ALT-BU-2021-3843-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2021-28378
Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
Modified: 2024-11-21
CVE-2021-29134
The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.
Modified: 2024-11-21
CVE-2021-3382
Stack buffer overflow vulnerability in gitea 1.9.0 through 1.13.1 allows remote attackers to cause a denial of service (crash) via vectors related to a file path.
Closed bugs
В tora не удаляются записи из таблиц MySQL
Package alt-csp-cryptopro updated to version 0.1.2-alt1 for branch sisyphus in task 269157.
Closed bugs
Дополнительное окно при запросе пароля на контейнер (при создании подписи)
Closed bugs
Поиск Metadata в подкаталоге directory из propagator
Package kernel-image-rpi-un updated to version 5.10.27-alt1 for branch sisyphus in task 269143.
Closed vulnerabilities
BDU:2021-01688
Уязвимость функции rtw_wx_set_scan() (drivers/staging/rtl8188eu/os_dep/ioctl_linux.c) ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-01827
Уязвимость реализации функции vhost_vdpa_config_put() ядра операционных систем Linux, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-04833
Уязвимость функции fastrpc_internal_invoke (drivers/misc/fastrpc.c) ядра операционной системы Linux, позволяющая нарушителю выполнить произвольную команду управления
Modified: 2024-11-21
CVE-2021-28375
An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages, aka CID-20c40794eb85. This is a related issue to CVE-2019-2308.
- https://git.kernel.org/linus/20c40794eb85ea29852d7bc37c55713802a543d6
- https://git.kernel.org/linus/20c40794eb85ea29852d7bc37c55713802a543d6
- FEDORA-2021-90083c9c0f
- FEDORA-2021-90083c9c0f
- FEDORA-2021-bb755ed5e3
- FEDORA-2021-bb755ed5e3
- FEDORA-2021-14f6642aa6
- FEDORA-2021-14f6642aa6
- https://lore.kernel.org/stable/YD03ew7+6v0XPh6l%40kroah.com/
- https://lore.kernel.org/stable/YD03ew7+6v0XPh6l%40kroah.com/
- https://security.netapp.com/advisory/ntap-20210401-0003/
- https://security.netapp.com/advisory/ntap-20210401-0003/
Modified: 2024-11-21
CVE-2021-28660
rtw_wx_set_scan in drivers/staging/rtl8188eu/os_dep/ioctl_linux.c in the Linux kernel through 5.11.6 allows writing beyond the end of the ->ssid[] array. NOTE: from the perspective of kernel.org releases, CVE IDs are not normally used for drivers/staging/* (unfinished work); however, system integrators may have situations in which a drivers/staging issue is relevant to their own customer base.
- [oss-security] 20221118 Linux kernel: staging: rtl8712: A Use-after-Free/Double-Free bug in read_bbreg_hdl in drivers/staging/rtl8712/rtl8712_cmd.c
- [oss-security] 20221118 Linux kernel: staging: rtl8712: A Use-after-Free/Double-Free bug in read_bbreg_hdl in drivers/staging/rtl8712/rtl8712_cmd.c
- [oss-security] 20221121 Re: Linux kernel: staging: rtl8712: A Use-after-Free/Double-Free bug in read_bbreg_hdl in drivers/staging/rtl8712/rtl8712_cmd.c
- [oss-security] 20221121 Re: Linux kernel: staging: rtl8712: A Use-after-Free/Double-Free bug in read_bbreg_hdl in drivers/staging/rtl8712/rtl8712_cmd.c
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=74b6b20df8cfe90ada777d621b54c32e69e27cd7
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=74b6b20df8cfe90ada777d621b54c32e69e27cd7
- [debian-lts-announce] 20210330 [SECURITY] [DLA 2610-1] linux-4.19 security update
- [debian-lts-announce] 20210330 [SECURITY] [DLA 2610-1] linux-4.19 security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
- [debian-lts-announce] 20210623 [SECURITY] [DLA 2689-1] linux security update
- FEDORA-2021-bb755ed5e3
- FEDORA-2021-bb755ed5e3
- https://security.netapp.com/advisory/ntap-20210507-0008/
- https://security.netapp.com/advisory/ntap-20210507-0008/
Modified: 2024-11-21
CVE-2021-29266
An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening a character device, aka CID-f6bbf0010ba0.
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.9
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.9
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f6bbf0010ba004f5e90c7aefdebc0ee4bd3283b9
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f6bbf0010ba004f5e90c7aefdebc0ee4bd3283b9
- https://security.netapp.com/advisory/ntap-20210513-0005/
- https://security.netapp.com/advisory/ntap-20210513-0005/
Closed bugs
Собрать с поддержкой PPS
Package python3-module-Pillow updated to version 8.1.2-alt1 for branch sisyphus in task 269240.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2021-27921
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
Modified: 2024-11-21
CVE-2021-27922
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.
Modified: 2024-11-21
CVE-2021-27923
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
Package eiskaltdcpp updated to version 2.4.2-alt2 for branch sisyphus in task 269246.
Closed bugs
Зависимость от /usr/bin/php