2020-11-23
ALT-BU-2020-4158-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Published: 2020-10-06
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-26570
The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.
Severity: LOW (2.1)
Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Severity: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References:
- http://www.openwall.com/lists/oss-security/2020/11/24/4
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24316
- https://github.com/OpenSC/OpenSC/commit/6903aebfddc466d966c7b865fae34572bf3ed23e
- https://lists.debian.org/debian-lts-announce/2021/11/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXOHFDMNMO6IDECAGUTB3SJGAGXVRT6S/
- http://www.openwall.com/lists/oss-security/2020/11/24/4
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24316
- https://github.com/OpenSC/OpenSC/commit/6903aebfddc466d966c7b865fae34572bf3ed23e
- https://lists.debian.org/debian-lts-announce/2021/11/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXOHFDMNMO6IDECAGUTB3SJGAGXVRT6S/
Published: 2020-10-06
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-26571
The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.
Severity: LOW (2.1)
Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Severity: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References:
- http://www.openwall.com/lists/oss-security/2020/11/24/4
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20612
- https://lists.debian.org/debian-lts-announce/2021/11/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXOHFDMNMO6IDECAGUTB3SJGAGXVRT6S/
- http://www.openwall.com/lists/oss-security/2020/11/24/4
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20612
- https://lists.debian.org/debian-lts-announce/2021/11/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXOHFDMNMO6IDECAGUTB3SJGAGXVRT6S/
Published: 2020-10-06
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-26572
The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.
Severity: LOW (2.1)
Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Severity: MEDIUM (5.5)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References:
- http://www.openwall.com/lists/oss-security/2020/11/24/4
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22967
- https://github.com/OpenSC/OpenSC/commit/9d294de90d1cc66956389856e60b6944b27b4817
- https://lists.debian.org/debian-lts-announce/2021/11/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXOHFDMNMO6IDECAGUTB3SJGAGXVRT6S/
- http://www.openwall.com/lists/oss-security/2020/11/24/4
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22967
- https://github.com/OpenSC/OpenSC/commit/9d294de90d1cc66956389856e60b6944b27b4817
- https://lists.debian.org/debian-lts-announce/2021/11/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXOHFDMNMO6IDECAGUTB3SJGAGXVRT6S/
Package kernel-image-std-pae updated to version 5.4.79-alt1 for branch sisyphus in task 262251.
Closed vulnerabilities
Published: 2021-07-06
Modified: 2025-01-29
Modified: 2025-01-29
BDU:2021-03412
Уязвимость ядра операционной системы Linux, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальным данным
Severity: MEDIUM (4.7)
Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: LOW (1.9)
Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
References:
Published: 2020-11-20
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-4788
IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
Severity: LOW (1.9)
Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
Severity: MEDIUM (4.7)
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References:
- http://www.openwall.com/lists/oss-security/2020/11/20/3
- http://www.openwall.com/lists/oss-security/2020/11/23/1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/189296
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TITJQPYDWZ4NB2ONJWUXW75KSQIPF35T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZF4OGZPKTAJJXWHPIFP3LHEWWEMR5LPT/
- https://www.ibm.com/support/pages/node/6370729
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://www.openwall.com/lists/oss-security/2020/11/20/3
- http://www.openwall.com/lists/oss-security/2020/11/23/1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/189296
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TITJQPYDWZ4NB2ONJWUXW75KSQIPF35T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZF4OGZPKTAJJXWHPIFP3LHEWWEMR5LPT/
- https://www.ibm.com/support/pages/node/6370729
- https://www.oracle.com/security-alerts/cpujul2022.html
Package kernel-image-std-debug updated to version 5.4.79-alt1 for branch sisyphus in task 262247.
Closed vulnerabilities
Published: 2021-07-06
Modified: 2025-01-29
Modified: 2025-01-29
BDU:2021-03412
Уязвимость ядра операционной системы Linux, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальным данным
Severity: MEDIUM (4.7)
Vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity: LOW (1.9)
Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
References:
Published: 2020-11-20
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-4788
IBM Power9 (AIX 7.1, 7.2, and VIOS 3.1) processors could allow a local user to obtain sensitive information from the data in the L1 cache under extenuating circumstances. IBM X-Force ID: 189296.
Severity: LOW (1.9)
Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
Severity: MEDIUM (4.7)
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References:
- http://www.openwall.com/lists/oss-security/2020/11/20/3
- http://www.openwall.com/lists/oss-security/2020/11/23/1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/189296
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TITJQPYDWZ4NB2ONJWUXW75KSQIPF35T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZF4OGZPKTAJJXWHPIFP3LHEWWEMR5LPT/
- https://www.ibm.com/support/pages/node/6370729
- https://www.oracle.com/security-alerts/cpujul2022.html
- http://www.openwall.com/lists/oss-security/2020/11/20/3
- http://www.openwall.com/lists/oss-security/2020/11/23/1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/189296
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TITJQPYDWZ4NB2ONJWUXW75KSQIPF35T/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZF4OGZPKTAJJXWHPIFP3LHEWWEMR5LPT/
- https://www.ibm.com/support/pages/node/6370729
- https://www.oracle.com/security-alerts/cpujul2022.html
Closed vulnerabilities
Published: 2019-12-17
Modified: 2023-11-21
Modified: 2023-11-21
BDU:2019-04671
Уязвимость служебных утилит e2fsprogs для работы с файловыми системами ext2, ext3 и ext4, связанная с записью за границами кучи, позволяющая нарушителю выполнить произвольный код
Severity: MEDIUM (6.7)
Vector: AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: MEDIUM (6.8)
Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C
References:
Published: 2021-07-13
Modified: 2023-11-21
Modified: 2023-11-21
BDU:2021-03599
Уязвимость функции повторного хэширования набора утилит для работы с файловыми системами E2fsprogs, связанная с записью за границами буфера, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Severity: MEDIUM (6.7)
Vector: AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: MEDIUM (4.6)
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
References:
Published: 2019-09-24
Modified: 2025-05-30
Modified: 2025-05-30
CVE-2019-5094
An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
Severity: MEDIUM (4.6)
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References:
- https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/
- https://seclists.org/bugtraq/2019/Sep/58
- https://security.gentoo.org/glsa/202003-05
- https://security.netapp.com/advisory/ntap-20200115-0002/
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887
- https://usn.ubuntu.com/4142-1/
- https://usn.ubuntu.com/4142-2/
- https://www.debian.org/security/2019/dsa-4535
- https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/
- https://seclists.org/bugtraq/2019/Sep/58
- https://security.gentoo.org/glsa/202003-05
- https://security.netapp.com/advisory/ntap-20200115-0002/
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887
- https://usn.ubuntu.com/4142-1/
- https://usn.ubuntu.com/4142-2/
- https://www.debian.org/security/2019/dsa-4535
Published: 2020-01-08
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2019-5188
A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.
Severity: MEDIUM (4.4)
Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P
Severity: MEDIUM (6.7)
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References:
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00004.html
- https://lists.debian.org/debian-lts-announce/2020/03/msg00030.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/
- https://security.netapp.com/advisory/ntap-20220506-0001/
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973
- https://usn.ubuntu.com/4249-1/
- http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00004.html
- https://lists.debian.org/debian-lts-announce/2020/03/msg00030.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00021.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2AKETJ6BREDUHRWQTV35SPGG5C6H7KSI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6DOBCYQKCTTWXBLMUPJ5TX3FY7JNCOKY/
- https://security.netapp.com/advisory/ntap-20220506-0001/
- https://talosintelligence.com/vulnerability_reports/TALOS-2019-0973
- https://usn.ubuntu.com/4249-1/