Branch sisyphus update bulletin.

Package ImageMagick updated to version 6.9.11.53-alt1 for branch sisyphus in task 264282.

Published: 2020-12-08

BDU:2021-01009

Уязвимость консольного графического редактора ImageMagick, вызванная переполнением буфера, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации

Severity: HIGH (7.1) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References:

CVE-2020-27752

Published: 2020-11-21

BDU:2021-03444

Уязвимость опции -authenticate консольного графического редактора ImageMagick, связанная с ошибками в обработке XML-запросов, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании

Severity: HIGH (7.3) Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References:

CVE-2020-29599

Published: 2020-12-09
Modified: 2024-11-21

CVE-2020-27752

A flaw was found in ImageMagick in MagickCore/quantum-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger a heap buffer overflow. This would most likely lead to an impact to application availability, but could potentially lead to an impact to data integrity as well. This flaw affects ImageMagick versions prior to 7.0.9-0.

Severity: HIGH (7.1) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References:

Published: 2020-12-07
Modified: 2024-11-21

CVE-2020-29599

ImageMagick before 6.9.11-40 and 7.x before 7.0.10-40 mishandles the -authenticate option, which allows setting a password for password-protected PDF files. The user-controlled password was not properly escaped/sanitized and it was therefore possible to inject additional shell commands via coders/pdf.c.

Severity: HIGH (7.8) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Package virtualbox updated to version 6.1.16-alt1 for branch sisyphus in task 264125.

Published: 2020-10-20

BDU:2020-05254

Уязвимость компонента Core программного средства виртуализации Oracle VM VirtualBox, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (5.5) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

CVE-2020-14892

Published: 2020-08-19

BDU:2020-05255

Уязвимость компонента Core программного средства виртуализации Oracle VM VirtualBox, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14884

Published: 2020-08-21

BDU:2020-05256

Уязвимость функции shader_generate_main компонента Core программного средства виртуализации Oracle VM VirtualBox, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14885

Published: 2020-08-21

BDU:2020-05257

Уязвимость функции shader_skip_unrecognized компонента Core программного средства виртуализации Oracle VM VirtualBox, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14886

Published: 2020-08-14

BDU:2020-05264

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14881

Published: 2020-10-20

BDU:2020-05266

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14889

Published: 2020-10-20

BDU:2020-05310

Уязвимость компонента Core программного средства виртуализации Oracle VM VirtualBox, позволяющая нарушителю получить полный контроль над приложением

Severity: HIGH (8.2) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References:

CVE-2020-14872

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14872

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

Severity: HIGH (7.2)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14881

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14884

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14885

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14886

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14889

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14892

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Severity: MEDIUM (4.9)

References:

Package kernel-modules-virtualbox-std-def updated to version 6.1.16-alt1.328789.2 for branch sisyphus in task 264125.

Published: 2020-10-20

BDU:2020-05254

Severity: MEDIUM (5.5) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

CVE-2020-14892

Published: 2020-08-19

BDU:2020-05255

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14884

Published: 2020-08-21

BDU:2020-05256

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14885

Published: 2020-08-21

BDU:2020-05257

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14886

Published: 2020-08-14

BDU:2020-05264

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14881

Published: 2020-10-20

BDU:2020-05266

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14889

Published: 2020-10-20

BDU:2020-05310

Severity: HIGH (8.2) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References:

CVE-2020-14872

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14872

Severity: HIGH (7.2)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14881

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14884

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14885

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14886

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14889

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14892

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Severity: MEDIUM (4.9)

References:

Package kernel-modules-virtualbox-addition-std-def updated to version 6.1.16-alt1.328789.2 for branch sisyphus in task 264125.

Published: 2020-10-20

BDU:2020-05254

Severity: MEDIUM (5.5) Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References:

CVE-2020-14892

Published: 2020-08-19

BDU:2020-05255

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14884

Published: 2020-08-21

BDU:2020-05256

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14885

Published: 2020-08-21

BDU:2020-05257

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14886

Published: 2020-08-14

BDU:2020-05264

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14881

Published: 2020-10-20

BDU:2020-05266

Severity: MEDIUM (6.0) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References:

CVE-2020-14889

Published: 2020-10-20

BDU:2020-05310

Severity: HIGH (8.2) Vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References:

CVE-2020-14872

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14872

Severity: HIGH (7.2)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14881

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14884

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14885

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14886

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14889

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

Severity: MEDIUM (4.9)

References:

Published: 2020-10-21
Modified: 2024-11-21

CVE-2020-14892

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prior to 6.1.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Severity: MEDIUM (4.9)

References:

Version: 2.1.0

ALT-BU-2021-3673-1

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities