2023-11-09
ALT-BU-2023-7115-1
Branch sisyphus_riscv64 update bulletin.
Package optipng updated to version 0.7.8-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Published: 2023-10-01
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-43907
OptiPNG v0.7.7 was discovered to contain a global buffer overflow via the 'buffer' variable at gifread.c.
Severity: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- http://optipng.sourceforge.net/
- https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/optipng-global-buffer-overflow1/optipng-global-buffer-overflow1.md
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBHVG5LDE2K3FZSIK4XFXOUXSE7NZ5JH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCG5CMDT37WCZGAWQNOIPVP4VHGCPUU3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAB22JXDE7O27DYARZXC7PFUETM5OOT5/
- https://sourceforge.net/projects/optipng/files/OptiPNG/optipng-0.7.7/optipng-0.7.7.tar.gz/download?use_mirror=udomain&download=
- http://optipng.sourceforge.net/
- https://github.com/Frank-Z7/z-vulnerabilitys/blob/main/optipng-global-buffer-overflow1/optipng-global-buffer-overflow1.md
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBHVG5LDE2K3FZSIK4XFXOUXSE7NZ5JH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RCG5CMDT37WCZGAWQNOIPVP4VHGCPUU3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAB22JXDE7O27DYARZXC7PFUETM5OOT5/
- https://sourceforge.net/projects/optipng/files/OptiPNG/optipng-0.7.7/optipng-0.7.7.tar.gz/download?use_mirror=udomain&download=
Package libetpan updated to version 1.9.4-alt4 for branch sisyphus_riscv64.
Closed vulnerabilities
Published: 2020-07-27
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-15953
LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a meddler-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection."
Severity: MEDIUM (5.8)
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Severity: HIGH (7.4)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References:
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00075.html
- https://github.com/dinhvh/libetpan/issues/386
- https://lists.debian.org/debian-lts-announce/2020/08/msg00026.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M65FVH5XPS23NLHFN3ABEGBSCHZAISXN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QFBWNA5REI5ZGW2DAOEAVHM23MOU6O5J/
- https://security.gentoo.org/glsa/202007-55
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00075.html
- https://github.com/dinhvh/libetpan/issues/386
- https://lists.debian.org/debian-lts-announce/2020/08/msg00026.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M65FVH5XPS23NLHFN3ABEGBSCHZAISXN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QFBWNA5REI5ZGW2DAOEAVHM23MOU6O5J/
- https://security.gentoo.org/glsa/202007-55
Package netdata updated to version 1.43.2-alt1 for branch sisyphus_riscv64.
Closed bugs
Отсутствие файлов конфигурации в Netdata