ALT-BU-2022-7242-3
Branch p10 update bulletin.
Closed bugs
После завершения процесса, запущенного с помощью incrond, он остается в списке процессов в состоянии "defunc"
Closed vulnerabilities
BDU:2022-06933
Уязвимость параметров PAC (Privileged Attribute Certificate) функции krb5_parse_pac пакетов Heimdal и MIT Kerberos программы сетевого взаимодействия Samba, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2022-42898
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
- https://bugzilla.samba.org/show_bug.cgi?id=15203
- https://bugzilla.samba.org/show_bug.cgi?id=15203
- https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
- https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
- https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
- https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
- GLSA-202309-06
- GLSA-202309-06
- GLSA-202310-06
- GLSA-202310-06
- https://security.netapp.com/advisory/ntap-20230216-0008/
- https://security.netapp.com/advisory/ntap-20230216-0008/
- https://security.netapp.com/advisory/ntap-20230223-0001/
- https://security.netapp.com/advisory/ntap-20230223-0001/
- https://web.mit.edu/kerberos/advisories/
- https://web.mit.edu/kerberos/advisories/
- https://web.mit.edu/kerberos/krb5-1.19/
- https://web.mit.edu/kerberos/krb5-1.19/
- https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
- https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
- https://www.samba.org/samba/security/CVE-2022-42898.html
- https://www.samba.org/samba/security/CVE-2022-42898.html
Closed vulnerabilities
BDU:2015-03334
Уязвимости операционной системы Debian GNU/Linux, позволяющие локальному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-11-21
CVE-2005-1774
WEB-DAV Linux File System (davfs2) 0.2.3 does not properly enforce Unix permissions, which allows local users to write arbitrary files on a davfs2 mounted filesystem.
Modified: 2024-11-21
CVE-2013-4362
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.
- 97416
- 97416
- 97417
- 97417
- http://savannah.nongnu.org/bugs/?40034
- http://savannah.nongnu.org/bugs/?40034
- [oss-security] 20130918 Re: CVE request: davfs2 - Unsecure use of system()
- [oss-security] 20130918 Re: CVE request: davfs2 - Unsecure use of system()
- DSA-2765
- DSA-2765
- 62445
- 62445
- GLSA-201612-02
- GLSA-201612-02
Closed bugs
mount.davfs "из коробки" не работает от рута
Перестал работать mount.davfs
Package zoneminder updated to version 1.36.31-alt2 for branch p10 in task 309926.
Closed bugs
Неверно указан путь для сокета в файле zm-fcgi.inc из пакета zoneminder-nginx
Closed bugs
без xterm не работает
Closed vulnerabilities
BDU:2022-03378
Уязвимость функции ntfs_get_attribute_value файловой системы NTFS для модуля FUSE NTFS-3G, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями
BDU:2022-03700
Уязвимость функции ntfs_names_full_collate файловой системы NTFS для модуля FUSE NTFS-3G, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями
BDU:2022-03701
Уязвимость функции ntfs_mft_rec_alloc файловой системы NTFS для модуля FUSE NTFS-3G, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями
BDU:2022-03707
Уязвимость функции ntfs_check_log_client_array файловой системы NTFS для модуля FUSE NTFS-3G, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями
BDU:2022-03917
Уязвимость функции check_file_record файловой системы NTFS для модуля FUSE NTFS-3G, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями
BDU:2022-03919
Уязвимость функции fuse_kern_mount библиотеки libfuse-lite файловой системы NTFS для модуля FUSE NTFS-3G, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями
BDU:2022-03924
Уязвимость функции fuse_lib_readdir библиотеки libfuse-lite файловой системы NTFS для модуля FUSE NTFS-3G, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями
BDU:2022-03951
Уязвимость дескриптора файлов файловой системы NTFS для модуля FUSE NTFS-3G, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями
BDU:2022-06607
Уязвимость утилиты ntfs-3g набора драйверов NTFS-3G реализации файловой системы NTFS, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2021-46790
ntfsck in NTFS-3G through 2021.8.22 has a heap-based buffer overflow involving buffer+512*3-2. NOTE: the upstream position is that ntfsck is deprecated; however, it is shipped by some Linux distributions.
- [oss-security] 20220526 OPEN SOURCE NTFS-3G SECURITY ADVISORY NTFS3G-SA-2022-0001
- [oss-security] 20220526 OPEN SOURCE NTFS-3G SECURITY ADVISORY NTFS3G-SA-2022-0001
- https://github.com/tuxera/ntfs-3g/issues/16
- https://github.com/tuxera/ntfs-3g/issues/16
- FEDORA-2022-8f775872c9
- FEDORA-2022-8f775872c9
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-1176b501f0
- FEDORA-2022-1176b501f0
- DSA-5160
- DSA-5160
Modified: 2024-11-21
CVE-2022-30783
An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite.
- [oss-security] 20220607 UNPAR-2022-0 Multiple Vulnerabilities in ntfs-3g NTFS Mount Tool
- [oss-security] 20220607 UNPAR-2022-0 Multiple Vulnerabilities in ntfs-3g NTFS Mount Tool
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- FEDORA-2022-8f775872c9
- FEDORA-2022-8f775872c9
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-1176b501f0
- FEDORA-2022-1176b501f0
- GLSA-202301-01
- GLSA-202301-01
- DSA-5160
- DSA-5160
Modified: 2024-11-21
CVE-2022-30784
A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- FEDORA-2022-8f775872c9
- FEDORA-2022-8f775872c9
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-1176b501f0
- FEDORA-2022-1176b501f0
- GLSA-202301-01
- GLSA-202301-01
- DSA-5160
- DSA-5160
Modified: 2024-11-21
CVE-2022-30785
A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
- [oss-security] 20220607 UNPAR-2022-0 Multiple Vulnerabilities in ntfs-3g NTFS Mount Tool
- [oss-security] 20220607 UNPAR-2022-0 Multiple Vulnerabilities in ntfs-3g NTFS Mount Tool
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- FEDORA-2022-8f775872c9
- FEDORA-2022-8f775872c9
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-1176b501f0
- FEDORA-2022-1176b501f0
- GLSA-202301-01
- GLSA-202301-01
- DSA-5160
- DSA-5160
Modified: 2024-11-21
CVE-2022-30786
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- FEDORA-2022-8f775872c9
- FEDORA-2022-8f775872c9
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-1176b501f0
- FEDORA-2022-1176b501f0
- GLSA-202301-01
- GLSA-202301-01
- DSA-5160
- DSA-5160
Modified: 2024-11-21
CVE-2022-30787
An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
- [oss-security] 20220607 UNPAR-2022-0 Multiple Vulnerabilities in ntfs-3g NTFS Mount Tool
- [oss-security] 20220607 UNPAR-2022-0 Multiple Vulnerabilities in ntfs-3g NTFS Mount Tool
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-6mv4-4v73-xw58
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- FEDORA-2022-8f775872c9
- FEDORA-2022-8f775872c9
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-1176b501f0
- FEDORA-2022-1176b501f0
- GLSA-202301-01
- GLSA-202301-01
- DSA-5160
- DSA-5160
Modified: 2024-11-21
CVE-2022-30788
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- FEDORA-2022-8f775872c9
- FEDORA-2022-8f775872c9
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-1176b501f0
- FEDORA-2022-1176b501f0
- GLSA-202301-01
- GLSA-202301-01
- DSA-5160
- DSA-5160
Modified: 2024-11-21
CVE-2022-30789
A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- [debian-lts-announce] 20220621 [SECURITY] [DLA 3055-1] ntfs-3g security update
- FEDORA-2022-8f775872c9
- FEDORA-2022-8f775872c9
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-13bc8c91b0
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-8fa7e5aeaf
- FEDORA-2022-1176b501f0
- FEDORA-2022-1176b501f0
- GLSA-202301-01
- GLSA-202301-01
- DSA-5160
- DSA-5160
Modified: 2024-11-21
CVE-2022-40284
A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if the ntfs-3g binary is setuid root. A physically proximate attacker can exploit this if NTFS-3G software is configured to execute upon attachment of an external storage device.
- http://www.openwall.com/lists/oss-security/2022/10/31/2
- http://www.openwall.com/lists/oss-security/2022/10/31/2
- https://github.com/tuxera/ntfs-3g/releases
- https://github.com/tuxera/ntfs-3g/releases
- [debian-lts-announce] 20221121 [SECURITY] [DLA 3201-1] ntfs-3g security update
- [debian-lts-announce] 20221121 [SECURITY] [DLA 3201-1] ntfs-3g security update
- FEDORA-2022-14f11bfc73
- FEDORA-2022-14f11bfc73
- FEDORA-2022-4915124227
- FEDORA-2022-4915124227
- FEDORA-2022-243616c548
- FEDORA-2022-243616c548
- GLSA-202301-01
- GLSA-202301-01