ALT-BU-2021-4790-1
Branch sisyphus_e2k update bulletin.
Package libaubio5 updated to version 0.4.9-alt4 for branch sisyphus_e2k.
Closed bugs
сломалась сборка libaubio5
Package libass updated to version 0.15.2-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-02042
Уязвимость функции decode_chars рендерера субтитров формата ASS/SSA Libass, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-36430
libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode_chars (called from decode_font and process_text) because the wrong integer data type is used for subtraction.
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libass/OSV-2020-2099.yaml
- https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libass/OSV-2020-2099.yaml
- https://github.com/libass/libass/commit/017137471d0043e0321e377ed8da48e45a3ec632
- https://github.com/libass/libass/commit/017137471d0043e0321e377ed8da48e45a3ec632
- FEDORA-2022-2af150223a
- FEDORA-2022-2af150223a
- GLSA-202208-13
- GLSA-202208-13
Package libexif updated to version 0.6.23-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2021-02074
Уязвимость фунции exif_data_load_data_content (exif-data.c) операционной системы Android, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-0181
In exif_data_load_data_thumbnail of exif-data.c, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145075076
Modified: 2024-11-21
CVE-2020-0198
In exif_data_load_data_content of exif-data.c, there is a possible UBSAN abort due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-146428941
- [debian-lts-announce] 20200613 [SECURITY] [DLA 2249-1] libexif security update
- FEDORA-2020-0aa0fc1b0c
- FEDORA-2020-e99ef3282f
- GLSA-202011-19
- https://source.android.com/security/bulletin/pixel/2020-06-01
- USN-4396-1
- [debian-lts-announce] 20200613 [SECURITY] [DLA 2249-1] libexif security update
- USN-4396-1
- https://source.android.com/security/bulletin/pixel/2020-06-01
- GLSA-202011-19
- FEDORA-2020-e99ef3282f
- FEDORA-2020-0aa0fc1b0c
Package unit updated to version 1.26.1-alt3 for branch sisyphus_e2k.
Closed bugs
Не перезапускать в процессе обновления
Package php8.0 updated to version 8.0.14-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7 updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7-curl updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7-gd updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7-pdo_mysql updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7-pgsql updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7-zip updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7-xsl updated to version 7.4.27-alt1.1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7-intl updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7-opcache updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7-xmlrpc updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package php7-tidy updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
Package apache2 updated to version 2.4.52-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2021-06392
Уязвимость HTTP-сервера Apache, связанная с выходом операции за границу буфера в памяти, позволяющая нарушителю выполнить произвольный код
BDU:2021-06393
Уязвимость HTTP-сервера Apache, связанная с подделкой запросов на стороне сервера, позволяющая нарушителю провести SSRF-атаку
Modified: 2024-11-21
CVE-2021-44224
A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).
- http://httpd.apache.org/security/vulnerabilities_24.html
- http://httpd.apache.org/security/vulnerabilities_24.html
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4
- [oss-security] 20211220 CVE-2021-44224: Apache HTTP Server: Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
- [oss-security] 20211220 CVE-2021-44224: Apache HTTP Server: Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
- FEDORA-2021-29a536c2ae
- FEDORA-2021-29a536c2ae
- FEDORA-2022-b4103753e9
- FEDORA-2022-b4103753e9
- FEDORA-2022-78e3211c55
- FEDORA-2022-78e3211c55
- FEDORA-2022-21264ec6db
- FEDORA-2022-21264ec6db
- GLSA-202208-20
- GLSA-202208-20
- https://security.netapp.com/advisory/ntap-20211224-0001/
- https://security.netapp.com/advisory/ntap-20211224-0001/
- https://support.apple.com/kb/HT213255
- https://support.apple.com/kb/HT213255
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213257
- https://support.apple.com/kb/HT213257
- DSA-5035
- DSA-5035
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.tenable.com/security/tns-2022-01
- https://www.tenable.com/security/tns-2022-01
- https://www.tenable.com/security/tns-2022-03
- https://www.tenable.com/security/tns-2022-03
Modified: 2024-11-21
CVE-2021-44790
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
- http://httpd.apache.org/security/vulnerabilities_24.html
- http://httpd.apache.org/security/vulnerabilities_24.html
- http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html
- http://packetstormsecurity.com/files/171631/Apache-2.4.x-Buffer-Overflow.html
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina
- 20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6
- 20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4
- 20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4
- [oss-security] 20211220 CVE-2021-44790: Apache HTTP Server: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
- [oss-security] 20211220 CVE-2021-44790: Apache HTTP Server: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
- FEDORA-2021-29a536c2ae
- FEDORA-2021-29a536c2ae
- FEDORA-2022-b4103753e9
- FEDORA-2022-b4103753e9
- FEDORA-2022-78e3211c55
- FEDORA-2022-78e3211c55
- FEDORA-2022-21264ec6db
- FEDORA-2022-21264ec6db
- GLSA-202208-20
- GLSA-202208-20
- https://security.netapp.com/advisory/ntap-20211224-0001/
- https://security.netapp.com/advisory/ntap-20211224-0001/
- https://support.apple.com/kb/HT213255
- https://support.apple.com/kb/HT213255
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213256
- https://support.apple.com/kb/HT213257
- https://support.apple.com/kb/HT213257
- DSA-5035
- DSA-5035
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.tenable.com/security/tns-2022-01
- https://www.tenable.com/security/tns-2022-01
- https://www.tenable.com/security/tns-2022-03
- https://www.tenable.com/security/tns-2022-03
Package php7-openssl updated to version 7.4.27-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.