ALT-BU-2021-3695-1
Branch sisyphus update bulletin.
Package libguestfs updated to version 1.42.0-alt4 for branch sisyphus in task 263114.
Closed bugs
Не хватает зависимости на db4.8-utils
Package rpm-build-guestfs updated to version 0.7-alt1 for branch sisyphus in task 263114.
Closed bugs
Inspection field ‘i_arch’ was ‘unknown’
Closed bugs
Не отрабатывает команда при LANG=ru_RU.UTF-8
Closed vulnerabilities
Modified: 2024-11-21
CVE-2020-11997
Apache Guacamole 1.2.0 and earlier do not consistently restrict access to connection history based on user visibility. If multiple users share access to the same connection, those users may be able to see which other users have accessed that connection, as well as the IP addresses from which that connection was accessed, even if those users do not otherwise have permission to see other users.
Closed vulnerabilities
BDU:2020-02035
Уязвимость функции hpack_dht_insert (hpack-tbl.c) библиотеки сетевого программного обеспечения HAProxy, связанная с выходом операции за допустимые границы буфера данных, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным, вызвать отказ в обслуживании или оказать воздействие на целостность данных
Modified: 2024-11-21
CVE-2020-11100
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
- openSUSE-SU-2020:0444
- http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html
- http://www.haproxy.org
- https://bugzilla.redhat.com/show_bug.cgi?id=1819111
- https://bugzilla.suse.com/show_bug.cgi?id=1168023
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88
- https://lists.debian.org/debian-security-announce/2020/msg00052.html
- FEDORA-2020-13fd8b1721
- FEDORA-2020-16cd111544
- GLSA-202012-22
- USN-4321-1
- DSA-4649
- https://www.haproxy.org/download/2.1/src/CHANGELOG
- https://www.mail-archive.com/haproxy%40formilux.org/msg36876.html
- openSUSE-SU-2020:0444
- https://www.mail-archive.com/haproxy%40formilux.org/msg36876.html
- https://www.haproxy.org/download/2.1/src/CHANGELOG
- DSA-4649
- USN-4321-1
- GLSA-202012-22
- FEDORA-2020-16cd111544
- FEDORA-2020-13fd8b1721
- https://lists.debian.org/debian-security-announce/2020/msg00052.html
- https://git.haproxy.org/?p=haproxy.git%3Ba=commit%3Bh=5dfc5d5cd0d2128d77253ead3acf03a421ab5b88
- https://bugzilla.suse.com/show_bug.cgi?id=1168023
- https://bugzilla.redhat.com/show_bug.cgi?id=1819111
- http://www.haproxy.org
- http://packetstormsecurity.com/files/157323/haproxy-hpack-tbl.c-Out-Of-Bounds-Write.html
Closed vulnerabilities
BDU:2022-00328
Уязвимость компонента url.cpp библиотеки для управления конфигурацией прокси Libproxy, связанная с недостатком механизма проверки размера копируемых данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-00336
Уязвимость функции url::recvline компонента url.cpp библиотеки для управления конфигурацией прокси Libproxy, связанная с выходом операции за допустимые границы буфера данных, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-25219
url::recvline in url.cpp in libproxy 0.4.x through 0.4.15 allows a remote HTTP server to trigger uncontrolled recursion via a response composed of an infinite stream that lacks a newline character. This leads to stack exhaustion.
- openSUSE-SU-2020:1676
- openSUSE-SU-2020:1676
- openSUSE-SU-2020:1680
- openSUSE-SU-2020:1680
- https://github.com/libproxy/libproxy/issues/134
- https://github.com/libproxy/libproxy/issues/134
- [debian-lts-announce] 20200912 [SECURITY] [DLA 2372-1] libproxy security update
- [debian-lts-announce] 20200912 [SECURITY] [DLA 2372-1] libproxy security update
- FEDORA-2020-2407cb0512
- FEDORA-2020-2407cb0512
- FEDORA-2020-f92d372cf1
- FEDORA-2020-f92d372cf1
- FEDORA-2020-7e1e9abf77
- FEDORA-2020-7e1e9abf77
- USN-4514-1
- USN-4514-1
- DSA-4800
- DSA-4800
Modified: 2024-11-21
CVE-2020-26154
url.cpp in libproxy through 0.4.15 is prone to a buffer overflow when PAC is enabled, as demonstrated by a large PAC file that is delivered without a Content-length header.
- openSUSE-SU-2020:1676
- openSUSE-SU-2020:1676
- openSUSE-SU-2020:1680
- openSUSE-SU-2020:1680
- https://bugs.debian.org/968366
- https://bugs.debian.org/968366
- https://github.com/libproxy/libproxy/pull/126
- https://github.com/libproxy/libproxy/pull/126
- [debian-lts-announce] 20201113 [SECURITY] [DLA 2450-1] libproxy security update
- [debian-lts-announce] 20201113 [SECURITY] [DLA 2450-1] libproxy security update
- FEDORA-2020-15b775b07e
- FEDORA-2020-15b775b07e
- FEDORA-2020-941b563a80
- FEDORA-2020-941b563a80
- DSA-4800
- DSA-4800