ALT-BU-2020-3969-13
Branch p9 update bulletin.
Package u-boot-tools updated to version 2020.07-alt1 for branch p9 in task 255613.
Closed vulnerabilities
BDU:2022-07031
Уязвимость функции do_rename_gpt_parts() (cmd/gpt.c) загрузчика U-Boot встроенных операционных систем на базе Linux, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2019-13104
In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including the whole stack) while reading a crafted ext4 filesystem.
- openSUSE-SU-2019:2233
- openSUSE-SU-2019:2233
- openSUSE-SU-2019:2235
- openSUSE-SU-2019:2235
- https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75
- https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75
- https://github.com/u-boot/u-boot/commits/master
- https://github.com/u-boot/u-boot/commits/master
- https://lists.denx.de/pipermail/u-boot/2019-July/375514.html
- https://lists.denx.de/pipermail/u-boot/2019-July/375514.html
Modified: 2024-11-21
CVE-2019-13106
Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.
- openSUSE-SU-2019:2233
- openSUSE-SU-2019:2233
- openSUSE-SU-2019:2235
- openSUSE-SU-2019:2235
- https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75
- https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75
- https://github.com/u-boot/u-boot/commits/master
- https://github.com/u-boot/u-boot/commits/master
- https://lists.denx.de/pipermail/u-boot/2019-July/375516.html
- https://lists.denx.de/pipermail/u-boot/2019-July/375516.html
Modified: 2024-11-21
CVE-2019-14192
An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an nc_input_packet call.
Modified: 2024-11-21
CVE-2019-14193
An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with an unvalidated length at nfs_readlink_reply, in the "if" block after calculating the new path length.
Modified: 2024-11-21
CVE-2019-14194
An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv2 case.
Modified: 2024-11-21
CVE-2019-14195
An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block after calculating the new path length.
Modified: 2024-11-21
CVE-2019-14196
An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_lookup_reply.
Modified: 2024-11-21
CVE-2019-14197
An issue was discovered in Das U-Boot through 2019.07. There is a read of out-of-bounds data at nfs_read_reply.
Modified: 2024-11-21
CVE-2019-14198
An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with a failed length check at nfs_read_reply when calling store_block in the NFSv3 case.
Modified: 2024-11-21
CVE-2019-14199
An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an *udp_packet_handler call.
Modified: 2024-11-21
CVE-2019-14200
An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_reply.
Modified: 2024-11-21
CVE-2019-14201
An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_reply.
Modified: 2024-11-21
CVE-2019-14202
An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_reply.
Modified: 2024-11-21
CVE-2019-14203
An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_reply.
Modified: 2024-11-21
CVE-2019-14204
An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall_reply.
Modified: 2024-11-21
CVE-2020-8432
In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identified by static analysis.
- openSUSE-SU-2020:1869
- openSUSE-SU-2020:1869
- https://www.mail-archive.com/u-boot%40lists.denx.de/msg354060.html
- https://www.mail-archive.com/u-boot%40lists.denx.de/msg354060.html
- https://www.mail-archive.com/u-boot%40lists.denx.de/msg354114.html
- https://www.mail-archive.com/u-boot%40lists.denx.de/msg354114.html
Closed bugs
Ошибка osec: getgrgid_r: No such file or directory
Closed vulnerabilities
BDU:2021-01911
Уязвимость функции phar_parse_zipfile языка программирования php, позволяющая нарушителю получить доступ к конфиденциальным данным, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-7068
In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
- https://bugs.php.net/bug.php?id=79797
- https://bugs.php.net/bug.php?id=79797
- GLSA-202009-10
- GLSA-202009-10
- https://security.netapp.com/advisory/ntap-20200918-0005/
- https://security.netapp.com/advisory/ntap-20200918-0005/
- DSA-4856
- DSA-4856
- https://www.tenable.com/security/tns-2021-14
- https://www.tenable.com/security/tns-2021-14