ALT-BU-2022-3687-1
Branch sisyphus_riscv64 update bulletin.
Package cryptsetup updated to version 2.4.3-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2021-4122
It was found that a specially crafted LUKS header could trick cryptsetup into disabling encryption during the recovery of the device. An attacker with physical access to the medium, such as a flash disk, could use this flaw to force a user into permanently disabling the encryption layer of that medium.
- https://access.redhat.com/security/cve/CVE-2021-4122
- https://access.redhat.com/security/cve/CVE-2021-4122
- https://bugzilla.redhat.com/show_bug.cgi?id=2031859
- https://bugzilla.redhat.com/show_bug.cgi?id=2031859
- https://bugzilla.redhat.com/show_bug.cgi?id=2032401
- https://bugzilla.redhat.com/show_bug.cgi?id=2032401
- https://gitlab.com/cryptsetup/cryptsetup/-/commit/0113ac2d889c5322659ad0596d4cfc6da53e356c
- https://gitlab.com/cryptsetup/cryptsetup/-/commit/0113ac2d889c5322659ad0596d4cfc6da53e356c
- https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.3-ReleaseNotes
- https://mirrors.edge.kernel.org/pub/linux/utils/cryptsetup/v2.4/v2.4.3-ReleaseNotes
Package clamav updated to version 0.103.5-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2022-00587
Уязвимость пакета антивирусного ПО Clam AntiVirus, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю выполнить отказ в обслуживании
Modified: 2024-11-21
CVE-2022-20698
A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.
Package expat updated to version 2.4.3-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2022-00800
Уязвимость функции defineAttribute файла xmlparse.c библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-00805
Уязвимость функции lookupl файла xmlparse.c библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01003
Уязвимость функции storeAtts() библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01052
Уязвимость функции doProlog (xmlparse.c) библиотеки Expat, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2022-01058
Уязвимость функции storeAtts (xmlparse.c) библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код
BDU:2022-01059
Уязвимость функции nextScaffoldPart (xmlparse.c) библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код
BDU:2022-01060
Уязвимость функции build_model (xmlparse.c) библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код
BDU:2022-02823
Уязвимость функции addBinding() библиотеки Expat, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-45960
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://bugzilla.mozilla.org/show_bug.cgi?id=1217609
- https://bugzilla.mozilla.org/show_bug.cgi?id=1217609
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/issues/531
- https://github.com/libexpat/libexpat/issues/531
- https://github.com/libexpat/libexpat/pull/534
- https://github.com/libexpat/libexpat/pull/534
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220121-0004/
- https://security.netapp.com/advisory/ntap-20220121-0004/
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Modified: 2024-11-21
CVE-2021-46143
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/issues/532
- https://github.com/libexpat/libexpat/issues/532
- https://github.com/libexpat/libexpat/pull/538
- https://github.com/libexpat/libexpat/pull/538
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220121-0006/
- https://security.netapp.com/advisory/ntap-20220121-0006/
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Modified: 2024-11-21
CVE-2022-22822
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Modified: 2024-11-21
CVE-2022-22823
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Modified: 2024-11-21
CVE-2022-22824
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Modified: 2024-11-21
CVE-2022-22825
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Modified: 2024-11-21
CVE-2022-22826
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Modified: 2024-11-21
CVE-2022-22827
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- [oss-security] 20220117 Expat 2.4.3 released, includes 8 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/539
- https://github.com/libexpat/libexpat/pull/539
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05