ALT-BU-2023-4289-1
Branch p10 update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-34969
D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
- https://gitlab.freedesktop.org/dbus/dbus/-/issues/457
- [debian-lts-announce] 20231023 [SECURITY] [DLA 3628-1] dbus security update
- FEDORA-2023-d22162d9ba
- https://security.netapp.com/advisory/ntap-20231208-0007/
- https://gitlab.freedesktop.org/dbus/dbus/-/issues/457
- https://security.netapp.com/advisory/ntap-20231208-0007/
- FEDORA-2023-d22162d9ba
- [debian-lts-announce] 20231023 [SECURITY] [DLA 3628-1] dbus security update
Closed bugs
CVE-2023-34969
Closed bugs
Вечная попытка входа в Wi-Fi
Новый стим не отображает окно добавления нового хранилища.
Closed bugs
Localization fix for OpenTimelineIO adapter list
Closed vulnerabilities
BDU:2022-00999
Уязвимость функции doProlog() библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01062
Уязвимость функции copyString библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01063
Уязвимость компонента xmltok_impl.c библиотеки Expat, позволяющая нарушителю выполнить произвольный код
BDU:2022-01064
Уязвимость функции build_model библиотеки Expat, связанная с переполнением буфера в стеке, позволяющая нарушителю выполнить произвольный код
BDU:2022-01065
Уязвимость компонента xmlparse.c библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01071
Уязвимость функции storeRawNames библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2022-01702
Уязвимость библиотеки синтаксического анализатора XML libexpat, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код
BDU:2023-02596
Уязвимость функции doContent файла xmlparse.c библиотеки синтаксического анализатора XML libexpat, позволяющая нарушителю выполнить произвольный код
BDU:2023-02688
Уязвимость функции XML_ExternalEntityParserCreate библиотеки синтаксического анализатора XML libexpat, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2022-23852
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/550
- https://github.com/libexpat/libexpat/pull/550
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220217-0001/
- https://security.netapp.com/advisory/ntap-20220217-0001/
- DSA-5073
- DSA-5073
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Modified: 2024-11-21
CVE-2022-23990
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/551
- https://github.com/libexpat/libexpat/pull/551
- FEDORA-2022-88f6a3d290
- FEDORA-2022-88f6a3d290
- FEDORA-2022-d2abd0858e
- FEDORA-2022-d2abd0858e
- GLSA-202209-24
- GLSA-202209-24
- DSA-5073
- DSA-5073
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.tenable.com/security/tns-2022-05
- https://www.tenable.com/security/tns-2022-05
Modified: 2024-11-21
CVE-2022-25235
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/562
- https://github.com/libexpat/libexpat/pull/562
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- FEDORA-2022-04f206996b
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-3d9d67f558
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220303-0008/
- https://security.netapp.com/advisory/ntap-20220303-0008/
- DSA-5085
- DSA-5085
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Modified: 2024-11-21
CVE-2022-25236
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
- http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/561
- https://github.com/libexpat/libexpat/pull/561
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- FEDORA-2022-04f206996b
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-3d9d67f558
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220303-0008/
- https://security.netapp.com/advisory/ntap-20220303-0008/
- DSA-5085
- DSA-5085
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Modified: 2024-11-21
CVE-2022-25313
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/558
- https://github.com/libexpat/libexpat/pull/558
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- FEDORA-2022-04f206996b
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-3d9d67f558
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220303-0008/
- https://security.netapp.com/advisory/ntap-20220303-0008/
- DSA-5085
- DSA-5085
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Modified: 2024-11-21
CVE-2022-25314
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/560
- https://github.com/libexpat/libexpat/pull/560
- FEDORA-2022-04f206996b
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-3d9d67f558
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220303-0008/
- https://security.netapp.com/advisory/ntap-20220303-0008/
- DSA-5085
- DSA-5085
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Modified: 2024-11-21
CVE-2022-25315
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- [oss-security] 20220219 Expat 2.4.5 released, includes 5 security fixes
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
- https://github.com/libexpat/libexpat/pull/559
- https://github.com/libexpat/libexpat/pull/559
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- [debian-lts-announce] 20220307 [SECURITY] [DLA 2935-1] expat security update
- FEDORA-2022-04f206996b
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-3d9d67f558
- GLSA-202209-24
- GLSA-202209-24
- https://security.netapp.com/advisory/ntap-20220303-0008/
- https://security.netapp.com/advisory/ntap-20220303-0008/
- DSA-5085
- DSA-5085
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Modified: 2024-11-21
CVE-2022-40674
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
- https://github.com/libexpat/libexpat/pull/629
- https://github.com/libexpat/libexpat/pull/629
- https://github.com/libexpat/libexpat/pull/640
- https://github.com/libexpat/libexpat/pull/640
- [debian-lts-announce] 20220925 [SECURITY] [DLA 3119-1] expat security update
- [debian-lts-announce] 20220925 [SECURITY] [DLA 3119-1] expat security update
- FEDORA-2022-d93b3bd8b9
- FEDORA-2022-d93b3bd8b9
- FEDORA-2022-c68d90efc3
- FEDORA-2022-c68d90efc3
- FEDORA-2022-dcb1d7bcb1
- FEDORA-2022-dcb1d7bcb1
- FEDORA-2022-15ec504440
- FEDORA-2022-15ec504440
- FEDORA-2022-c22feb71ba
- FEDORA-2022-c22feb71ba
- GLSA-202209-24
- GLSA-202209-24
- GLSA-202211-06
- GLSA-202211-06
- https://security.netapp.com/advisory/ntap-20221028-0008/
- https://security.netapp.com/advisory/ntap-20221028-0008/
- DSA-5236
- DSA-5236
Modified: 2024-11-21
CVE-2022-43680
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
- [oss-security] 20231228 CVE-2022-43680: Apache OpenOffice: "Use after free" fixed in libexpat
- [oss-security] 20231228 CVE-2022-43680: Apache OpenOffice: "Use after free" fixed in libexpat
- [oss-security] 20240103 CVE-2022-43680: Apache OpenOffice: "Use after free" fixed in libexpat
- [oss-security] 20240103 CVE-2022-43680: Apache OpenOffice: "Use after free" fixed in libexpat
- https://github.com/libexpat/libexpat/issues/649
- https://github.com/libexpat/libexpat/issues/649
- https://github.com/libexpat/libexpat/pull/616
- https://github.com/libexpat/libexpat/pull/616
- https://github.com/libexpat/libexpat/pull/650
- https://github.com/libexpat/libexpat/pull/650
- [debian-lts-announce] 20221028 [SECURITY] [DLA 3165-1] expat security update
- [debian-lts-announce] 20221028 [SECURITY] [DLA 3165-1] expat security update
- FEDORA-2022-3cf0e7ebc7
- FEDORA-2022-3cf0e7ebc7
- FEDORA-2022-ae2559a8f4
- FEDORA-2022-ae2559a8f4
- FEDORA-2022-49db80f821
- FEDORA-2022-49db80f821
- FEDORA-2022-c43235716e
- FEDORA-2022-c43235716e
- FEDORA-2022-f3a939e960
- FEDORA-2022-f3a939e960
- FEDORA-2022-5f1e2e9016
- FEDORA-2022-5f1e2e9016
- GLSA-202210-38
- GLSA-202210-38
- https://security.netapp.com/advisory/ntap-20221118-0007/
- https://security.netapp.com/advisory/ntap-20221118-0007/
- DSA-5266
- DSA-5266
Closed bugs
Обновить игру gav и решить проблему