ALT-BU-2021-4753-1
Branch sisyphus_riscv64 update bulletin.
Package libvirglrenderer updated to version 0.9.1-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2020-00553
Уязвимость функции vrend_blit_need_swizzle (vrend_renderer.c) библиотеки virglrenderer, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2020-00554
Уязвимость функции vrend_renderer_transfer_write_iov (vrend_renderer.c) библиотеки virglrenderer, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-00915
Уязвимость функции vrend_renderer_transfer_write_iov компонента vrend_renderer.c виртуального OpenGL рендерера Virglrenderer, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2023-00916
Уязвимость компонента vrend_renderer.c виртуального OpenGL рендерера Virglrenderer, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-00917
Уязвимость компонента vrend_renderer.c виртуального OpenGL рендерера Virglrenderer, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-00918
Уязвимость компонента vrend_renderer.c виртуального OpenGL рендерера Virglrenderer, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2017-6386
Memory leak in the vrend_create_vertex_elements_state function in vrend_renderer.c in virglrenderer allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRGL_OBJECT_VERTEX_ELEMENTS commands.
- [oss-security] 20170301 CVE-2017-6386 Virglrenderer: memory leakage while in vrend_create_vertex_elements_state
- [oss-security] 20170301 CVE-2017-6386 Virglrenderer: memory leakage while in vrend_create_vertex_elements_state
- 96506
- 96506
- https://bugzilla.redhat.com/show_bug.cgi?id=1427472
- https://bugzilla.redhat.com/show_bug.cgi?id=1427472
- https://cgit.freedesktop.org/virglrenderer/commit/?id=737c3350850ca4dbc5633b3bdb4118176ce59920
- https://cgit.freedesktop.org/virglrenderer/commit/?id=737c3350850ca4dbc5633b3bdb4118176ce59920
- GLSA-201707-06
- GLSA-201707-06
Modified: 2024-11-21
CVE-2019-18388
A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via malformed commands.
- openSUSE-SU-2020:0058
- openSUSE-SU-2020:0058
- Red Hat
- Red Hat
- https://bugzilla.redhat.com/show_bug.cgi?id=1765578
- https://bugzilla.redhat.com/show_bug.cgi?id=1765578
- https://gitlab.freedesktop.org/virgl/virglrenderer/commit/0d9a2c88dc3a70023541b3260b9f00c982abda16
- https://gitlab.freedesktop.org/virgl/virglrenderer/commit/0d9a2c88dc3a70023541b3260b9f00c982abda16
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=d2cdbcf6a8f2317f250fd54f08aa35dde2fa3e30#diff-content-3cd772559e0d73afa136d6818023cfd0c4c8ecc0
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=d2cdbcf6a8f2317f250fd54f08aa35dde2fa3e30#diff-content-3cd772559e0d73afa136d6818023cfd0c4c8ecc0
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
Modified: 2024-11-21
CVE-2019-18389
A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.
- openSUSE-SU-2020:0058
- openSUSE-SU-2020:0058
- Red Hat
- Red Hat
- https://bugzilla.redhat.com/show_bug.cgi?id=1765577
- https://bugzilla.redhat.com/show_bug.cgi?id=1765577
- https://gitlab.freedesktop.org/virgl/virglrenderer/commit/cbc8d8b75be360236cada63784046688aeb6d921
- https://gitlab.freedesktop.org/virgl/virglrenderer/commit/cbc8d8b75be360236cada63784046688aeb6d921
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=9c280a28651507e6ef87b17b90d47b6af3a4ab7d
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=9c280a28651507e6ef87b17b90d47b6af3a4ab7d
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
Modified: 2024-11-21
CVE-2019-18390
An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_BLIT commands.
- openSUSE-SU-2020:0058
- openSUSE-SU-2020:0058
- Red Hat
- Red Hat
- https://bugzilla.redhat.com/show_bug.cgi?id=1765584
- https://bugzilla.redhat.com/show_bug.cgi?id=1765584
- https://gitlab.freedesktop.org/virgl/virglrenderer/commit/24f67de7a9088a873844a39be03cee6882260ac9
- https://gitlab.freedesktop.org/virgl/virglrenderer/commit/24f67de7a9088a873844a39be03cee6882260ac9
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=d2cdbcf6a8f2317f250fd54f08aa35dde2fa3e30#3cd772559e0d73afa136d6818023cfd0c4c8ecc0_0_151
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=d2cdbcf6a8f2317f250fd54f08aa35dde2fa3e30#3cd772559e0d73afa136d6818023cfd0c4c8ecc0_0_151
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
Modified: 2024-11-21
CVE-2019-18391
A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.
- openSUSE-SU-2020:0058
- openSUSE-SU-2020:0058
- Red Hat
- Red Hat
- https://bugzilla.redhat.com/show_bug.cgi?id=1765589
- https://bugzilla.redhat.com/show_bug.cgi?id=1765589
- https://gitlab.freedesktop.org/virgl/virglrenderer/commit/2abeb1802e3c005b17a7123e382171b3fb665971
- https://gitlab.freedesktop.org/virgl/virglrenderer/commit/2abeb1802e3c005b17a7123e382171b3fb665971
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=8c9cfb4e425542e96f0717189fe4658555baaf08
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs?commit_id=8c9cfb4e425542e96f0717189fe4658555baaf08
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
Modified: 2024-11-21
CVE-2020-8002
A NULL pointer dereference in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service via commands that attempt to launch a grid without previously providing a Compute Shader (CS).
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=572a36879701598fa727f50313508be99865b58f
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=572a36879701598fa727f50313508be99865b58f
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=725e12beba4a41934f0ab62d399b5d4de2d13190
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=725e12beba4a41934f0ab62d399b5d4de2d13190
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
Modified: 2024-11-21
CVE-2020-8003
A double-free vulnerability in vrend_renderer.c in virglrenderer through 0.8.1 allows attackers to cause a denial of service by triggering texture allocation failure, because vrend_renderer_resource_allocated_texture is not an appropriate place for a free.
- https://gitlab.freedesktop.org/virgl/virglrenderer/commit/f9b079ccc319c98499111f66bd654fc9b56cf15f?merge_request_iid=340
- https://gitlab.freedesktop.org/virgl/virglrenderer/commit/f9b079ccc319c98499111f66bd654fc9b56cf15f?merge_request_iid=340
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=3320973c9f2068f60cf6613c2811a8824781878a
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=3320973c9f2068f60cf6613c2811a8824781878a
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=f9b079ccc319c98499111f66bd654fc9b56cf15f
- https://gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/340/diffs?commit_id=f9b079ccc319c98499111f66bd654fc9b56cf15f
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
- [debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update
Package packageinstall updated to version 1.4-alt1 for branch sisyphus_riscv64.
Closed bugs
По завершении предлагает ждать
Неправильная обработка вывода apt-get
[FR] apt-get update
Некорректно отрисовывается прогресс операции packageinstall
Неточности в README.md для packageinstall
Package p7zip updated to version 17.04-alt2 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2016-9296
A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackPositions in function CInArchive::ReadAndDecodePackedStreams in CPP/7zip/Archive/7z/7zIn.cpp, as used in the 7z.so library and in 7z applications, will cause a crash and a denial of service when decoding malformed 7z files.
- 94294
- 94294
- https://github.com/yangke/7zip-null-pointer-dereference
- https://github.com/yangke/7zip-null-pointer-dereference
- https://sourceforge.net/p/p7zip/bugs/185/
- https://sourceforge.net/p/p7zip/bugs/185/
- https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/
- https://sourceforge.net/p/p7zip/discussion/383043/thread/648d34db/
Package libupnp updated to version 1.14.12-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2021-01679
Уязвимость функции Parser_parseDocument() набора средств для UPnP устройств PUPnP, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-03726
Уязвимость функций FindServiceControlURLPath и FindServiceEventURLPath библиотеки для разработки программного обеспечения Portable UPnP SDK, связанная с ошибками разыменования указателя, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-13848
Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.
- openSUSE-SU-2020:0821
- openSUSE-SU-2020:0805
- https://github.com/pupnp/pupnp/commit/c805c1de1141cb22f74c0d94dd5664bda37398e0
- https://github.com/pupnp/pupnp/issues/177
- [debian-lts-announce] 20200608 [SECURITY] [DLA 2238-1] libupnp security update
- [debian-lts-announce] 20210307 [SECURITY] [DLA 2585-1] libupnp security update
- openSUSE-SU-2020:0821
- [debian-lts-announce] 20210307 [SECURITY] [DLA 2585-1] libupnp security update
- [debian-lts-announce] 20200608 [SECURITY] [DLA 2238-1] libupnp security update
- https://github.com/pupnp/pupnp/issues/177
- https://github.com/pupnp/pupnp/commit/c805c1de1141cb22f74c0d94dd5664bda37398e0
- openSUSE-SU-2020:0805
Modified: 2024-11-21
CVE-2021-28302
A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.
Package systemd updated to version 249.7-alt7 for branch sisyphus_riscv64.
Closed bugs
Отсутствует /usr/share/polkit-1/actions/org.freedesktop.systemd1.policy