU-2018-3619-2
Branch sisyphus update bulletin.
Closed bugs
Сломалась сборка
Closed bugs
Прошу собрать новую версию gwibber
Closed bugs
Сломалась сборка
Closed vulnerabilities
BDU:2019-00923
Уязвимость LBMPDM диссектора анализатора трафика компьютерных сетей Wireshark, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-00924
Уязвимость MMSE диссектора анализатора трафика компьютерных сетей Wireshark, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-00959
Уязвимость компонента IxVeriWave анализатора трафика компьютерных сетей Wireshark, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-01272
Уязвимость программы-анализатора трафика Wireshark, связанная с чтением за пределами границ в памяти, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2019-01273
Уязвимость программы-анализатора трафика Wireshark, связанная с чтением за пределами границ в памяти, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2018-19622
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop. This was addressed in epan/dissectors/packet-mmse.c by preventing length overflows.
- openSUSE-SU-2020:0362
- openSUSE-SU-2020:0362
- 106051
- 106051
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15250
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15250
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=3b7555d32d11862f0e500ec466ad6bfe54190076
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=3b7555d32d11862f0e500ec466ad6bfe54190076
- [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
- [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
- DSA-4359
- DSA-4359
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.wireshark.org/security/wnpa-sec-2018-54.html
- https://www.wireshark.org/security/wnpa-sec-2018-54.html
Modified: 2024-11-21
CVE-2018-19623
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the LBMPDM dissector could crash. In addition, a remote attacker could write arbitrary data to any memory locations before the packet-scoped memory. This was addressed in epan/dissectors/packet-lbmpdm.c by disallowing certain negative values.
- openSUSE-SU-2020:0362
- openSUSE-SU-2020:0362
- 106051
- 106051
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15132
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15132
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=9c8645ec7b28e4d7193962ecd2a418613bf6a84f
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=9c8645ec7b28e4d7193962ecd2a418613bf6a84f
- [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
- [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
- DSA-4359
- DSA-4359
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.wireshark.org/security/wnpa-sec-2018-53.html
- https://www.wireshark.org/security/wnpa-sec-2018-53.html
Modified: 2024-11-21
CVE-2018-19624
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the PVFS dissector could crash. This was addressed in epan/dissectors/packet-pvfs2.c by preventing a NULL pointer dereference.
- openSUSE-SU-2020:0362
- openSUSE-SU-2020:0362
- 106051
- 106051
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15280
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15280
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=3e319db1107b08fc3be804b6d449143ec9aa0dec
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=3e319db1107b08fc3be804b6d449143ec9aa0dec
- [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
- [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
- DSA-4359
- DSA-4359
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.wireshark.org/security/wnpa-sec-2018-56.html
- https://www.wireshark.org/security/wnpa-sec-2018-56.html
Modified: 2024-11-21
CVE-2018-19625
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the dissection engine could crash. This was addressed in epan/tvbuff_composite.c by preventing a heap-based buffer over-read.
- openSUSE-SU-2020:0362
- openSUSE-SU-2020:0362
- 106051
- 106051
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14466
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14466
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=dc4d209f39132a4ae05675a11609176ae9705cfc
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=dc4d209f39132a4ae05675a11609176ae9705cfc
- [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
- [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
- DSA-4359
- DSA-4359
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.wireshark.org/security/wnpa-sec-2018-51.html
- https://www.wireshark.org/security/wnpa-sec-2018-51.html
Modified: 2024-11-21
CVE-2018-19626
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by adding '\0' termination.
- openSUSE-SU-2020:0362
- openSUSE-SU-2020:0362
- 106051
- 106051
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15130
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15130
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=c5a65115ebab55cfd5ce0a855c2256e01cab6449
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=c5a65115ebab55cfd5ce0a855c2256e01cab6449
- [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
- [debian-lts-announce] 20190115 [SECURITY] [DLA 1634-1] wireshark security update
- DSA-4359
- DSA-4359
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.wireshark.org/security/wnpa-sec-2018-52.html
- https://www.wireshark.org/security/wnpa-sec-2018-52.html
Modified: 2024-11-21
CVE-2018-19627
In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by adjusting a buffer boundary.
- openSUSE-SU-2020:0362
- openSUSE-SU-2020:0362
- 106051
- 106051
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15279
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15279
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=bdc33cfaecb1b4cf2c114ed9015713ddf8569a60
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=bdc33cfaecb1b4cf2c114ed9015713ddf8569a60
- DSA-4359
- DSA-4359
- 45951
- 45951
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.wireshark.org/security/wnpa-sec-2018-55.html
- https://www.wireshark.org/security/wnpa-sec-2018-55.html
Modified: 2024-11-21
CVE-2018-19628
In Wireshark 2.6.0 to 2.6.4, the ZigBee ZCL dissector could crash. This was addressed in epan/dissectors/packet-zbee-zcl-lighting.c by preventing a divide-by-zero error.
- openSUSE-SU-2020:0362
- openSUSE-SU-2020:0362
- 106051
- 106051
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15281
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15281
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=212b18825d9b668cda23d334c48867dfa66b2b36
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=212b18825d9b668cda23d334c48867dfa66b2b36
- DSA-4359
- DSA-4359
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.wireshark.org/security/wnpa-sec-2018-57.html
- https://www.wireshark.org/security/wnpa-sec-2018-57.html
Closed bugs
отсутствует devel пакет
Closed vulnerabilities
Modified: 2024-11-21
CVE-2018-1000115
Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.
- RHBA-2018:2140
- RHBA-2018:2140
- RHSA-2018:1593
- RHSA-2018:1593
- RHSA-2018:1627
- RHSA-2018:1627
- RHSA-2018:2331
- RHSA-2018:2331
- RHSA-2018:2857
- RHSA-2018:2857
- https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html
- https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html
- https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974
- https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974
- https://github.com/memcached/memcached/issues/348
- https://github.com/memcached/memcached/issues/348
- https://github.com/memcached/memcached/wiki/ReleaseNotes156
- https://github.com/memcached/memcached/wiki/ReleaseNotes156
- https://twitter.com/dormando/status/968579781729009664
- https://twitter.com/dormando/status/968579781729009664
- USN-3588-1
- USN-3588-1
- DSA-4218
- DSA-4218
- 44264
- 44264
- 44265
- 44265
- https://www.synology.com/support/security/Synology_SA_18_07
- https://www.synology.com/support/security/Synology_SA_18_07
Closed vulnerabilities
Modified: 2024-11-21
CVE-2018-11210
TinyXML2 6.2.0 has a heap-based buffer over-read in the XMLDocument::Parse function in libtinyxml2.so. NOTE: The tinyxml2 developers have determined that the reported overflow is due to improper use of the library and not a vulnerability in tinyxml2
- https://github.com/leethomason/tinyxml2/issues/675
- https://github.com/leethomason/tinyxml2/issues/675
- https://github.com/leethomason/tinyxml2/issues/675#issuecomment-439933437
- https://github.com/leethomason/tinyxml2/issues/675#issuecomment-439933437
- https://github.com/leethomason/tinyxml2/issues/675#issuecomment-462194018
- https://github.com/leethomason/tinyxml2/issues/675#issuecomment-462194018