ALT-BU-2023-2423-1
Branch sisyphus update bulletin.
Package alterator-bind updated to version 0.9.6-alt1 for branch sisyphus in task 314447.
Closed bugs
При изменении имени компьютера создаётся некорректный ddns-key.conf
Closed vulnerabilities
BDU:2023-00495
Уязвимость модуля mod_proxy_ajp веб-сервера Apache HTTP Server, позволяющая нарушителю отправить скрытый HTTP-запрос (атака типа HTTP Request Smuggling)
BDU:2023-00496
Уязвимость модуля mod_proxy веб-сервера Apache HTTP Server, позволяющая нарушителю выполнять атаки с разделением ответов HTTP
BDU:2023-01105
Уязвимость модуля mod_dav веб-сервера Apache HTTP Server, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-02-13
CVE-2006-20001
A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.
Modified: 2025-04-04
CVE-2022-36760
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.54 and prior versions.
Modified: 2025-04-04
CVE-2022-37436
Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. If the later headers have any security purpose, they will not be interpreted by the client.
Package lightdm-webkit2-greeter updated to version 3.5.2-alt1.1 for branch sisyphus in task 314536.
Closed bugs
web-greeter thows an UnicodeDecodeError: 'utf-8' codec can't decode byte 0xd0 in position 8
web-greeter thows an exception Widget: Must construct a QApplication before a QWidget
Package kernel-image-un-def updated to version 6.1.9-alt1 for branch sisyphus in task 314537.
Closed vulnerabilities
BDU:2023-00383
Уязвимость компонентa netfilter ядра операционной системы Linux, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и повысить свои привилегии.
BDU:2023-01572
Уязвимость функции stat() подсистемы OverlayFS ядра операционных систем Linux, позволяющая нарушителю повысить свои привилегии
Modified: 2024-11-21
CVE-2023-0179
A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.
- http://packetstormsecurity.com/files/171601/Kernel-Live-Patch-Security-Notice-LNS-0093-1.html
- http://packetstormsecurity.com/files/171601/Kernel-Live-Patch-Security-Notice-LNS-0093-1.html
- https://bugzilla.redhat.com/show_bug.cgi?id=2161713
- https://bugzilla.redhat.com/show_bug.cgi?id=2161713
- https://seclists.org/oss-sec/2023/q1/20
- https://seclists.org/oss-sec/2023/q1/20
- https://security.netapp.com/advisory/ntap-20230511-0003/
- https://security.netapp.com/advisory/ntap-20230511-0003/
Modified: 2025-02-26
CVE-2023-0386
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
- http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html
- http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a
- [debian-lts-announce] 20230605 [SECURITY] [DLA 3446-1] linux-5.10 security update
- [debian-lts-announce] 20230605 [SECURITY] [DLA 3446-1] linux-5.10 security update
- [debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security update
- [debian-lts-announce] 20240627 [SECURITY] [DLA 3840-1] linux security update
- https://security.netapp.com/advisory/ntap-20230420-0004/
- https://security.netapp.com/advisory/ntap-20230420-0004/
- DSA-5402
- DSA-5402
Closed bugs
Включить SFC_SIENA