ALT-BU-2020-4136-1
Branch p9 update bulletin.
Package kernel-image-std-debug updated to version 5.4.76-alt1 for branch p9 in task 261485.
Closed vulnerabilities
BDU:2020-05831
Уязвимость ядра операционной системы Linux, связанная с использованием памяти после её освобождения, позволяющая нарушителю раскрыть защищаемую информацию
Modified: 2024-11-21
CVE-2020-25656
A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.
- https://bugzilla.redhat.com/show_bug.cgi?id=1888726
- https://bugzilla.redhat.com/show_bug.cgi?id=1888726
- [debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update
- [debian-lts-announce] 20201210 [SECURITY] [DLA 2483-1] linux-4.19 security update
- [debian-lts-announce] 20201218 [SECURITY] [DLA 2494-1] linux security update
- [debian-lts-announce] 20201218 [SECURITY] [DLA 2494-1] linux security update
- https://lkml.org/lkml/2020/10/16/84
- https://lkml.org/lkml/2020/10/16/84
- https://lkml.org/lkml/2020/10/29/528
- https://lkml.org/lkml/2020/10/29/528
- https://www.starwindsoftware.com/security/sw-20210325-0006/
- https://www.starwindsoftware.com/security/sw-20210325-0006/
Closed vulnerabilities
Modified: 2024-11-21
CVE-2020-27347
In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.
- https://github.com/tmux/tmux/commit/a868bacb46e3c900530bed47a1c6f85b0fbe701c
- https://github.com/tmux/tmux/commit/a868bacb46e3c900530bed47a1c6f85b0fbe701c
- https://raw.githubusercontent.com/tmux/tmux/3.1c/CHANGES
- https://raw.githubusercontent.com/tmux/tmux/3.1c/CHANGES
- GLSA-202011-10
- GLSA-202011-10
- https://www.openwall.com/lists/oss-security/2020/11/05/3
- https://www.openwall.com/lists/oss-security/2020/11/05/3
Closed bugs
Вылет на экран авторизации при смене доменного пароля
Package firefox-esr updated to version 78.4.1-alt0.1.p9 for branch p9 in task 261517.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2020-26950
In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2.
- http://packetstormsecurity.com/files/166175/Firefox-MCallGetProperty-Write-Side-Effects-Use-After-Free.html
- http://packetstormsecurity.com/files/166175/Firefox-MCallGetProperty-Write-Side-Effects-Use-After-Free.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1675905
- https://bugzilla.mozilla.org/show_bug.cgi?id=1675905
- https://www.mozilla.org/security/advisories/mfsa2020-49/
- https://www.mozilla.org/security/advisories/mfsa2020-49/