ALT-BU-2019-3596-1
Branch sisyphus update bulletin.
Package automake_1.14 updated to version 1.14.1-alt5 for branch sisyphus in task 226896.
Closed bugs
Не обновляется с файловым конфликтом
Closed bugs
Сломалась сборка libpeas
Package rpm-build-ruby updated to version 1.0.0-alt6 for branch sisyphus in task 226864.
Closed bugs
/usr/lib/rpm/ruby.prov: line 13: cd: too many arguments (rpm-build-ruby некорректно работает вне hasher)
Package util-linux updated to version 2.33.1-alt1 for branch sisyphus in task 226906.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-2616
A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.
- RHSA-2017:0654
- RHSA-2017:0654
- 96404
- 96404
- 1038271
- 1038271
- RHSA-2017:0907
- RHSA-2017:0907
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2616
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2616
- https://github.com/karelzak/util-linux/commit/dffab154d29a288aa171ff50263ecc8f2e14a891
- https://github.com/karelzak/util-linux/commit/dffab154d29a288aa171ff50263ecc8f2e14a891
- GLSA-201706-02
- GLSA-201706-02
- DSA-3793
- DSA-3793
Package libjpeg-turbo updated to version 1.5.3-alt1 for branch sisyphus in task 226932.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9614
The fill_input_buffer function in jdatasrc.c in libjpeg-turbo 1.5.1 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted jpg file. NOTE: Maintainer asserts the issue is due to a bug in downstream code caused by misuse of the libjpeg API
- http://packetstormsecurity.com/files/143518/libjpeg-turbo-1.5.1-Denial-Of-Service.html
- http://packetstormsecurity.com/files/143518/libjpeg-turbo-1.5.1-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2017/Jul/66
- http://seclists.org/fulldisclosure/2017/Jul/66
- 20170726 libjpeg-turbo denial of service vulnerability
- 20170726 libjpeg-turbo denial of service vulnerability
- https://github.com/libjpeg-turbo/libjpeg-turbo/issues/167
- https://github.com/libjpeg-turbo/libjpeg-turbo/issues/167
- 42391
- 42391
Closed vulnerabilities
BDU:2020-01407
Уязвимость функции xsltNumberFormatGetMultipleLevel библиотеки для анализа XML-документов libxslt, связанная с доступом к ресурсу через несовместимые типы, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2019-5815
Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.
- https://bugs.chromium.org/p/chromium/issues/detail?id=930663
- https://bugs.chromium.org/p/chromium/issues/detail?id=930663
- https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b
- https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b
- [debian-lts-announce] 20220909 [SECURITY] [DLA 3101-1] libxslt security update
- [debian-lts-announce] 20220909 [SECURITY] [DLA 3101-1] libxslt security update
Closed bugs
libxslt необходимо обновить
Closed vulnerabilities
Modified: 2024-11-21
CVE-2019-13240
An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address.
- https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7
- https://github.com/glpi-project/glpi/commit/5da9f99b2d81713b1e36016b47ce656a33648bc7
- https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6
- https://github.com/glpi-project/glpi/commit/86a43ae47b3dd844947f40a2ffcf1a36e53dbba6
- https://github.com/glpi-project/glpi/compare/1783b78...8e621f6
- https://github.com/glpi-project/glpi/compare/1783b78...8e621f6
- https://github.com/glpi-project/glpi/releases/tag/9.4.1
- https://github.com/glpi-project/glpi/releases/tag/9.4.1
- https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdf
- https://www.synacktiv.com/ressources/advisories/GLPI_9.4.0_unsafe_reset.pdf
Package alternatives updated to version 0.5.1-alt1 for branch sisyphus in task 226946.
Closed bugs
отсутствует /usr/sbin/update-alternatives
Closed bugs
Обновить freecad