ALT-BU-2022-4117-1
Branch sisyphus_e2k update bulletin.
Package python3-module-tabulate updated to version 0.8.9-alt1 for branch sisyphus_e2k.
Closed bugs
tabulate failure on python 3.10: ImportError: cannot import name 'Iterable' from 'collections'
Package python3-module-httplib2 updated to version 0.20.4-alt1 for branch sisyphus_e2k.
Closed bugs
httplib2/auth.py: module 'pyparsing' has no attribute 'downcaseTokens'
Package python3-module-Pillow updated to version 9.0.1-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-00581
Уязвимость функции path_getbbox (path.c) библиотеки изображений Python Pillow, связанная с неверным ограничением пути к каталогу, позволяющая нарушителю получить доступ к произвольным файлам в системе
BDU:2022-00582
Уязвимость функции path_getbbox (path.c) библиотеки изображений Python Pillow, связанная с чтением за границами буфера, позволяющая нарушителю получить доступ к конфиденциальной информации
BDU:2022-00583
Уязвимость компонента PIL.ImageMath.eval библиотеки изображений Python Pillow, связанная с использованием опасных методов или функций, позволяющая нарушителю выполнить произвольный код
BDU:2023-01714
Уязвимость библиотеки для работы с растровой графикой Pillow, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю нарушить целостность данных, а также вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2022-22815
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.
- https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
- https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
- [debian-lts-announce] 20220123 [SECURITY] [DLA 2893-1] pillow security update
- [debian-lts-announce] 20220123 [SECURITY] [DLA 2893-1] pillow security update
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
- GLSA-202211-10
- GLSA-202211-10
- DSA-5053
- DSA-5053
Modified: 2024-11-21
CVE-2022-22816
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.
- https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
- https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae44c8499f3/src/path.c#L331
- [debian-lts-announce] 20220123 [SECURITY] [DLA 2893-1] pillow security update
- [debian-lts-announce] 20220123 [SECURITY] [DLA 2893-1] pillow security update
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling
- GLSA-202211-10
- GLSA-202211-10
- DSA-5053
- DSA-5053
Modified: 2024-11-21
CVE-2022-22817
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method. A lambda expression could also be used.
- [debian-lts-announce] 20220123 [SECURITY] [DLA 2893-1] pillow security update
- [debian-lts-announce] 20220123 [SECURITY] [DLA 2893-1] pillow security update
- [debian-lts-announce] 20240322 [SECURITY] [DLA 3768-1] pillow security update
- [debian-lts-announce] 20240322 [SECURITY] [DLA 3768-1] pillow security update
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- GLSA-202211-10
- GLSA-202211-10
- DSA-5053
- DSA-5053
Modified: 2024-11-21
CVE-2022-24303
Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
- https://github.com/python-pillow/Pillow/pull/3450
- https://github.com/python-pillow/Pillow/pull/3450
- FEDORA-2022-ee15b98ea1
- FEDORA-2022-ee15b98ea1
- FEDORA-2022-64332f2a7c
- FEDORA-2022-64332f2a7c
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- https://pillow.readthedocs.io/en/stable/releasenotes/9.0.1.html#security
- GLSA-202211-10
- GLSA-202211-10
Package python3-module-lxml updated to version 4.7.1-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-00756
Уязвимость реализации модуля Class Cleaner библиотеки для обработки разметки XML и HTML Lxml, позволяющая нарушителю осуществлять межсайтовые сценарные атаки
Modified: 2024-11-21
CVE-2021-43818
lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.
- https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
- https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a
- https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776
- https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776
- https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
- https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0
- https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
- https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8
- [debian-lts-announce] 20211230 [SECURITY] [DLA 2871-1] lxml security update
- [debian-lts-announce] 20211230 [SECURITY] [DLA 2871-1] lxml security update
- FEDORA-2022-96c79bf003
- FEDORA-2022-96c79bf003
- FEDORA-2022-7129fbaeed
- FEDORA-2022-7129fbaeed
- FEDORA-2021-9f9e7c5c4f
- FEDORA-2021-9f9e7c5c4f
- FEDORA-2021-6e8fb79f90
- FEDORA-2021-6e8fb79f90
- GLSA-202208-06
- GLSA-202208-06
- https://security.netapp.com/advisory/ntap-20220107-0005/
- https://security.netapp.com/advisory/ntap-20220107-0005/
- DSA-5043
- DSA-5043
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Package php7 updated to version 7.4.28-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-curl updated to version 7.4.28-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-gd updated to version 7.4.28-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-pdo_mysql updated to version 7.4.28-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-pgsql updated to version 7.4.28-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-zip updated to version 7.4.28-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-xsl updated to version 7.4.28-alt1.1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-intl updated to version 7.4.28-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-opcache updated to version 7.4.28-alt1.1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-xmlrpc updated to version 7.4.28-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-tidy updated to version 7.4.28-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php7-openssl updated to version 7.4.28-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package wireshark updated to version 3.6.2-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-0581
Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0581.json
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0581.json
- https://gitlab.com/wireshark/wireshark/-/issues/17935
- https://gitlab.com/wireshark/wireshark/-/issues/17935
- [debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security update
- [debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security update
- FEDORA-2022-5a3603afe0
- FEDORA-2022-5a3603afe0
- FEDORA-2022-e29665a42b
- FEDORA-2022-e29665a42b
- GLSA-202210-04
- GLSA-202210-04
- https://www.wireshark.org/security/wnpa-sec-2022-05.html
- https://www.wireshark.org/security/wnpa-sec-2022-05.html
Modified: 2024-11-21
CVE-2022-0582
Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0582.json
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0582.json
- https://gitlab.com/wireshark/wireshark/-/issues/17882
- https://gitlab.com/wireshark/wireshark/-/issues/17882
- [debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security update
- [debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security update
- FEDORA-2022-5a3603afe0
- FEDORA-2022-5a3603afe0
- FEDORA-2022-e29665a42b
- FEDORA-2022-e29665a42b
- GLSA-202210-04
- GLSA-202210-04
- https://www.wireshark.org/security/wnpa-sec-2022-04.html
- https://www.wireshark.org/security/wnpa-sec-2022-04.html
Modified: 2024-11-21
CVE-2022-0583
Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0583.json
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0583.json
- https://gitlab.com/wireshark/wireshark/-/issues/17840
- https://gitlab.com/wireshark/wireshark/-/issues/17840
- [debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security update
- [debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security update
- FEDORA-2022-5a3603afe0
- FEDORA-2022-5a3603afe0
- FEDORA-2022-e29665a42b
- FEDORA-2022-e29665a42b
- GLSA-202210-04
- GLSA-202210-04
- https://www.wireshark.org/security/wnpa-sec-2022-03.html
- https://www.wireshark.org/security/wnpa-sec-2022-03.html
Modified: 2024-11-21
CVE-2022-0585
Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0585.json
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0585.json
- [debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security update
- [debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security update
- FEDORA-2022-5a3603afe0
- FEDORA-2022-5a3603afe0
- FEDORA-2022-e29665a42b
- FEDORA-2022-e29665a42b
- GLSA-202210-04
- GLSA-202210-04
- https://www.wireshark.org/security/wnpa-sec-2022-02.html
- https://www.wireshark.org/security/wnpa-sec-2022-02.html
Modified: 2024-11-21
CVE-2022-0586
Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0586.json
- https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0586.json
- https://gitlab.com/wireshark/wireshark/-/issues/17813
- https://gitlab.com/wireshark/wireshark/-/issues/17813
- [debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security update
- [debian-lts-announce] 20220331 [SECURITY] [DLA 2967-1] wireshark security update
- FEDORA-2022-5a3603afe0
- FEDORA-2022-5a3603afe0
- FEDORA-2022-e29665a42b
- FEDORA-2022-e29665a42b
- GLSA-202210-04
- GLSA-202210-04
- https://www.wireshark.org/security/wnpa-sec-2022-01.html
- https://www.wireshark.org/security/wnpa-sec-2022-01.html
Package wolfssl updated to version 5.2.0-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-25638
In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig_algo field differs between the certificate_verify message and the certificate message.
Modified: 2024-11-21
CVE-2022-25640
In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificate_verify message from the handshake, and never present a certificate.
Package python3-module-django updated to version 3.2.12-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-00584
Уязвимость фреймворка для веб-приложений Django, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю провести атаку межсайтового скриптинга
BDU:2022-00585
Уязвимость фреймворка для веб-приложений Django, связанная с выполнением цикла с недоступным условием выхода, позволяющая нарушителю выполнить отказ в обслуживании
Modified: 2024-11-21
CVE-2022-22818
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://groups.google.com/forum/#%21forum/django-announce
- FEDORA-2022-e7fd530688
- FEDORA-2022-e7fd530688
- https://security.netapp.com/advisory/ntap-20220221-0003/
- https://security.netapp.com/advisory/ntap-20220221-0003/
- DSA-5254
- DSA-5254
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
Modified: 2024-11-21
CVE-2022-23833
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a
- https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a
- https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
- https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
- https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9
- https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9
- https://groups.google.com/forum/#%21forum/django-announce
- https://groups.google.com/forum/#%21forum/django-announce
- FEDORA-2022-e7fd530688
- FEDORA-2022-e7fd530688
- https://security.netapp.com/advisory/ntap-20220221-0003/
- https://security.netapp.com/advisory/ntap-20220221-0003/
- DSA-5254
- DSA-5254
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
Package php8.1 updated to version 8.1.3-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package php8.0 updated to version 8.0.16-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-05350
Уязвимость функции php_filter_float() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.
Package startup-rescue updated to version 0.41-alt1 for branch sisyphus_e2k.
Closed bugs
mount-system не поддерживает кавычки в UUID