ALT-BU-2024-3363-2
Branch sisyphus update bulletin.
Closed vulnerabilities
BDU:2024-01580
Уязвимость компонента Accessibility браузера Google Chrome и Microsoft Edge, позволяющая нарушителю скомпрометировать процесс рендеринга
BDU:2024-01583
Уязвимость компонента Download браузера Google Chrome и Microsoft Edge, позволяющая нарушителю обойти существующие ограничения безопасности
BDU:2024-01584
Уязвимость механизма CSP (Content Security Policy) браузера Google Chrome и Microsoft Edge, позволяющая нарушителю обойти существующие ограничения безопасности
BDU:2024-01585
Уязвимость функции Navigation браузера Google Chrome и Microsoft Edge, позволяющая нарушителю обойти ограничения безопасности
BDU:2024-01598
Уязвимость модуля отображения Blink браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю выполнить произвольный код
BDU:2024-01600
Уязвимость функции Navigation браузера Google Chrome и Microsoft Edge, позволяющая нарушителю раскрыть защищаемую информацию
BDU:2024-01614
Уязвимость функции изоляции сайтов (Site Isolation) браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации или вызвать отказ в обслуживании
BDU:2024-01615
Уязвимость IPC-библиотеки Mojo браузеров Microsoft Edge и Google Chrome, позволяющая нарушителю выполнить произвольный код
Modified: 2024-12-19
CVE-2024-1669
Out of bounds memory access in Blink in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://issues.chromium.org/issues/41495060
- https://issues.chromium.org/issues/41495060
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
Modified: 2024-12-19
CVE-2024-1670
Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://issues.chromium.org/issues/41481374
- https://issues.chromium.org/issues/41481374
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
Modified: 2025-03-27
CVE-2024-1671
Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://issues.chromium.org/issues/41487933
- https://issues.chromium.org/issues/41487933
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
Modified: 2024-12-19
CVE-2024-1672
Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://issues.chromium.org/issues/41485789
- https://issues.chromium.org/issues/41485789
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
Modified: 2024-12-19
CVE-2024-1673
Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via specific UI gestures. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://issues.chromium.org/issues/41490491
- https://issues.chromium.org/issues/41490491
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
Modified: 2024-12-05
CVE-2024-1674
Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://issues.chromium.org/issues/40095183
- https://issues.chromium.org/issues/40095183
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
Modified: 2025-03-14
CVE-2024-1675
Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security severity: Medium)
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://issues.chromium.org/issues/41486208
- https://issues.chromium.org/issues/41486208
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
Modified: 2024-12-19
CVE-2024-1676
Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafted HTML page. (Chromium security severity: Low)
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_20.html
- https://issues.chromium.org/issues/40944847
- https://issues.chromium.org/issues/40944847
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWWBMVQTSERVBXSXCZVUKIMEDNQUQ7O3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/
Modified: 2024-12-19
CVE-2024-1938
Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html
- https://issues.chromium.org/issues/324596281
- https://issues.chromium.org/issues/324596281
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWSP5MIK7CDWJQHN2SJJX2YGSSS7E4O/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWSP5MIK7CDWJQHN2SJJX2YGSSS7E4O/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6KJCEJWJR5Z54Z75LRJGELDNMFDKLZG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6KJCEJWJR5Z54Z75LRJGELDNMFDKLZG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTGM2WHYSZAUUPENB7YO6E5ONAKE6AKJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTGM2WHYSZAUUPENB7YO6E5ONAKE6AKJ/
Modified: 2024-12-19
CVE-2024-1939
Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html
- https://chromereleases.googleblog.com/2024/02/stable-channel-update-for-desktop_27.html
- https://issues.chromium.org/issues/323694592
- https://issues.chromium.org/issues/323694592
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWSP5MIK7CDWJQHN2SJJX2YGSSS7E4O/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWSP5MIK7CDWJQHN2SJJX2YGSSS7E4O/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6KJCEJWJR5Z54Z75LRJGELDNMFDKLZG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L6KJCEJWJR5Z54Z75LRJGELDNMFDKLZG/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTGM2WHYSZAUUPENB7YO6E5ONAKE6AKJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTGM2WHYSZAUUPENB7YO6E5ONAKE6AKJ/
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-46303
link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the document root.
Package gnome-boxes updated to version 45.0-alt2 for branch sisyphus in task 341894.
Closed bugs
Добавить недостающие зависимости к gnome-boxes пакету
Closed vulnerabilities
BDU:2023-04834
Уязвимость компонента lsi53c895a.c эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2024-00308
Уязвимость функции qemu_clipboard_request() встроенного сервера VNC эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2023-0330
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
- https://access.redhat.com/security/cve/CVE-2023-0330
- https://access.redhat.com/security/cve/CVE-2023-0330
- RHBZ#2160151
- RHBZ#2160151
- [debian-lts-announce] 20231005 [SECURITY] [DLA 3604-1] qemu security update
- [debian-lts-announce] 20231005 [SECURITY] [DLA 3604-1] qemu security update
- https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html
- https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html
Modified: 2024-11-21
CVE-2023-6683
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2024-24246
Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h.