ALT-BU-2022-4344-1
Branch sisyphus_mipsel update bulletin.
Package liblucene++ updated to version 3.0.8-alt2 for branch sisyphus_mipsel.
Closed bugs
Прошу обновить liblucene++
Package libwebkitgtk4 updated to version 2.34.6-alt0.1.mips1 for branch sisyphus_mipsel.
Closed vulnerabilities
BDU:2021-06030
Уязвимость модуля отображения веб-страниц WPE WebKit браузера Safari для операционных систем iOS, iPadOS, tvOS, watchOS, macOS, связанная с ошибками смешения типов данных, позволяющая нарушителю выполнить произвольный код
BDU:2021-06107
Уязвимость модуля отображения веб-страниц WPE WebKit браузера Safari для операционных систем iOS, iPadOS, tvOS, watchOS, macOS, связанная с использованием памяти после ее освобождения, позволяющая нарушителю выполнить произвольный код
BDU:2022-00665
Уязвимость модулей отображения веб-страниц WebKitGTK и WPE WebKit, связанная с чтением за границами буфера в памяти, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
BDU:2022-05674
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-05675
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с использованием открытой переадресации, позволяющая нарушителю получить доступ к конфиденциальным данным
BDU:2022-05694
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с копированием буфера без проверки входных данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2022-05708
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с использованием недоверенного файла междоменной политики, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-05779
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с передачей защищаемой информации в незашифрованном виде, позволяющая нарушителю оказать воздействие на целостность данных
BDU:2022-05787
Уязвимость модуля отображения веб-страниц WPE WebKit, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю получить доступ к конфиденциальным данным
Modified: 2024-11-21
CVE-2021-30809
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 15, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing maliciously crafted web content may lead to arbitrary code execution.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30818
A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, iOS 15 and iPadOS 15, Safari 15, watchOS 8. Processing maliciously crafted web content may lead to arbitrary code execution.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30823
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 14.8 and iPadOS 14.8, tvOS 15, Safari 15, watchOS 8. An attacker in a privileged network position may be able to bypass HSTS.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212816
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/kb/HT212953
- https://support.apple.com/kb/HT212953
Modified: 2024-11-21
CVE-2021-30836
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 14.8 and iPadOS 14.8, tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Processing a maliciously crafted audio file may disclose restricted memory.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212807
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212816
- https://support.apple.com/kb/HT212816
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212814
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212815
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/en-us/HT212819
- https://support.apple.com/kb/HT212869
- https://support.apple.com/kb/HT212869
Modified: 2024-11-21
CVE-2021-30887
A logic issue was addressed with improved restrictions. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to unexpectedly unenforced Content Security Policy.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- FEDORA-2022-25a98f5d55
- FEDORA-2022-25a98f5d55
- FEDORA-2022-f7366e60cb
- FEDORA-2022-f7366e60cb
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
- DSA-5030
- DSA-5030
- DSA-5031
- DSA-5031
Modified: 2024-11-21
CVE-2021-30888
An information leakage issue was addressed. This issue is fixed in iOS 15.1 and iPadOS 15.1, macOS Monterey 12.0.1, iOS 14.8.1 and iPadOS 14.8.1, tvOS 15.1, watchOS 8.1. A malicious website using Content Security Policy reports may be able to leak information via redirect behavior .
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212868
- https://support.apple.com/en-us/HT212868
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
Modified: 2024-11-21
CVE-2021-30889
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to arbitrary code execution.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
Modified: 2024-11-21
CVE-2021-30890
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.0.1, iOS 15.1 and iPadOS 15.1, watchOS 8.1, tvOS 15.1. Processing maliciously crafted web content may lead to universal cross site scripting.
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- [oss-security] 20211220 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0007
- FEDORA-2022-25a98f5d55
- FEDORA-2022-25a98f5d55
- FEDORA-2022-f7366e60cb
- FEDORA-2022-f7366e60cb
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212867
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212869
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212874
- https://support.apple.com/en-us/HT212876
- https://support.apple.com/en-us/HT212876
- DSA-5030
- DSA-5030
- DSA-5031
- DSA-5031
Modified: 2024-11-21
CVE-2021-30897
An issue existed in the specification for the resource timing API. The specification was updated and the updated specification was implemented. This issue is fixed in macOS Monterey 12.0.1. A malicious website may exfiltrate data cross-origin.
Modified: 2024-11-21
CVE-2021-42762
BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.
- [oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211026 WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- [oss-security] 20211027 Re: WebKitGTK and WPE WebKit Security Advisory WSA-2021-0006
- https://bugs.webkit.org/show_bug.cgi?id=231479
- https://bugs.webkit.org/show_bug.cgi?id=231479
- https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
- https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
- FEDORA-2021-483d896d1d
- FEDORA-2021-483d896d1d
- FEDORA-2021-db6ebb2d68
- FEDORA-2021-db6ebb2d68
- FEDORA-2021-131360fa9a
- FEDORA-2021-131360fa9a
- DSA-4995
- DSA-4995
- DSA-4996
- DSA-4996
Modified: 2024-11-21
CVE-2021-45481
In WebKitGTK before 2.32.4, there is incorrect memory allocation in WebCore::ImageBufferCairoImageSurfaceBackend::create, leading to a segmentation violation and application crash, a different vulnerability than CVE-2021-30889.
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
Modified: 2024-11-21
CVE-2021-45482
In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::ContainerNode::firstChild, a different vulnerability than CVE-2021-30889.
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
Modified: 2024-11-21
CVE-2021-45483
In WebKitGTK before 2.32.4, there is a use-after-free in WebCore::Frame::page, a different vulnerability than CVE-2021-30889.
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- [oss-security] 20220121 WebKitGTK and WPE WebKit Security Advisory WSA-2022-0001
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
- https://github.com/ChijinZ/security_advisories/tree/master/webkitgtk-2.32.3
Package epiphany updated to version 41.3-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
BDU:2022-05569
Уязвимость реализации сценария ephy-about:overview веб-браузера Epiphany, позволяющая нарушителю проводить межсайтовые сценарные атаки
Modified: 2024-11-21
CVE-2021-45085
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list.
- https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612
- https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612
- https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045
- https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045
- [debian-lts-announce] 20220818 [SECURITY] [DLA 3074-1] epiphany-browser security update
- [debian-lts-announce] 20220818 [SECURITY] [DLA 3074-1] epiphany-browser security update
- DSA-5042
- DSA-5042
Modified: 2024-11-21
CVE-2021-45086
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js.
Modified: 2024-11-21
CVE-2021-45087
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title.
- https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612
- https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612
- https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045
- https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045
- [debian-lts-announce] 20220818 [SECURITY] [DLA 3074-1] epiphany-browser security update
- [debian-lts-announce] 20220818 [SECURITY] [DLA 3074-1] epiphany-browser security update
- DSA-5042
- DSA-5042
Modified: 2024-11-21
CVE-2021-45088
XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page.
- https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612
- https://gitlab.gnome.org/GNOME/epiphany/-/issues/1612
- https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045
- https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1045
- [debian-lts-announce] 20220818 [SECURITY] [DLA 3074-1] epiphany-browser security update
- [debian-lts-announce] 20220818 [SECURITY] [DLA 3074-1] epiphany-browser security update
- DSA-5042
- DSA-5042
Package fish updated to version 3.4.0-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
BDU:2022-01726
Уязвимость оболочки командной строки fish, связанная с недостатками процедуры нейтрализации особых элементов в выходных данных, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2022-20001
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs `git` commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the `fish_git_prompt` function from the prompt.
- https://github.com/fish-shell/fish-shell/pull/8589
- https://github.com/fish-shell/fish-shell/pull/8589
- https://github.com/fish-shell/fish-shell/releases/tag/3.4.0
- https://github.com/fish-shell/fish-shell/releases/tag/3.4.0
- https://github.com/fish-shell/fish-shell/security/advisories/GHSA-pj5f-6vxj-f5mq
- https://github.com/fish-shell/fish-shell/security/advisories/GHSA-pj5f-6vxj-f5mq
- FEDORA-2022-cd2c5e0634
- FEDORA-2022-cd2c5e0634
- FEDORA-2022-443c5ec2dd
- FEDORA-2022-443c5ec2dd
- GLSA-202309-10
- GLSA-202309-10
- DSA-5234
- DSA-5234
Package python3 updated to version 3.10.3-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
BDU:2019-02881
Уязвимость функции BZ2_decompress утилиты для сжатия данных bzip2, позволяющая нарушителю выполнить произвольный код
BDU:2021-01720
Уязвимость функции bzip2recover программного обеспечения для сжатия данных Bzip2, связанная с использованием после освобождения, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2016-3189
Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
- http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
- http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
- http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
- [oss-security] 20160620 CVE-2016-3189: bzip2 use-after-free on bzip2recover
- [oss-security] 20160620 CVE-2016-3189: bzip2 use-after-free on bzip2recover
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
- 91297
- 91297
- 1036132
- 1036132
- https://bugzilla.redhat.com/show_bug.cgi?id=1319648
- https://bugzilla.redhat.com/show_bug.cgi?id=1319648
- [kafka-jira] 20200414 [jira] [Commented] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20200414 [jira] [Commented] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-dev] 20210729 [jira] [Resolved] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-dev] 20210729 [jira] [Resolved] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20200413 [jira] [Created] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20200413 [jira] [Created] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20210729 [jira] [Resolved] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20210729 [jira] [Resolved] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20210729 [jira] [Commented] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20210729 [jira] [Commented] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20210729 [jira] [Commented] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20210729 [jira] [Commented] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20200413 [jira] [Updated] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20200413 [jira] [Updated] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka
- [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka
- [kafka-dev] 20200413 [jira] [Created] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-dev] 20200413 [jira] [Created] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20210729 [jira] [Comment Edited] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [kafka-jira] 20210729 [jira] [Comment Edited] (KAFKA-9858) CVE-2016-3189 Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
- [debian-lts-announce] 20190624 [SECURITY] [DLA 1833-1] bzip2 security update
- [debian-lts-announce] 20190624 [SECURITY] [DLA 1833-1] bzip2 security update
- 20190806 FreeBSD Security Advisory FreeBSD-SA-19:18.bzip2
- 20190806 FreeBSD Security Advisory FreeBSD-SA-19:18.bzip2
- 20190715 [slackware-security] bzip2 (SSA:2019-195-01)
- 20190715 [slackware-security] bzip2 (SSA:2019-195-01)
- FreeBSD-SA-19:18
- FreeBSD-SA-19:18
- GLSA-201708-08
- GLSA-201708-08
- USN-4038-1
- USN-4038-1
- USN-4038-2
- USN-4038-2
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
Modified: 2024-11-21
CVE-2019-12900
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
- openSUSE-SU-2019:1781
- openSUSE-SU-2019:1781
- openSUSE-SU-2019:1918
- openSUSE-SU-2019:1918
- openSUSE-SU-2019:2595
- openSUSE-SU-2019:2595
- openSUSE-SU-2019:2597
- openSUSE-SU-2019:2597
- http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
- http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
- http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
- http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
- https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc
- https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc
- [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka
- [kafka-users] 20200413 CVEs for the dependency software guava and rocksdbjni of Kafka
- [flink-user] 20210717 Re: Flink 1.13.1 - Vulnerabilities CVE-2019-12900 for librocksdbjni
- [flink-user] 20210717 Re: Flink 1.13.1 - Vulnerabilities CVE-2019-12900 for librocksdbjni
- [flink-user] 20210716 Flink 1.13.1 - Vulnerabilities CVE-2019-12900 for librocksdbjni
- [flink-user] 20210716 Flink 1.13.1 - Vulnerabilities CVE-2019-12900 for librocksdbjni
- [debian-lts-announce] 20190624 [SECURITY] [DLA 1833-1] bzip2 security update
- [debian-lts-announce] 20190624 [SECURITY] [DLA 1833-1] bzip2 security update
- [debian-lts-announce] 20190718 [SECURITY] [DLA 1833-2] bzip2 regression update
- [debian-lts-announce] 20190718 [SECURITY] [DLA 1833-2] bzip2 regression update
- [debian-lts-announce] 20191010 [SECURITY] [DLA 1953-1] clamav security update
- [debian-lts-announce] 20191010 [SECURITY] [DLA 1953-1] clamav security update
- [debian-lts-announce] 20191014 [SECURITY] [DLA 1953-2] clamav regression update
- [debian-lts-announce] 20191014 [SECURITY] [DLA 1953-2] clamav regression update
- 20190806 FreeBSD Security Advisory FreeBSD-SA-19:18.bzip2
- 20190806 FreeBSD Security Advisory FreeBSD-SA-19:18.bzip2
- 20190715 [slackware-security] bzip2 (SSA:2019-195-01)
- 20190715 [slackware-security] bzip2 (SSA:2019-195-01)
- FreeBSD-SA-19:18
- FreeBSD-SA-19:18
- https://support.f5.com/csp/article/K68713584?utm_source=f5support&%3Butm_medium=RSS
- https://support.f5.com/csp/article/K68713584?utm_source=f5support&%3Butm_medium=RSS
- USN-4038-1
- USN-4038-1
- USN-4038-2
- USN-4038-2
- USN-4146-1
- USN-4146-1
- USN-4146-2
- USN-4146-2
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
Package apt updated to version 0.5.15lorg2-alt77 for branch sisyphus_mipsel.
Closed bugs
wrapper for apt-shell