As correcções de segurança
libytnef-2.0-alt1
build Yuri N. Sedunov,
2021-09-20
- 2.0 (fixed CVE-2021-3403, CVE-2021-3404)
sqlite3-3.36.0-alt1 build Vladimir D. Seleznev, 2021-09-20
- 3.36.0.
- Fixed CVE-2021-36690.
fail2ban-0.11.2-alt2 build Vitaly Lipatov, 2021-09-18
- fix build, apply patches from upstream
- .service: use /run instead of /var/run
- CVE-2021-32749
curl-7.79.0-alt1 build Anton Farygin, 2021-09-15
- 7.79.0
- Fixes:
* CVE-2021-22945 clear the leftovers pointer when sending succeeds
* CVE-2021-22946 do not ignore --ssl-reqd
* CVE-2021-22947 reject STARTTLS server response pipelining
chromium-93.0.4577.82-alt1 build Alexey Gladkov, 2021-09-14
- New version (93.0.4577.82).
- Security fixes:
- CVE-2021-30625: Use after free in Selection API.
- CVE-2021-30626: Out of bounds memory access in ANGLE.
- CVE-2021-30627: Type Confusion in Blink layout.
- CVE-2021-30628: Stack buffer overflow in ANGLE.
- CVE-2021-30629: Use after free in Permissions.
- CVE-2021-30630: Inappropriate implementation in Blink .
- CVE-2021-30631: Type Confusion in Blink layout.
- CVE-2021-30632: Out of bounds write in V8.
- CVE-2021-30633: Use after free in Indexed DB API.
golang-1.17.1-alt1 build Alexey Shabalin, 2021-09-13
- New version (1.17.1).
- Fixes:
+ CVE-2021-39293
element-desktop-1.8.4-alt1 build Vitaly Lipatov, 2021-09-13
- new version (1.8.4) with rpmgs script
- switch to electron13
- CVE-2021-40823, CVE-2021-40824
element-web-1.8.4-alt1 build Vitaly Lipatov, 2021-09-13
- new version 1.8.4 (with rpmrb script)
- CVE-2021-40823, CVE-2021-40824
cifs-utils-6.13-alt3 build Evgeny Sinelnikov, 2021-09-12
- Fix kerberos mount regression in commit e461afd (Arch).
This is the fix for CVE-2021-20208 (Closes: 40887)
ghostscript-9.54.0-alt3 build Fr. Br. George, 2021-09-11
- (Fixes: CVE-2021-3781)
thunderbird-91.1.0-alt1 build Andrey Cherepanov, 2021-09-08
- New version.
- Security fixes:
+ CVE-2021-38492 Navigating to `mk:` URL scheme could load Internet Explorer
+ CVE-2021-38495 Memory safety bugs fixed in Thunderbird 91.1
firefox-92.0-alt1 build Alexey Gladkov, 2021-09-07
- New release (92.0).
- Security fixes:
+ CVE-2021-29993: Handling custom intents could lead to crashes and UI spoofs
+ CVE-2021-38491: Mixed-Content-Blocking was unable to check opaque origins
+ CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer
+ CVE-2021-38493: Memory safety bugs fixed in Firefox 92, Firefox ESR 78.14 and Firefox ESR 91.1
+ CVE-2021-38494: Memory safety bugs fixed in Firefox 92
firefox-esr-91.1.0-alt1 build Andrey Cherepanov, 2021-09-07
- New ESR version.
- Security fixes:
+ CVE-2021-38492 Navigating to `mk:` URL scheme could load Internet Explorer
+ CVE-2021-38495 Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
cyrus-imapd-3.2.8-alt1 build Sergey Y. Afonin, 2021-09-05
- 3.2.8 (fixes: CVE-2021-33582)
firefox-esr-91.0.1-alt1 build Andrey Cherepanov, 2021-09-04
- New ESR version.
- Security fixes:
+ CVE-2021-29991: Header Splitting possible with HTTP/3 Responses
+ CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT
+ CVE-2021-29983: Firefox for Android could get stuck in fullscreen mode
+ CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux
+ CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion
+ CVE-2021-29990: Memory safety bugs fixed in Firefox 91
connman-1.40-alt1 build Alexey Shabalin, 2021-09-03
- new version 1.40 (Fixes: CVE-2021-33833)
qemu-6.1.0-alt1 build Alexey Shabalin, 2021-09-02
- 6.1.0.
- Enabled build with bpf support.
- Disabled build with nettle support.
- Added subpackages:
+ device-display-virtio-gpu-gl
+ device-display-virtio-gpu-pci-gl
+ device-display-virtio-vga-gl
+ device-display-vhost-user-gpu
+ device-usb-host
- Split out qemu-pr-helper subpackage.
- Moved qemu-storage-daemon from qemu-tools to qemu-img subpackage.
- Moved virtfs-proxy-helper, qemu-bridge-helper, virtiofsd
from tools to common subpackage.
- Fixes for the following security vulnerabilities:
+ CVE-2021-3582
+ CVE-2021-3607
+ CVE-2021-3608
+ CVE-2021-3545
+ CVE-2021-3544
+ CVE-2021-3546
+ CVE-2021-3527
+ CVE-2021-3713
libvirt-7.7.0-alt1 build Alexey Shabalin, 2021-09-02
- 7.7.0 (Fixes: CVE-2021-3667, CVE-2021-3631)
libssh-0.9.6-alt1 build Sergey V Turchin, 2021-09-02
- new version
- security (fixes: CVE-2021-3634)
gem-rails-6.1.4.1-alt1 build Pavel Skrylev, 2021-09-01
- ^ 6.1.3.2 -> 6.1.4.1
- ! CVE-2021-22942, CVE-2021-22881
- ! spec
chromium-93.0.4577.63-alt1 build Alexey Gladkov, 2021-09-01
- New version (93.0.4577.63).
- Use internal ffmpeg.
- Security fixes:
- CVE-2021-30606: Use after free in Blink.
- CVE-2021-30607: Use after free in Permissions.
- CVE-2021-30608: Use after free in Web Share.
- CVE-2021-30609: Use after free in Sign-In.
- CVE-2021-30610: Use after free in Extensions API.
- CVE-2021-30611: Use after free in WebRTC.
- CVE-2021-30612: Use after free in WebRTC.
- CVE-2021-30613: Use after free in Base internals.
- CVE-2021-30614: Heap buffer overflow in TabStrip.
- CVE-2021-30615: Cross-origin data leak in Navigation.
- CVE-2021-30616: Use after free in Media.
- CVE-2021-30617: Policy bypass in Blink.
- CVE-2021-30618: Inappropriate implementation in DevTools.
- CVE-2021-30619: UI Spoofing in Autofill.
- CVE-2021-30620: Insufficient policy enforcement in Blink.
- CVE-2021-30621: UI Spoofing in Autofill.
- CVE-2021-30622: Use after free in WebApp Installs.
- CVE-2021-30623: Use after free in Bookmarks.
- CVE-2021-30624: Use after free in Autofill.
ntfs-3g-2021.8.22-alt1 build Valery Inozemtsev, 2021-08-31
- 2021.8.22 (Fixes: CVE-2021-33285, CVE-2021-35269, CVE-2021-35268, CVE-2021-33289,
CVE-2021-33286, CVE-2021-35266, CVE-2021-33287, CVE-2021-35267, CVE-2021-39251,
CVE-2021-39252, CVE-2021-39253, CVE-2021-39254, CVE-2021-39255, CVE-2021-39256,
CVE-2021-39257, CVE-2021-39258, CVE-2021-39259, CVE-2021-39260, CVE-2021-39261,
CVE-2021-39262, CVE-2021-39263)
LibreSSL-3.3.4-alt1 build Vladimir D. Seleznev, 2021-08-26
- Updated to 3.3.4 (fixed CVE-2021-3712).
libcaca-0.99-alt21 build Dmitry V. Levin, 2021-08-26
- NMU.
- v0.99.beta19-60-g813baea -> v0.99.beta19-62-ge4968ba (fixes: CVE-2021-3410).
java-11-openjdk-11.0.12.7-alt1_0jpp10 build Andrey Cherepanov, 2021-08-25
- new version
- security fixes:
+ CVE-2021-2341: Improve file transfers
+ CVE-2021-2369: Better jar file validation
+ CVE-2021-2388: Enhance compiler validation
+ CVE-2021-2161: Less ambiguous processing
+ CVE-2021-2163: Enhance opening JARs
+ CVE-2020-14779: Enhance support of Proxy class
+ CVE-2020-14781: Enhanced LDAP contexts
+ CVE-2020-14782: Enhance certificate processing
+ CVE-2020-14792: Better range handling
+ CVE-2020-14796: Improved URI Support
+ CVE-2020-14797: Better Path Validation
+ CVE-2020-14798: Enhanced buffer support
+ CVE-2020-14803: Improved Buffer supports
+ CVE-2020-14562: Enhance TIFF support
+ CVE-2020-14573: Enhance Graal interface handling
+ CVE-2020-14556: Better ForkJoinPool behavior
+ CVE-2020-14577: Enhance certificate verification
+ CVE-2020-14581: Better matrix operations
+ CVE-2020-14583: Better Buffer support
+ CVE-2020-14593: Less Affine Transformations
+ CVE-2020-14621: Better XML namespace handling
+ CVE-2020-2754: Forward references to Nashorn
+ CVE-2020-2755: Improve Nashorn matching
+ CVE-2020-2756: Better mapping of serial ENUMs
+ CVE-2020-2757: Less Blocking Array Queues
+ CVE-2020-2773: Better signatures in XML
+ CVE-2020-2778: More constrained algorithms
+ CVE-2020-2767: Improve TLS verification
+ CVE-2020-2781: Improve TLS session handling
+ CVE-2020-2800: Better Headings for HTTP Servers
+ CVE-2020-2803: Enhance buffering of byte buffers
+ CVE-2020-2805: Enhance typing of methods
+ CVE-2020-2816: Enhance TLS connectivity
+ CVE-2020-2830: Better Scanner conversions
+ CVE-2020-2583: Unlink Set of LinkedHashSets
+ CVE-2020-2590: Improve Kerberos interop capabilities
+ CVE-2020-2593: Normalize normalization for all
+ CVE-2020-2601: Better Ticket Granting Services
+ CVE-2020-2604: Better serial filter handling
+ CVE-2020-2655: Better TLS messaging support
+ CVE-2020-2654: Improve Object Identifier Processing
+ CVE-2019-2933: Windows file handling redux
+ CVE-2019-2945: Better socket support
+ CVE-2019-2949: Better Kerberos ccache handling
+ CVE-2019-2958: Build Better Processes
+ CVE-2019-2964: Better support for patterns
+ CVE-2019-2962: Better Glyph Images
+ CVE-2019-2973: Better pattern compilation
+ CVE-2019-2975: Unexpected exception in jjs
+ CVE-2019-2978: Improved handling of jar files
+ CVE-2019-2977: Improve String index handling
+ CVE-2019-2981: Better Path supports
+ CVE-2019-2983: Better serial attributes
+ CVE-2019-2987: Better rendering of native glyphs
+ CVE-2019-2988: Better Graphics2D drawing
+ CVE-2019-2989: Improve TLS connection support
+ CVE-2019-2992: Enhance font glyph mapping
+ CVE-2019-2999: Commentary on Javadoc comments
+ CVE-2019-2894: Enhance ECDSA operations
+ CVE-2019-2762: Exceptional throw cases
+ CVE-2019-2766: Improve file protocol handling
+ CVE-2019-2769: Better copies of CopiesList
+ CVE-2019-2786: More limited privilege usage
+ CVE-2019-7317: Improve PNG support options
+ CVE-2019-2818: Better Poly1305 support
+ CVE-2019-2816: Normalize normalization
+ CVE-2019-2821: Improve TLS negotiation
+ CVE-2019-2602: Better String parsing
+ CVE-2019-2684: More dynamic RMI interactions
+ CVE-2019-2698: Fuzzing TrueType fonts: setCurrGlyphID()
projeto & código: Vladimir Lettiev aka crux © 2004-2005,
Andrew Avramenko aka liks © 2007-2008
mantenedor atual: Michael Shigorin
mantenedor da tradução: Fernando Martini aka fmartini © 2009
mantenedor atual: Michael Shigorin
mantenedor da tradução: Fernando Martini aka fmartini © 2009