2020-05-26
ALT-BU-2020-3832-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Published: 2022-01-17
Modified: 2024-09-16
Modified: 2024-09-16
BDU:2022-00277
Уязвимость программы для анализа трафика wireshark, связанная с неконтролируемой рекурсией, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM (5.0)
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
References:
Published: 2020-05-19
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-13164
In Wireshark 3.2.0 to 3.2.3, 3.0.0 to 3.0.10, and 2.6.0 to 2.6.16, the NFS dissector could crash. This was addressed in epan/dissectors/packet-nfs.c by preventing excessive recursion, such as for a cycle in the directory graph on a filesystem.
Severity: MEDIUM (5.0)
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00038.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16476
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=e6e98eab8e5e0bbc982cfdc808f2469d7cab6c5a
- https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5UOISPQTRCZGQLKBVXEDL72AEXEHS425/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNV3EYL4JBWCR22TJO3PH7ADUVS5RWSU/
- https://security.gentoo.org/glsa/202007-13
- https://www.wireshark.org/security/wnpa-sec-2020-08.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00038.html
- https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16476
- https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=e6e98eab8e5e0bbc982cfdc808f2469d7cab6c5a
- https://lists.debian.org/debian-lts-announce/2021/02/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5UOISPQTRCZGQLKBVXEDL72AEXEHS425/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DNV3EYL4JBWCR22TJO3PH7ADUVS5RWSU/
- https://security.gentoo.org/glsa/202007-13
- https://www.wireshark.org/security/wnpa-sec-2020-08.html
Closed vulnerabilities
Published: 2020-06-19
Modified: 2024-11-07
Modified: 2024-11-07
BDU:2020-02828
Уязвимость функции cbs_jpeg_split_fragment мультимедийной библиотеки Ffmpeg, позволяющая нарушителю вызвать отказ в обслуживании
Severity: CRITICAL (9.8)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL (10.0)
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
References:
Published: 2019-07-05
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2019-13312
block_cmp() in libavcodec/zmbvenc.c in FFmpeg 4.1.3 has a heap-based buffer over-read.
Severity: MEDIUM (6.8)
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Severity: HIGH (8.8)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- https://security.gentoo.org/glsa/202003-65
- https://security.gentoo.org/glsa/202007-58
- https://trac.ffmpeg.org/ticket/7980
- https://usn.ubuntu.com/4431-1/
- https://security.gentoo.org/glsa/202003-65
- https://security.gentoo.org/glsa/202007-58
- https://trac.ffmpeg.org/ticket/7980
- https://usn.ubuntu.com/4431-1/
Published: 2020-04-28
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-12284
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.1 and 4.2.2 has a heap-based buffer overflow during JPEG_MARKER_SOS handling because of a missing length check.
Severity: CRITICAL (10.0)
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Severity: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19734
- https://github.com/FFmpeg/FFmpeg/commit/1812352d767ccf5431aa440123e2e260a4db2726
- https://github.com/FFmpeg/FFmpeg/commit/a3a3730b5456ca00587455004d40c047f7b20a99
- https://security.gentoo.org/glsa/202007-58
- https://usn.ubuntu.com/4431-1/
- https://www.debian.org/security/2020/dsa-4722
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19734
- https://github.com/FFmpeg/FFmpeg/commit/1812352d767ccf5431aa440123e2e260a4db2726
- https://github.com/FFmpeg/FFmpeg/commit/a3a3730b5456ca00587455004d40c047f7b20a99
- https://security.gentoo.org/glsa/202007-58
- https://usn.ubuntu.com/4431-1/
- https://www.debian.org/security/2020/dsa-4722