ALT-BU-2020-3951-3
Branch p9 update bulletin.
Package kernel-image-std-def updated to version 5.4.54-alt1 for branch p9 in task 255521.
Closed vulnerabilities
Modified: 2025-01-29
BDU:2020-05547
Уязвимость функций expand_downwards и expand_upwards (mm/mmap.c) ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-09-13
BDU:2021-03189
Уязвимость подсистемы cgroupv2 ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или повысить свои привилегии
Modified: 2024-11-21
CVE-2020-14356
A flaw null pointer dereference in the Linux kernel cgroupv2 subsystem in versions before 5.7.10 was found in the way when reboot the system. A local user could use this flaw to crash the system or escalate their privileges on the system.
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
- https://bugzilla.kernel.org/show_bug.cgi?id=208003
- https://bugzilla.redhat.com/show_bug.cgi?id=1868453
- https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
- https://lore.kernel.org/netdev/CAM_iQpUKQJrj8wE+Qa8NGR3P0L+5Uz=qo-O5+k_P60HzTde6aw%40mail.gmail.com/t/
- https://security.netapp.com/advisory/ntap-20200904-0002/
- https://usn.ubuntu.com/4483-1/
- https://usn.ubuntu.com/4484-1/
- https://usn.ubuntu.com/4526-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00047.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
- https://bugzilla.kernel.org/show_bug.cgi?id=208003
- https://bugzilla.redhat.com/show_bug.cgi?id=1868453
- https://lists.debian.org/debian-lts-announce/2020/09/msg00025.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00032.html
- https://lists.debian.org/debian-lts-announce/2020/10/msg00034.html
- https://lore.kernel.org/netdev/CAM_iQpUKQJrj8wE+Qa8NGR3P0L+5Uz=qo-O5+k_P60HzTde6aw%40mail.gmail.com/t/
- https://security.netapp.com/advisory/ntap-20200904-0002/
- https://usn.ubuntu.com/4483-1/
- https://usn.ubuntu.com/4484-1/
- https://usn.ubuntu.com/4526-1/
Modified: 2024-11-21
CVE-2020-29369
An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call, aka CID-246c320a8cfe.
- http://www.openwall.com/lists/oss-security/2021/02/10/6
- http://www.openwall.com/lists/oss-security/2021/02/19/8
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2056
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.11
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=246c320a8cfe0b11d81a4af38fa9985ef0cc9a4c
- https://security.netapp.com/advisory/ntap-20210115-0001/
- http://www.openwall.com/lists/oss-security/2021/02/10/6
- http://www.openwall.com/lists/oss-security/2021/02/19/8
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2056
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.11
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=246c320a8cfe0b11d81a4af38fa9985ef0cc9a4c
- https://security.netapp.com/advisory/ntap-20210115-0001/
Closed vulnerabilities
Modified: 2024-09-16
BDU:2021-01430
Уязвимость реализации протокола WebUSB браузера Google Chrome, связанная с использованием области памяти после её освобождения, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-09-16
BDU:2021-01459
Уязвимость компонента CSS браузера Google Chrome, связанная с использованием области памяти после её освобождения, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-09-16
BDU:2021-01460
Уязвимость обработчика JavaScript-сценариев V8 браузера Google Chrome, связанная с доступом к данным без контроля типов, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-09-16
BDU:2021-01462
Уязвимость реализации протокола управления передачей потока (SCTP) браузера Google Chrome, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-09-16
BDU:2021-01503
Уязвимость графической библиотеки Skia браузера Google Chrome, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-09-16
BDU:2022-00069
Уязвимость компонента для отображения веб-страниц WebView браузера Google Chrome, позволяющая нарушителю обойти существующие ограничения безопасности
Modified: 2024-11-21
CVE-2020-16046
Script injection in iOSWeb in Google Chrome on iOS prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Modified: 2024-11-21
CVE-2020-6532
Use after free in SCTP in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1104061
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1104061
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
Modified: 2024-11-21
CVE-2020-6537
Type confusion in V8 in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1105318
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://www.debian.org/security/2021/dsa-4824
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1105318
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://www.debian.org/security/2021/dsa-4824
Modified: 2024-11-21
CVE-2020-6538
Inappropriate implementation in WebView in Google Chrome on Android prior to 84.0.4147.105 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1096677
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://www.debian.org/security/2021/dsa-4824
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1096677
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://www.debian.org/security/2021/dsa-4824
Modified: 2024-11-21
CVE-2020-6539
Use after free in CSS in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1105635
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://www.debian.org/security/2021/dsa-4824
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1105635
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://www.debian.org/security/2021/dsa-4824
Modified: 2024-11-21
CVE-2020-6540
Buffer overflow in Skia in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1105720
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1105720
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
Modified: 2024-11-21
CVE-2020-6541
Use after free in WebUSB in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- http://packetstormsecurity.com/files/159610/Chrome-USB-OnServiceConnectionError-Use-After-Free.html
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1106773
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
- http://packetstormsecurity.com/files/159610/Chrome-USB-OnServiceConnectionError-Use-After-Free.html
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop_27.html
- https://crbug.com/1106773
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EE7XWIZBME7JAY7N6CGPET4CLNHHEIVT/
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
Closed bugs
Сервис firebird не запускается после перезагрузки системы