ALT-BU-2021-4205-3

Branch p10 update bulletin.

Package ghostscript updated to version 9.54.0-alt3 for branch p10 in task 285079.

Уязвимость набора программного обеспечения для обработки, преобразования и генерации документов Ghostscript, связанная с неправильной нейтрализацией специальных элементов, используемых в команде ОС, позволяющая нарушителю выполнить произвольный код

Severity: CRITICAL (9.9)Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Severity: CRITICAL (9.0)Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C

References:

CVE-2021-3781

A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Severity: CRITICAL (9.3)Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Severity: CRITICAL (9.9)Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References:

Файл из PFB в PFА не конвертируется

Package cifs-utils updated to version 6.13-alt3 for branch p10 in task 285065.

A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.

Severity: MEDIUM (4.9)Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N

Severity: MEDIUM (6.1)Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N

References:

Не работает монтирование сетевой папки с помощью pam_mount

Version: 2.1.2

Branch p10 update on 2021-09-17

ALT-BU-2021-4205-3

ALT-PU-2021-2808-2

Closed vulnerabilities

BDU:2024-05832

CVE-2021-3781

Closed bugs

Bug #40817

ALT-PU-2021-2827-1

Closed vulnerabilities

CVE-2021-20208

Closed bugs

Bug #40887