ALT-BU-2022-3496-1
Branch sisyphus_e2k update bulletin.
Package rxvt-unicode updated to version 9.26-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2021-04892
Уязвимость программного обеспечения Eterm, Mrxyt, Rxyt, Rxyt-unicode, связанная с функцией SSL-Proxy, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2021-33477
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.
- http://cvs.schmorp.de/rxvt-unicode/Changes?view=log
- http://cvs.schmorp.de/rxvt-unicode/Changes?view=log
- http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583
- http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583
- https://git.enlightenment.org/apps/eterm.git/log/
- https://git.enlightenment.org/apps/eterm.git/log/
- [debian-lts-announce] 20210530 [SECURITY] [DLA 2671-1] rxvt-unicode security update
- [debian-lts-announce] 20210530 [SECURITY] [DLA 2671-1] rxvt-unicode security update
- [debian-lts-announce] 20210609 [SECURITY] [DLA 2681-1] eterm security update
- [debian-lts-announce] 20210609 [SECURITY] [DLA 2681-1] eterm security update
- [debian-lts-announce] 20210609 [SECURITY] [DLA 2682-1] mrxvt security update
- [debian-lts-announce] 20210609 [SECURITY] [DLA 2682-1] mrxvt security update
- [debian-lts-announce] 20210609 [SECURITY] [DLA 2683-1] rxvt security update
- [debian-lts-announce] 20210609 [SECURITY] [DLA 2683-1] rxvt security update
- FEDORA-2021-5b96f0f5db
- FEDORA-2021-5b96f0f5db
- FEDORA-2021-71556a5722
- FEDORA-2021-71556a5722
- FEDORA-2021-0d3268fc35
- FEDORA-2021-0d3268fc35
- FEDORA-2021-a4c0a91884
- FEDORA-2021-a4c0a91884
- FEDORA-2021-c883ca2a37
- FEDORA-2021-c883ca2a37
- FEDORA-2021-8b85b2de05
- FEDORA-2021-8b85b2de05
- https://packetstormsecurity.com/files/162621/rxvt-2.7.0-rxvt-unicode-9.22-Code-Execution.html
- https://packetstormsecurity.com/files/162621/rxvt-2.7.0-rxvt-unicode-9.22-Code-Execution.html
- GLSA-202105-17
- GLSA-202105-17
- GLSA-202209-07
- GLSA-202209-07
- https://sourceforge.net/projects/materm/files/mrxvt%20source/
- https://sourceforge.net/projects/materm/files/mrxvt%20source/
- https://sourceforge.net/projects/rxvt/files/rxvt-dev/
- https://sourceforge.net/projects/rxvt/files/rxvt-dev/
- https://www.openwall.com/lists/oss-security/2017/05/01/20
- https://www.openwall.com/lists/oss-security/2017/05/01/20
- https://www.openwall.com/lists/oss-security/2021/05/17/1
- https://www.openwall.com/lists/oss-security/2021/05/17/1
Package spawn-fcgi updated to version 1.6.4-alt5 for branch sisyphus_e2k.
Closed bugs
'/var/run/spawn-fcgi': No such file or directory
Package rosegarden updated to version 21.06-alt1 for branch sisyphus_e2k.
Closed bugs
Прошу собрать новую версию rosegarden
Package tcl updated to version 8.6.12-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-01774
Уязвимость компонента nmakehlp.c языка программирования Tcl, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2021-35331
In Tcl 8.6.11, a format string vulnerability in nmakehlp.c might allow code execution via a crafted file. NOTE: multiple third parties dispute the significance of this finding
- https://core.tcl-lang.org/tcl/info/28ef6c0c741408a2
- https://core.tcl-lang.org/tcl/info/28ef6c0c741408a2
- https://core.tcl-lang.org/tcl/info/bad6cc213dfe8280
- https://core.tcl-lang.org/tcl/info/bad6cc213dfe8280
- https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222
- https://github.com/tcltk/tcl/commit/4705dbdde2f32ff90420765cd93e7ac71d81a222
- https://sqlite.org/forum/info/7dcd751996c93ec9
- https://sqlite.org/forum/info/7dcd751996c93ec9
Package tigervnc updated to version 1.11.0-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2021-05229
Уязвимость программного обеспечения для реализации VNC TigerVNC, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность
Modified: 2024-11-21
CVE-2020-26117
In rfb/CSecurityTLS.cxx and rfb/CSecurityTLS.java in TigerVNC before 1.11.0, viewers mishandle TLS certificate exceptions. They store the certificates as authorities, meaning that the owner of a certificate could impersonate any server after a client had added an exception.
- openSUSE-SU-2020:1666
- openSUSE-SU-2020:1666
- openSUSE-SU-2020:1841
- openSUSE-SU-2020:1841
- https://bugzilla.opensuse.org/show_bug.cgi?id=1176733
- https://bugzilla.opensuse.org/show_bug.cgi?id=1176733
- https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cb
- https://github.com/TigerVNC/tigervnc/commit/20dea801e747318525a5859fe4f37c52b05310cb
- https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562b
- https://github.com/TigerVNC/tigervnc/commit/7399eab79a4365434d26494fa1628ce1eb91562b
- https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cba
- https://github.com/TigerVNC/tigervnc/commit/b30f10c681ec87720cff85d490f67098568a9cba
- https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6e
- https://github.com/TigerVNC/tigervnc/commit/f029745f63ac7d22fb91639b2cb5b3ab56134d6e
- https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0
- https://github.com/TigerVNC/tigervnc/releases/tag/v1.11.0
- [debian-lts-announce] 20201006 [SECURITY] [DLA 2396-1] tigervnc security update
- [debian-lts-announce] 20201006 [SECURITY] [DLA 2396-1] tigervnc security update
Package zsh updated to version 5.8-alt3 for branch sisyphus_e2k.
Closed bugs
отвалилось rpmquery --lastchange
Package roundcube updated to version 1.5.1-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2021-06259
Уязвимость почтового клиента Roundcube, связанная с непринятием мер по защите структуры запроса SQL, позволяющая нарушителю выполнить произвольный SQL-код
Modified: 2024-11-21
CVE-2021-44025
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
- https://bugs.debian.org/1000156
- https://bugs.debian.org/1000156
- https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7
- https://github.com/roundcube/roundcubemail/commit/7d7b1dfeff795390b69905ceb63d6391b5b0dfe7
- https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a
- https://github.com/roundcube/roundcubemail/commit/faf99bf8a2b7b7562206fa047e8de652861e624a
- https://github.com/roundcube/roundcubemail/issues/8193
- https://github.com/roundcube/roundcubemail/issues/8193
- [debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update
- [debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update
- FEDORA-2021-43d3c10590
- FEDORA-2021-43d3c10590
- FEDORA-2021-167865df98
- FEDORA-2021-167865df98
- DSA-5013
- DSA-5013
Modified: 2024-11-21
CVE-2021-44026
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
- https://bugs.debian.org/1000156
- https://bugs.debian.org/1000156
- https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1
- https://github.com/roundcube/roundcubemail/commit/c8947ecb762d9e89c2091bda28d49002817263f1
- https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa
- https://github.com/roundcube/roundcubemail/commit/ee809bde2dcaa04857a919397808a7296681dcfa
- [debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update
- [debian-lts-announce] 20211206 [SECURITY] [DLA 2840-1] roundcube security update
- FEDORA-2021-43d3c10590
- FEDORA-2021-43d3c10590
- FEDORA-2021-167865df98
- FEDORA-2021-167865df98
- DSA-5013
- DSA-5013
Package resource-agents updated to version 4.10.0-alt1 for branch sisyphus_e2k.
Closed bugs
Файловый конфликт с пакетом resource-agents
Package SDL2 updated to version 2.0.18-alt2 for branch sisyphus_e2k.
Closed bugs
Отсутствуют статические компоненты