ALT-BU-2023-7403-1
Branch p10_e2k update bulletin.
Closed bugs
Сломалась сборка на p10
Closed vulnerabilities
BDU:2023-07250
Уязвимость функции ga_grow_inner текстового редактора vim,, вызванная целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-02-13
CVE-2023-46246
Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c` at line 748, which is freed in the file `src/ex_docmd.c` in the function `do_cmdline` at line 1010 and then used again in `src/cmdhist.c` at line 759. When using the `:history` command, it's possible that the provided argument overflows the accepted value. Causing an Integer Overflow and potentially later an use-after-free. This vulnerability has been patched in version 9.0.2068.
- https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45a
- https://github.com/vim/vim/commit/9198c1f2b1ddecde22af918541e0de2a32f0f45a
- https://github.com/vim/vim/security/advisories/GHSA-q22m-h7m2-9mgm
- https://github.com/vim/vim/security/advisories/GHSA-q22m-h7m2-9mgm
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNMFS3IH74KEMMESOA3EOB6MZ56TWGFF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNMFS3IH74KEMMESOA3EOB6MZ56TWGFF/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVA7K73WHQH4KVFDJQ7ELIUD2WK5ZT5E/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVA7K73WHQH4KVFDJQ7ELIUD2WK5ZT5E/
- https://security.netapp.com/advisory/ntap-20231208-0006/
- https://security.netapp.com/advisory/ntap-20231208-0006/
Modified: 2024-11-21
CVE-2023-5535
Use After Free in GitHub repository vim/vim prior to v9.0.2010.
- https://github.com/vim/vim/commit/41e6f7d6ba67b61d911f9b1d76325cd79224753d
- https://github.com/vim/vim/commit/41e6f7d6ba67b61d911f9b1d76325cd79224753d
- https://huntr.dev/bounties/2c2d85a7-1171-4014-bf7f-a2451745861f
- https://huntr.dev/bounties/2c2d85a7-1171-4014-bf7f-a2451745861f
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDDWD25AZIHBAA44HQT75OWLQ5UMDKU3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VDDWD25AZIHBAA44HQT75OWLQ5UMDKU3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VGTVLUV7UCXXCZAIQIUCLG6JXAVYT3HE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VGTVLUV7UCXXCZAIQIUCLG6JXAVYT3HE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPT7NMYJRLBPIALGSE24UWTY6F774GZW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XPT7NMYJRLBPIALGSE24UWTY6F774GZW/
Closed vulnerabilities
BDU:2023-07323
Уязвимость сокета Unix системы управления базами данных Redis, связана с раскрытием информации в ошибочной области данных, позволяющая нарушителю раскрыть защищаемую информацию
Modified: 2024-11-21
CVE-2023-45145
Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.
- https://github.com/redis/redis/commit/03345ddc7faf7af079485f2cbe5d17a1611cbce1
- https://github.com/redis/redis/commit/03345ddc7faf7af079485f2cbe5d17a1611cbce1
- https://github.com/redis/redis/security/advisories/GHSA-ghmp-889m-7cvx
- https://github.com/redis/redis/security/advisories/GHSA-ghmp-889m-7cvx
- https://lists.debian.org/debian-lts-announce/2023/10/msg00032.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00032.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/464JPNBWE433ZGYXO3KN72VR3KJPWHAW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/464JPNBWE433ZGYXO3KN72VR3KJPWHAW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BNEK2K4IE7MPKRD6H36JXZMJKYS6I5GQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BNEK2K4IE7MPKRD6H36JXZMJKYS6I5GQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZMGTTV5XM4LA66FSIJSETNBBRRPJYOQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZMGTTV5XM4LA66FSIJSETNBBRRPJYOQ/
- https://security.netapp.com/advisory/ntap-20231116-0014/
- https://security.netapp.com/advisory/ntap-20231116-0014/
Closed bugs
redis перестал запускаться после обновления до 6.2.13-alt1