ALT-BU-2022-5611-1
Branch sisyphus_e2k update bulletin.
Package perl-Image-ExifTool updated to version 12.42-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-23935
lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
- https://gist.github.com/ert-plus/1414276e4cb5d56dd431c2f0429e4429
- https://gist.github.com/ert-plus/1414276e4cb5d56dd431c2f0429e4429
- https://github.com/exiftool/exiftool/commit/74dbab1d2766d6422bb05b033ac6634bf8d1f582
- https://github.com/exiftool/exiftool/commit/74dbab1d2766d6422bb05b033ac6634bf8d1f582
Package rpm-build-python3 updated to version 0.1.19-alt1 for branch sisyphus_e2k.
Closed bugs
%python3_build does not work for PEP 517 conforming upstreams
Package seatd updated to version 0.7.0-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-25643
seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname.
- https://github.com/kennylevinsen/seatd/commit/10658dc5439db429af0088295a051c53925a4416
- https://github.com/kennylevinsen/seatd/commit/10658dc5439db429af0088295a051c53925a4416
- https://github.com/kennylevinsen/seatd/commit/7cffe0797fdb17a9c08922339465b1b187394335
- https://github.com/kennylevinsen/seatd/commit/7cffe0797fdb17a9c08922339465b1b187394335
- https://github.com/kennylevinsen/seatd/compare/0.6.3...0.6.4
- https://github.com/kennylevinsen/seatd/compare/0.6.3...0.6.4
- https://github.com/kennylevinsen/seatd/tags
- https://github.com/kennylevinsen/seatd/tags
- https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3E
- https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3E
- https://nvd.nist.gov/vuln/detail/CVE-2022-25643
- https://nvd.nist.gov/vuln/detail/CVE-2022-25643
Package glpi updated to version 10.0.2-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-04910
Уязвимость системы работы с заявками и инцидентами GLPI, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю осуществлять межсайтовые сценарные атаки
Modified: 2024-11-21
CVE-2022-31056
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.
- http://packetstormsecurity.com/files/171656/GLPI-10.0.2-SQL-Injection-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/171656/GLPI-10.0.2-SQL-Injection-Remote-Code-Execution.html
- https://github.com/glpi-project/glpi/security/advisories/GHSA-9q9x-7xxh-w4cg
- https://github.com/glpi-project/glpi/security/advisories/GHSA-9q9x-7xxh-w4cg
Modified: 2024-11-21
CVE-2022-31061
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
- https://github.com/glpi-project/glpi/commit/21ae07d00d0b3230f6235386e98388cfc5bb0514
- https://github.com/glpi-project/glpi/commit/21ae07d00d0b3230f6235386e98388cfc5bb0514
- https://github.com/glpi-project/glpi/security/advisories/GHSA-w2gc-v2gm-q7wq
- https://github.com/glpi-project/glpi/security/advisories/GHSA-w2gc-v2gm-q7wq
Modified: 2024-11-21
CVE-2022-31068
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.
- https://github.com/glpi-project/glpi/commit/9953a644777e4167b06db9e14fc93b945a557be5
- https://github.com/glpi-project/glpi/commit/9953a644777e4167b06db9e14fc93b945a557be5
- https://github.com/glpi-project/glpi/security/advisories/GHSA-g4hm-6vfr-q3wg
- https://github.com/glpi-project/glpi/security/advisories/GHSA-g4hm-6vfr-q3wg
Package sqlite3 updated to version 3.39.2-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-06495
Уязвимость API-библиотеки системы управления базами данных SQLite, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код
Modified: 2024-11-21
CVE-2022-35737
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
- https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/
- https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/
- https://kb.cert.org/vuls/id/720344
- https://kb.cert.org/vuls/id/720344
- GLSA-202210-40
- GLSA-202210-40
- https://security.netapp.com/advisory/ntap-20220915-0009/
- https://security.netapp.com/advisory/ntap-20220915-0009/
- https://sqlite.org/releaselog/3_39_2.html
- https://sqlite.org/releaselog/3_39_2.html
- https://www.sqlite.org/cves.html
- https://www.sqlite.org/cves.html
Package fontconfig updated to version 2.13.1-alt4 for branch sisyphus_e2k.
Closed bugs
fontconfig.filetrigger calls egrep(1)