ALT-BU-2023-2800-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2020-29600
In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501.
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891469
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891469
- https://github.com/eldy/awstats/issues/90
- https://github.com/eldy/awstats/issues/90
- [debian-lts-announce] 20201223 [SECURITY] [DLA 2506-1] awstats security update
- [debian-lts-announce] 20201223 [SECURITY] [DLA 2506-1] awstats security update
- FEDORA-2020-d1aa0e030c
- FEDORA-2020-d1aa0e030c
Modified: 2024-11-21
CVE-2020-35176
In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600.
- https://github.com/eldy/awstats/issues/195
- https://github.com/eldy/awstats/issues/195
- [debian-lts-announce] 20201223 [SECURITY] [DLA 2506-1] awstats security update
- [debian-lts-announce] 20201223 [SECURITY] [DLA 2506-1] awstats security update
- FEDORA-2020-d1aa0e030c
- FEDORA-2020-d1aa0e030c
- FEDORA-2020-4cba5f2846
- FEDORA-2020-4cba5f2846
Modified: 2024-11-21
CVE-2022-46391
AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.
- https://github.com/eldy/AWStats/pull/226
- https://github.com/eldy/AWStats/pull/226
- [debian-lts-announce] 20221205 [SECURITY] [DLA 3225-1] awstats security update
- [debian-lts-announce] 20221205 [SECURITY] [DLA 3225-1] awstats security update
- FEDORA-2023-b645c7feda
- FEDORA-2023-b645c7feda
- FEDORA-2023-fda5480804
- FEDORA-2023-fda5480804
Package whatsapp-for-linux updated to version 1.6.1-alt1 for branch sisyphus in task 316370.
Closed bugs
Обновление до версии whatsapp-for-linux 1.5.2
Package chromium-gost updated to version 110.0.5481.177-alt2 for branch sisyphus in task 316385.
Closed vulnerabilities
BDU:2023-00957
Уязвимость библиотеки SwiftShader браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность данных
BDU:2023-00958
Уязвимость компонента Video браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-00959
Уязвимость режима рендеринга Vulkan браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2023-00960
Уязвимость реализации технологии WebRTC браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2023-00961
Уязвимость функции PDF Viewer браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2023-00972
Уязвимость реализации прикладного программного интерфейса Web Payments браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
BDU:2023-00973
Уязвимость компонента Prompts браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-00974
Уязвимость компонента Video браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
Modified: 2024-11-21
CVE-2023-0927
Use after free in Web Payments API in Google Chrome on Android prior to 110.0.5481.177 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://crbug.com/1414738
- https://crbug.com/1414738
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202309-17
Modified: 2024-11-21
CVE-2023-0928
Use after free in SwiftShader in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://crbug.com/1309035
- https://crbug.com/1309035
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202309-17
Modified: 2024-11-21
CVE-2023-0929
Use after free in Vulkan in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://crbug.com/1399742
- https://crbug.com/1399742
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202309-17
Modified: 2024-11-21
CVE-2023-0930
Heap buffer overflow in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://crbug.com/1410766
- https://crbug.com/1410766
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202309-17
Modified: 2024-11-21
CVE-2023-0931
Use after free in Video in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://crbug.com/1407701
- https://crbug.com/1407701
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202309-17
Modified: 2024-11-21
CVE-2023-0932
Use after free in WebRTC in Google Chrome on Windows prior to 110.0.5481.177 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://crbug.com/1413005
- https://crbug.com/1413005
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202309-17
Modified: 2024-11-21
CVE-2023-0933
Integer overflow in PDF in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://crbug.com/1404864
- https://crbug.com/1404864
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202309-17
Modified: 2024-11-21
CVE-2023-0941
Use after free in Prompts in Google Chrome prior to 110.0.5481.177 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://chromereleases.googleblog.com/2023/02/stable-channel-desktop-update_22.html
- https://crbug.com/1415366
- https://crbug.com/1415366
- https://security.gentoo.org/glsa/202309-17
- https://security.gentoo.org/glsa/202309-17
Closed bugs
chromium падает после вызова справки или недолгой работы
chromium: Браузер очень медленно работает
Closed bugs
Содержит файлы шрифтов, содержащиеся в пакете fonts-ttf-reduce или fonts-ttf-latex-xft