ALT-BU-2024-4293-1
Branch sisyphus_e2k update bulletin.
Package avahi updated to version 0.8-alt3 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2023-08473
Уязвимость функции avahi_rdata_parse() системы обнаружения сервисов в локальной сети Avahi, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2023-38469
A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record.
Modified: 2024-11-21
CVE-2023-38470
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function.
Modified: 2024-11-21
CVE-2023-38471
A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function.
Modified: 2024-11-21
CVE-2023-38472
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function.
Modified: 2024-11-21
CVE-2023-38473
A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function.
Package lua5.4 updated to version 5.4.6-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2022-04620
Уязвимость реализации функции singlevar() интерпретатора скриптов Lua, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2022-28805
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
- https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
- https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
- FEDORA-2022-b9ed35a7ad
- FEDORA-2022-b9ed35a7ad
- FEDORA-2022-5b5889f43a
- FEDORA-2022-5b5889f43a
- https://lua-users.org/lists/lua-l/2022-02/msg00001.html
- https://lua-users.org/lists/lua-l/2022-02/msg00001.html
- https://lua-users.org/lists/lua-l/2022-02/msg00070.html
- https://lua-users.org/lists/lua-l/2022-02/msg00070.html
- https://lua-users.org/lists/lua-l/2022-04/msg00009.html
- https://lua-users.org/lists/lua-l/2022-04/msg00009.html
- GLSA-202305-23
- GLSA-202305-23
Modified: 2024-11-21
CVE-2022-33099
An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.
- https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf
- https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf
- FEDORA-2022-b9ed35a7ad
- FEDORA-2022-b9ed35a7ad
- FEDORA-2022-5b5889f43a
- FEDORA-2022-5b5889f43a
- https://lua-users.org/lists/lua-l/2022-05/msg00035.html
- https://lua-users.org/lists/lua-l/2022-05/msg00035.html
- https://lua-users.org/lists/lua-l/2022-05/msg00042.html
- https://lua-users.org/lists/lua-l/2022-05/msg00042.html
- https://lua-users.org/lists/lua-l/2022-05/msg00073.html
- https://lua-users.org/lists/lua-l/2022-05/msg00073.html
- https://www.lua.org/bugs.html#Lua-stack%20overflow%20when%20C%20stack%20overflows%20while%20handling%20an%20error:~:text=Lua-stack%20overflow%20when%20C%20stack%20overflows%20while%20handling%20an%20error
- https://www.lua.org/bugs.html#Lua-stack%20overflow%20when%20C%20stack%20overflows%20while%20handling%20an%20error:~:text=Lua-stack%20overflow%20when%20C%20stack%20overflows%20while%20handling%20an%20error
Package zabbix updated to version 6.0.27-alt2 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2023-09066
Уязвимость файла cookie zbx_session универсальной системы мониторинга Zabbix, позволяющая нарушителю повысить свои привилегии
BDU:2024-00033
Уязвимость функции icmpping универсальной системы мониторинга Zabbix, позволяющая нарушителю выполнить произвольный код
BDU:2024-00645
Уязвимость компонента DNS Response Handler агента универсальной системы мониторинга Zabbix, позволяющая нарушителю вызвать переполнение буфера
Modified: 2024-11-21
CVE-2023-32725
The website configured in the URL widget will receive a session cookie when testing or executing scheduled reports. The received session cookie can then be used to access the frontend as the particular user.
Modified: 2024-11-21
CVE-2023-32726
The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server.
- https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BYSYLA7VTHR25CBLYO5ZLEJFGU7HTHQB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMFKNV5E4LG2DIZNPRWQ2ENH75H6UEQT/
- https://support.zabbix.com/browse/ZBX-23855
- https://lists.debian.org/debian-lts-announce/2024/01/msg00012.html
- https://support.zabbix.com/browse/ZBX-23855
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMFKNV5E4LG2DIZNPRWQ2ENH75H6UEQT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BYSYLA7VTHR25CBLYO5ZLEJFGU7HTHQB/
Modified: 2024-11-21
CVE-2023-32727
An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.
Modified: 2024-11-21
CVE-2023-32728
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.
Modified: 2024-11-21
CVE-2024-22119
The cause of vulnerability is improper validation of form input field “Name” on Graph page in Items section.