ALT-BU-2024-3063-1
Branch sisyphus_riscv64 update bulletin.
Package vim updated to version 9.1.0050-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2024-22667
Vim before 9.0.2142 has a stack-based buffer overflow because did_set_langmap in map.c calls sprintf to write to the error buffer that is passed down to the option callback functions.
- https://gist.githubusercontent.com/henices/2467e7f22dcc2aa97a2453e197b55a0c/raw/7b54bccc9a129c604fb139266f4497ab7aaa94c7/gistfile1.txt
- https://gist.githubusercontent.com/henices/2467e7f22dcc2aa97a2453e197b55a0c/raw/7b54bccc9a129c604fb139266f4497ab7aaa94c7/gistfile1.txt
- https://github.com/vim/vim/commit/b39b240c386a5a29241415541f1c99e2e6b8ce47
- https://github.com/vim/vim/commit/b39b240c386a5a29241415541f1c99e2e6b8ce47
- FEDORA-2024-12513b5cee
- FEDORA-2024-12513b5cee
- FEDORA-2024-1c85d5b179
- FEDORA-2024-1c85d5b179
- https://security.netapp.com/advisory/ntap-20240223-0008/
- https://security.netapp.com/advisory/ntap-20240223-0008/
Package python3-module-poppler-qt5 updated to version 21.3.0-alt1 for branch sisyphus_riscv64.
Closed bugs
21.3.0 есть
Package python3-module-cryptography updated to version 42.0.0-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-50782
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
Package python3-module-Pillow updated to version 10.2.0-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2024-00775
Уязвимость функции eval() модуля ImageMath библиотеки для работы с изображениями Pillow, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2023-50447
Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2022-22817 (which was about the expression parameter).
- [oss-security] 20240120 Pillow 10.2.0 released, fixes CVE-2023-50447
- [oss-security] 20240120 Pillow 10.2.0 released, fixes CVE-2023-50447
- https://devhub.checkmarx.com/cve-details/CVE-2023-50447/
- https://devhub.checkmarx.com/cve-details/CVE-2023-50447/
- https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/
- https://duartecsantos.github.io/2024-01-02-CVE-2023-50447/
- https://github.com/python-pillow/Pillow/releases
- https://github.com/python-pillow/Pillow/releases
- [debian-lts-announce] 20240129 [SECURITY] [DLA 3724-1] pillow security update
- [debian-lts-announce] 20240129 [SECURITY] [DLA 3724-1] pillow security update