ALT-BU-2021-3681-1
Branch sisyphus update bulletin.
Package x2goserver updated to version 4.1.0.3-alt3 for branch sisyphus in task 264555.
Closed bugs
Неправильный вывод версий командой x2goversion
Package thunderbird updated to version 78.6.1-alt1 for branch sisyphus in task 264551.
Closed vulnerabilities
BDU:2021-01665
Уязвимость реализации блока COOKIE-ECHO расширения WebRTC браузеров Google Chrome, Mozilla Firefox, Firefox ESR и Firefox for Android, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
Modified: 2024-11-21
CVE-2020-16044
Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet.
Closed vulnerabilities
BDU:2021-01901
Уязвимость компонентов lda, lmtp и imap почтового сервера Dovecot, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-24386
An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure).
- http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html
- http://packetstormsecurity.com/files/160842/Dovecot-2.3.11.3-Access-Bypass.html
- 20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail
- 20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail
- http://www.openwall.com/lists/oss-security/2021/01/04/4
- http://www.openwall.com/lists/oss-security/2021/01/04/4
- https://doc.dovecot.org/configuration_manual/hibernation/
- https://doc.dovecot.org/configuration_manual/hibernation/
- https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html
- https://dovecot.org/pipermail/dovecot-news/2021-January/000450.html
- https://dovecot.org/security
- https://dovecot.org/security
- FEDORA-2021-c90cb486f7
- FEDORA-2021-c90cb486f7
- GLSA-202101-01
- GLSA-202101-01
- DSA-4825
- DSA-4825
Modified: 2024-11-21
CVE-2020-25275
Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts.
- http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html
- http://packetstormsecurity.com/files/160841/Dovecot-2.3.11.3-Denial-Of-Service.html
- 20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail
- 20210106 CVE-2020-24386: IMAP hibernation allows accessing other peoples mail
- http://www.openwall.com/lists/oss-security/2021/01/04/3
- http://www.openwall.com/lists/oss-security/2021/01/04/3
- https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html
- https://dovecot.org/pipermail/dovecot-news/2021-January/000451.html
- https://dovecot.org/security
- https://dovecot.org/security
- FEDORA-2021-c90cb486f7
- FEDORA-2021-c90cb486f7
- GLSA-202101-01
- GLSA-202101-01
- DSA-4825
- DSA-4825
Closed vulnerabilities
BDU:2022-00213
Уязвимость программы для анализа трафика wireshark, связанная с неправильным освобождением памяти перед удалением последний ссылки, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-00214
Уязвимость программы для анализа трафика wireshark, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-26418
Memory leak in Kafka protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26418.json
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26418.json
- https://gitlab.com/wireshark/wireshark/-/issues/16739
- https://gitlab.com/wireshark/wireshark/-/issues/16739
- [debian-lts-announce] 20210206 [SECURITY] [DLA 2547-1] wireshark security update
- [debian-lts-announce] 20210206 [SECURITY] [DLA 2547-1] wireshark security update
- FEDORA-2021-138674557c
- FEDORA-2021-138674557c
- FEDORA-2021-f3011da665
- FEDORA-2021-f3011da665
- GLSA-202101-12
- GLSA-202101-12
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.wireshark.org/security/wnpa-sec-2020-16.html
- https://www.wireshark.org/security/wnpa-sec-2020-16.html
Modified: 2024-11-21
CVE-2020-26420
Memory leak in RTPS protocol dissector in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26420.json
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26420.json
- https://gitlab.com/wireshark/wireshark/-/issues/16994
- https://gitlab.com/wireshark/wireshark/-/issues/16994
- FEDORA-2021-138674557c
- FEDORA-2021-138674557c
- FEDORA-2021-f3011da665
- FEDORA-2021-f3011da665
- GLSA-202101-12
- GLSA-202101-12
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.wireshark.org/security/wnpa-sec-2020-18.html
- https://www.wireshark.org/security/wnpa-sec-2020-18.html
Modified: 2024-11-21
CVE-2020-26421
Crash in USB HID protocol dissector and possibly other dissectors in Wireshark 3.4.0 and 3.2.0 to 3.2.8 allows denial of service via packet injection or crafted capture file.
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26421.json
- https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-26421.json
- https://gitlab.com/wireshark/wireshark/-/issues/16958
- https://gitlab.com/wireshark/wireshark/-/issues/16958
- [debian-lts-announce] 20210206 [SECURITY] [DLA 2547-1] wireshark security update
- [debian-lts-announce] 20210206 [SECURITY] [DLA 2547-1] wireshark security update
- FEDORA-2021-138674557c
- FEDORA-2021-138674557c
- FEDORA-2021-f3011da665
- FEDORA-2021-f3011da665
- GLSA-202101-12
- GLSA-202101-12
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.wireshark.org/security/wnpa-sec-2020-17.html
- https://www.wireshark.org/security/wnpa-sec-2020-17.html
Closed vulnerabilities
Modified: 2024-11-21
CVE-2020-36317
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the same string.
Modified: 2024-11-21
CVE-2020-36318
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.