ALT-BU-2023-6248-1
Branch p10 update bulletin.
Closed bugs
Кнопки "Принудительно" и "Отключено" контекстного меню привязанных групповых политик удаляют связь с подразделением
Closed vulnerabilities
BDU:2023-04304
Уязвимость функции fopen() библиотеки libcurl, связанная с ошибками управления состоянием, позволяющая нарушителю создать или перезаписать защищенные файлы
BDU:2023-05819
Уязвимость интерфейса утилиты командной строки cURL, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2023-11-07
CVE-2023-32001
Rejected reason: We issued this CVE pre-maturely, as we have subsequently realized that this issue points out a problem that there really is no safe measures around or protections for.
Modified: 2024-11-21
CVE-2023-38039
When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory.
- http://seclists.org/fulldisclosure/2023/Oct/17
- http://seclists.org/fulldisclosure/2023/Oct/17
- http://seclists.org/fulldisclosure/2024/Jan/34
- http://seclists.org/fulldisclosure/2024/Jan/34
- http://seclists.org/fulldisclosure/2024/Jan/37
- http://seclists.org/fulldisclosure/2024/Jan/37
- http://seclists.org/fulldisclosure/2024/Jan/38
- http://seclists.org/fulldisclosure/2024/Jan/38
- https://hackerone.com/reports/2072338
- https://hackerone.com/reports/2072338
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5DCZMYODALBLVOXVJEN2LF2MLANEYL4F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M6KGKB2JNZVT276JYSKI6FV2VFJUGDOJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEAWTYHC3RT6ZRS5OZRHLAIENVN6CCIS/
- https://security.gentoo.org/glsa/202310-12
- https://security.gentoo.org/glsa/202310-12
- https://security.netapp.com/advisory/ntap-20231013-0005/
- https://security.netapp.com/advisory/ntap-20231013-0005/
- https://support.apple.com/kb/HT214036
- https://support.apple.com/kb/HT214036
- https://support.apple.com/kb/HT214057
- https://support.apple.com/kb/HT214057
- https://support.apple.com/kb/HT214058
- https://support.apple.com/kb/HT214058
- https://support.apple.com/kb/HT214063
- https://support.apple.com/kb/HT214063
- https://www.insyde.com/security-pledge/SA-2023064
- https://www.insyde.com/security-pledge/SA-2023064
Closed bugs
Xsane не обнаруживает сканер Canon Lide 25
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-39323
Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
- https://go.dev/cl/533215
- https://go.dev/cl/533215
- https://go.dev/issue/63211
- https://go.dev/issue/63211
- https://groups.google.com/g/golang-announce/c/XBa1oHDevAo
- https://groups.google.com/g/golang-announce/c/XBa1oHDevAo
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/
- https://pkg.go.dev/vuln/GO-2023-2095
- https://pkg.go.dev/vuln/GO-2023-2095
- https://security.gentoo.org/glsa/202311-09
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20231020-0001/
- https://security.netapp.com/advisory/ntap-20231020-0001/