ALT-BU-2022-7559-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-4415
A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.
- https://github.com/systemd/systemd/commit/b7641425659243c09473cd8fb3aef2c0d4a3eb9c
- https://github.com/systemd/systemd/commit/b7641425659243c09473cd8fb3aef2c0d4a3eb9c
- https://security.netapp.com/advisory/ntap-20230216-0010/
- https://www.openwall.com/lists/oss-security/2022/12/21/3
- https://www.openwall.com/lists/oss-security/2022/12/21/3
Package xfce4-docklike-plugin updated to version 0.4.0-alt1 for branch sisyphus in task 312275.
Closed bugs
Обновить до последней версии
Package thunderbird updated to version 102.6.1-alt1 for branch sisyphus in task 312280.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2022-46874
A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.
*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.
- https://bugzilla.mozilla.org/show_bug.cgi?id=1746139
- https://bugzilla.mozilla.org/show_bug.cgi?id=1746139
- GLSA-202305-06
- GLSA-202305-06
- GLSA-202305-13
- GLSA-202305-13
- https://www.mozilla.org/security/advisories/mfsa2022-51/
- https://www.mozilla.org/security/advisories/mfsa2022-51/
- https://www.mozilla.org/security/advisories/mfsa2022-52/
- https://www.mozilla.org/security/advisories/mfsa2022-52/
- https://www.mozilla.org/security/advisories/mfsa2022-53/
- https://www.mozilla.org/security/advisories/mfsa2022-53/
- https://www.mozilla.org/security/advisories/mfsa2022-54/
- https://www.mozilla.org/security/advisories/mfsa2022-54/
Package kernel-image-centos updated to version 5.14.0.226-alt1.el9 for branch sisyphus in task 312282.
Closed vulnerabilities
BDU:2022-07074
Уязвимость функций l2cap_connect и l2cap_le_connect_req (net/bluetooth/l2cap_core.c) ядра операционных систем Linux, позволяющая нарушителю выполнить произвольный код
BDU:2023-00659
Уязвимость драйвера Broadcom Full MAC Wi-Fi (drivers/net/wireless/broadcom/brcm80211/brcmfmac) ядра операционных систем Linux, позволяющая нарушителю повысить свои привилегии или вызвать отказ в обслуживании
Modified: 2024-12-27
CVE-2022-21505
In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Modified: 2024-11-21
CVE-2022-3628
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c?id=6788ba8aed4e28e90f72d68a9d794e34eac17295
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c?id=6788ba8aed4e28e90f72d68a9d794e34eac17295
Modified: 2024-11-21
CVE-2022-42896
There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow code execution and leaking kernel memory (respectively) remotely via Bluetooth. A remote attacker could execute code leaking kernel memory via Bluetooth if within proximity of the victim. We recommend upgrading past commit https://www.google.com/url https://github.com/torvalds/linux/commit/711f8c3fb3db61897080468586b970c87c61d9e4 https://www.google.com/url