ALT-BU-2023-2643-1
Branch sisyphus_riscv64 update bulletin.
Package python3-module-requests-cache updated to version 0.9.8-alt1 for branch sisyphus_riscv64.
Closed bugs
Недоступен бэкэнд sqlite
Package kernel-image-un-def updated to version 6.1.12-alt1.0.rv64 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2023-01205
Уязвимость функции rds_rm_zerocopy_callback() в модуле net/rds/message.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2023-1078
A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption.
- [oss-security] 20231105 CVE-2023-1078: Linux: rds_rm_zerocopy_callback() bugs
- [oss-security] 20231105 CVE-2023-1078: Linux: rds_rm_zerocopy_callback() bugs
- https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=f753a68980cf4b59a80fe677619da2b1804f526d
- https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=f753a68980cf4b59a80fe677619da2b1804f526d
- [debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update
- [debian-lts-announce] 20230502 [SECURITY] [DLA 3404-1] linux-5.10 security update
- [debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update
- [debian-lts-announce] 20230503 [SECURITY] [DLA 3403-1] linux security update
- https://security.netapp.com/advisory/ntap-20230505-0004/
- https://security.netapp.com/advisory/ntap-20230505-0004/
Package protobuf updated to version 3.21.12-alt0.2.rv64 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2022-06396
Уязвимость библиотеки среды выполнения Java Protocol Buffers protobuf-java, связанная с недостаточной проверкой входных данных, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2021-22569
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated pauses. We recommend upgrading libraries beyond the vulnerable versions.
- [oss-security] 20220112 CVE-2021-22569: Protobuf Java, Kotlin, JRuby DoS
- [oss-security] 20220112 CVE-2021-22569: Protobuf Java, Kotlin, JRuby DoS
- [oss-security] 20220112 Re: CVE-2021-22569: Protobuf Java, Kotlin, JRuby DoS
- [oss-security] 20220112 Re: CVE-2021-22569: Protobuf Java, Kotlin, JRuby DoS
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
- https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39330
- https://cloud.google.com/support/bulletins#gcp-2022-001
- https://cloud.google.com/support/bulletins#gcp-2022-001
- [debian-lts-announce] 20230418 [SECURITY] [DLA 3393-1] protobuf security update
- [debian-lts-announce] 20230418 [SECURITY] [DLA 3393-1] protobuf security update
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Modified: 2024-11-21
CVE-2022-3171
A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Package cups-x2go updated to version 3.0.1.4-alt1.1 for branch sisyphus_riscv64.
Closed bugs
Не работает печать из сеанса X2GO
Package pcsc-lite-ccid updated to version 1.5.2-alt1 for branch sisyphus_riscv64.
Closed bugs
картридер не видит смарт-карту
Package alterator-auth updated to version 0.44.0-alt1 for branch sisyphus_riscv64.
Closed bugs
При вводе клиента в домен FreeIPA через альтератор показывается ненужный чекбокс про групповые политики