ALT-BU-2023-3646-1
Branch p10 update bulletin.
Closed bugs
таскает копию zstd
Package postgresql15 updated to version 15.3-alt0.p10.1 for branch p10 in task 320241.
Closed vulnerabilities
BDU:2023-03024
Уязвимость компонента Schema Handler системы управления базами данных PostgreSQL, позволяющая нарушителю обойти ограничения безопасности
BDU:2023-03247
Уязвимость системы управления базами данных PostgreSQL, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код
Modified: 2025-01-06
CVE-2023-2454
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2454/
- https://www.postgresql.org/support/security/CVE-2023-2454/
Modified: 2025-01-06
CVE-2023-2455
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2455/
- https://www.postgresql.org/support/security/CVE-2023-2455/
Package postgresql11 updated to version 11.20-alt0.p10.1 for branch p10 in task 320241.
Closed vulnerabilities
BDU:2023-03024
Уязвимость компонента Schema Handler системы управления базами данных PostgreSQL, позволяющая нарушителю обойти ограничения безопасности
BDU:2023-03247
Уязвимость системы управления базами данных PostgreSQL, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код
Modified: 2025-01-06
CVE-2023-2454
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2454/
- https://www.postgresql.org/support/security/CVE-2023-2454/
Modified: 2025-01-06
CVE-2023-2455
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2455/
- https://www.postgresql.org/support/security/CVE-2023-2455/
Package postgresql12 updated to version 12.15-alt0.p10.1 for branch p10 in task 320241.
Closed vulnerabilities
BDU:2023-03024
Уязвимость компонента Schema Handler системы управления базами данных PostgreSQL, позволяющая нарушителю обойти ограничения безопасности
BDU:2023-03247
Уязвимость системы управления базами данных PostgreSQL, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код
Modified: 2025-01-06
CVE-2023-2454
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2454/
- https://www.postgresql.org/support/security/CVE-2023-2454/
Modified: 2025-01-06
CVE-2023-2455
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2455/
- https://www.postgresql.org/support/security/CVE-2023-2455/
Package postgresql13 updated to version 13.11-alt0.p10.1 for branch p10 in task 320241.
Closed vulnerabilities
BDU:2023-03024
Уязвимость компонента Schema Handler системы управления базами данных PostgreSQL, позволяющая нарушителю обойти ограничения безопасности
BDU:2023-03247
Уязвимость системы управления базами данных PostgreSQL, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код
Modified: 2025-01-06
CVE-2023-2454
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2454/
- https://www.postgresql.org/support/security/CVE-2023-2454/
Modified: 2025-01-06
CVE-2023-2455
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2455/
- https://www.postgresql.org/support/security/CVE-2023-2455/
Package postgresql14 updated to version 14.8-alt0.p10.1 for branch p10 in task 320241.
Closed vulnerabilities
BDU:2023-03024
Уязвимость компонента Schema Handler системы управления базами данных PostgreSQL, позволяющая нарушителю обойти ограничения безопасности
BDU:2023-03247
Уязвимость системы управления базами данных PostgreSQL, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код
Modified: 2025-01-06
CVE-2023-2454
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2454/
- https://www.postgresql.org/support/security/CVE-2023-2454/
Modified: 2025-01-06
CVE-2023-2455
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2455/
- https://www.postgresql.org/support/security/CVE-2023-2455/
Package postgresql15-1C updated to version 15.3-alt0.p10.1 for branch p10 in task 320241.
Closed vulnerabilities
BDU:2023-03024
Уязвимость компонента Schema Handler системы управления базами данных PostgreSQL, позволяющая нарушителю обойти ограничения безопасности
BDU:2023-03247
Уязвимость системы управления базами данных PostgreSQL, связанная с недостатками разграничения доступа, позволяющая нарушителю повысить свои привилегии и выполнить произвольный код
Modified: 2025-01-06
CVE-2023-2454
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://access.redhat.com/security/cve/CVE-2023-2454
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2454/
- https://www.postgresql.org/support/security/CVE-2023-2454/
Modified: 2025-01-06
CVE-2023-2455
Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and a given query is planned under one role and then executed under other roles. This scenario can happen under security definer functions or when a common user and query is planned initially and then re-used across multiple SET ROLEs. Applying an incorrect policy may permit a user to complete otherwise-forbidden reads and modifications. This affects only databases that have used CREATE POLICY to define a row security policy.
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://access.redhat.com/security/cve/CVE-2023-2455
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://security.netapp.com/advisory/ntap-20230706-0006/
- https://www.postgresql.org/support/security/CVE-2023-2455/
- https://www.postgresql.org/support/security/CVE-2023-2455/
Package pcmanfm-qt updated to version 1.3.0-alt3 for branch p10 in task 319973.
Closed bugs
Незапрошенное закрытие окна pcmanfm-qt на размонтировании
Closed bugs
добавить макрос для ctest
Closed vulnerabilities
BDU:2023-02895
Уязвимость библиотеки libcurl, связанная с ошибками при отправке HTTP-запросов POST и PUT с использованием одного и того же дескриптора, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
Modified: 2025-01-15
CVE-2023-28319
A use after free vulnerability exists in curl
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9
- https://hackerone.com/reports/1913733
- https://hackerone.com/reports/1913733
- GLSA-202310-12
- GLSA-202310-12
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- https://support.apple.com/kb/HT213845
Modified: 2025-01-15
CVE-2023-28320
A denial of service vulnerability exists in curl
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9
- https://hackerone.com/reports/1929597
- https://hackerone.com/reports/1929597
- GLSA-202310-12
- GLSA-202310-12
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- https://support.apple.com/kb/HT213845
Modified: 2025-01-15
CVE-2023-28321
An improper certificate validation vulnerability exists in curl
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9
- https://hackerone.com/reports/1950627
- https://hackerone.com/reports/1950627
- [debian-lts-announce] 20231011 [SECURITY] [DLA 3613-1] curl security update
- [debian-lts-announce] 20231011 [SECURITY] [DLA 3613-1] curl security update
- FEDORA-2023-37eac50e9b
- FEDORA-2023-37eac50e9b
- FEDORA-2023-8ed627bb04
- FEDORA-2023-8ed627bb04
- GLSA-202310-12
- GLSA-202310-12
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- https://support.apple.com/kb/HT213845
Modified: 2024-11-21
CVE-2023-28322
An information disclosure vulnerability exists in curl
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9
- https://hackerone.com/reports/1954658
- [debian-lts-announce] 20231222 [SECURITY] [DLA 3692-1] curl security update
- FEDORA-2023-37eac50e9b
- FEDORA-2023-8ed627bb04
- GLSA-202310-12
- https://security.netapp.com/advisory/ntap-20230609-0009/
- https://support.apple.com/kb/HT213843
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213845
- 20230725 APPLE-SA-2023-07-24-4 macOS Ventura 13.5
- https://support.apple.com/kb/HT213845
- https://support.apple.com/kb/HT213844
- https://support.apple.com/kb/HT213843
- https://security.netapp.com/advisory/ntap-20230609-0009/
- GLSA-202310-12
- FEDORA-2023-8ed627bb04
- FEDORA-2023-37eac50e9b
- [debian-lts-announce] 20231222 [SECURITY] [DLA 3692-1] curl security update
- https://hackerone.com/reports/1954658
- 20230725 APPLE-SA-2023-07-24-6 macOS Big Sur 11.7.9
- 20230725 APPLE-SA-2023-07-24-5 macOS Monterey 12.6.8