As correcções de segurança
mediawiki-1.34.2-alt1
build Vitaly Lipatov,
2020-08-01
- new version 1.34.2 (with rpmrb script)
- CVE-2020-15005
nss-3.55.0-alt1 build Alexey Gladkov, 2020-07-30
- New version (3.55).
- Security fixes:
+ CVE-2020-6829, CVE-2020-12400: Replace P384 and P521 with new, verifiable implementations from Fiat-Crypto and ECCKiila.
+ CVE-2020-12401: Remove unnecessary scalar padding.
+ CVE-2020-12403: Explicitly disable multi-part ChaCha20 (which was not functioning correctly) and more strictly enforce tag length.
clamav-0.102.4-alt1 build Sergey Y. Afonin, 2020-07-28
- 0.102.4
+ CVE-2020-3350
+ CVE-2020-3327
+ CVE-2020-3481
firefox-esr-78.1.0-alt1 build Andrey Cherepanov, 2020-07-28
- New release (78.1.0).
- Fixes:
+ CVE-2020-15652 Potential leak of redirect targets when loading scripts in a worker
+ CVE-2020-6514 WebRTC data channel leaks internal address to peer
+ CVE-2020-15655 Extension APIs could be used to bypass Same-Origin Policy
+ CVE-2020-15653 Bypassing iframe sandbox when allowing popups
+ CVE-2020-6463 Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
+ CVE-2020-15656 Type confusion for special arguments in IonMonkey
+ CVE-2020-15658 Overriding file type when saving to disk
+ CVE-2020-15657 DLL hijacking due to incorrect loading path
+ CVE-2020-15654 Custom cursor can overlay user interface
+ CVE-2020-15659 Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1
chromium-84.0.4147.105-alt1 build Alexey Gladkov, 2020-07-28
- New version (84.0.4147.105).
- Security fixes:
- CVE-2020-6532: Use after free in SCTP.
- CVE-2020-6537: Type Confusion in V8.
- CVE-2020-6538: Inappropriate implementation in WebView.
- CVE-2020-6539: Use after free in CSS.
- CVE-2020-6540: Heap buffer overflow in Skia.
- CVE-2020-6541: Use after free in WebUSB.
golang-1.14.6-alt1 build Alexey Shabalin, 2020-07-23
- New version (1.14.6). (Fixes: CVE-2020-15586, CVE-2020-14039)
freerdp-2.2.0-alt1 build Andrey Cherepanov, 2020-07-21
- New version.
- Fixes:
+ CVE-2020-15103 - Integer overflow due to missing input sanitation in rdpegfx channel
cve-manager-0.34.0-alt1 build Alexey Appolonov, 2020-07-16
- New input data convention - a bin list (and it's simplified ver) is sufficient
for representing an investigated repository, src list is no longer supported;
- Correlations of build timelines of packages and mention dates of vulnerable
products are taken into account when making a mapping choice;
- New model of parallel processing + elimination of verbose logging for
cve-fixes, cpe-map and cve-issues that together result in improved
performance and much lighter and clearer log;
- cve-manager's dialog mode is deprecated (a user can learn about existing
modules with a use of the 'cve-manager --list_modules' command before running
the whole process or just it's particular parts through the main module).
chromium-84.0.4147.89-alt1 build Alexey Gladkov, 2020-07-15
- New version (84.0.4147.89).
- Fix compilation with system ffmpeg 4.3 (ALT#38716)
- Security fixes:
- CVE-2020-6510: Heap buffer overflow in background fetch.
- CVE-2020-6511: Side-channel information leakage in content security policy.
- CVE-2020-6512: Type Confusion in V8.
- CVE-2020-6513: Heap buffer overflow in PDFium.
- CVE-2020-6514: Inappropriate implementation in WebRTC.
- CVE-2020-6515: Use after free in tab strip.
- CVE-2020-6516: Policy bypass in CORS.
- CVE-2020-6517: Heap buffer overflow in history.
- CVE-2020-6518: Use after free in developer tools.
- CVE-2020-6519: Policy bypass in CSP.
- CVE-2020-6520: Heap buffer overflow in Skia.
- CVE-2020-6521: Side-channel information leakage in autofill.
- CVE-2020-6522: Inappropriate implementation in external protocol handlers.
- CVE-2020-6523: Out of bounds write in Skia.
- CVE-2020-6524: Heap buffer overflow in WebAudio.
- CVE-2020-6525: Heap buffer overflow in Skia.
- CVE-2020-6526: Inappropriate implementation in iframe sandbox.
- CVE-2020-6527: Insufficient policy enforcement in CSP.
- CVE-2020-6528: Incorrect security UI in basic auth.
- CVE-2020-6529: Inappropriate implementation in WebRTC.
- CVE-2020-6530: Out of bounds memory access in developer tools.
- CVE-2020-6531: Side-channel information leakage in scroll to text.
- CVE-2020-6533: Type Confusion in V8.
- CVE-2020-6534: Heap buffer overflow in WebRTC.
- CVE-2020-6535: Insufficient data validation in WebUI.
- CVE-2020-6536: Incorrect security UI in PWAs.
firmware-intel-ucode-13-alt1.20200616 build L.A. Kostis, 2020-07-13
- Sync with Debian 3.20200616.1:
+ New upstream microcode datafile 20200616
+ Downgraded microcodes (to a previously shipped revision):
sig 0x000406e3, pf_mask 0xc0, 2019-10-03, rev 0x00d6, size 101376
sig 0x000506e3, pf_mask 0x36, 2019-10-03, rev 0x00d6, size 101376
+ Works around hangs on boot on Skylake-U/Y and Skylake Xeon E3,
+ https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/issues/31
+ This update *removes* the SRBDS mitigations from the above processors
- REGRESSION FIX: 0x406e3: rollback to rev 0xd6 and document regression
- Security fixes:
+ Implements mitigation for CVE-2020-0543 Special Register Buffer Data
Sampling (SRBDS), aka INTEL-SA-00320
+ Implements mitigation for CVE-2020-0548 Vector Register Data Sampling
(VRDS), INTEL-SA-00329
+ Implements mitigation for CVE-2020-0549 L1D Cache Eviction Sampling
(L1DCES), INTEL-SA-00329
+ Known to fix the regression introduced in release 2019-11-12 (sig
0x50564, rev. 0x2000065), which would cause several systems with
Skylake Xeon, Skylake HEDT processors to hang while rebooting
+ Updated Microcodes:
sig 0x000306c3, pf_mask 0x32, 2019-11-12, rev 0x0028, size 23552
sig 0x000306d4, pf_mask 0xc0, 2019-11-12, rev 0x002f, size 19456
sig 0x00040651, pf_mask 0x72, 2019-11-12, rev 0x0026, size 22528
sig 0x00040661, pf_mask 0x32, 2019-11-12, rev 0x001c, size 25600
sig 0x00040671, pf_mask 0x22, 2019-11-12, rev 0x0022, size 14336
sig 0x000406e3, pf_mask 0xc0, 2020-04-27, rev 0x00dc, size 104448
sig 0x00050653, pf_mask 0x97, 2020-04-24, rev 0x1000157, size 32768
sig 0x00050654, pf_mask 0xb7, 2020-04-24, rev 0x2006906, size 34816
sig 0x00050656, pf_mask 0xbf, 2020-04-23, rev 0x4002f01, size 52224
sig 0x00050657, pf_mask 0xbf, 2020-04-23, rev 0x5002f01, size 52224
sig 0x000806e9, pf_mask 0x10, 2020-04-27, rev 0x00d6, size 103424
sig 0x000806e9, pf_mask 0xc0, 2020-04-27, rev 0x00d6, size 103424
sig 0x000806ea, pf_mask 0xc0, 2020-04-27, rev 0x00d6, size 103424
sig 0x000806eb, pf_mask 0xd0, 2020-04-27, rev 0x00d6, size 103424
sig 0x000806ec, pf_mask 0x94, 2020-04-23, rev 0x00d6, size 103424
sig 0x000906e9, pf_mask 0x2a, 2020-04-23, rev 0x00d6, size 103424
sig 0x000906ea, pf_mask 0x22, 2020-04-27, rev 0x00d6, size 102400
sig 0x000906eb, pf_mask 0x02, 2020-04-23, rev 0x00d6, size 103424
sig 0x000906ec, pf_mask 0x22, 2020-04-27, rev 0x00d6, size 102400
sig 0x000906ed, pf_mask 0x22, 2020-04-23, rev 0x00d6, size 103424
tor-0.4.3.6-alt1 build Vladimir Didenko, 2020-07-09
- new version (fixes CVE-2020-15572)
ansible-2.9.10-alt1 build Andrey Cherepanov, 2020-07-08
- 2.9.10
- Fixes:
+ CVE-2020-10691
+ CVE-2019-14858
+ CVE-2019-10156
+ CVE-2019-10206
- Change maintainer and group
samba-4.11.11-alt1 build Evgeny Sinelikov, 2020-07-07
- Update to latest stable security release of the Samba 4.11
- Security fixes:
+ CVE-2020-10730: NULL pointer de-reference and use-after-free in Samba AD DC
LDAP Server with ASQ, VLV and paged_results
+ CVE-2020-10745: Parsing and packing of NBT and DNS packets can consume excessive CPU
+ CVE-2020-10760: LDAP Use-after-free in Samba AD DC Global Catalog with paged_results and VLV
+ CVE-2020-14303: Empty UDP packet DoS in Samba AD DC nbtd
json-c-0.14-alt2 build Alexey Shabalin, 2020-07-04
- Fixes: CVE-2020-12762
firefox-78.0.1-alt1 build Alexey Gladkov, 2020-07-04
- New release (78.0.1).
- Security fixes:
+ CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing
+ CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster
+ CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64
+ CVE-2020-12418: Information disclosure due to manipulated URL object
+ CVE-2020-12419: Use-after-free in nsGlobalWindowInner
+ CVE-2020-12420: Use-After-Free when trying to connect to a STUN server
+ CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack
+ CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates
+ CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer
+ CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library
+ CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process
+ CVE-2020-12425: Out of bound read in Date.parse()
+ CVE-2020-12426: Memory safety bugs fixed in Firefox 78
firefox-esr-78.0.1-alt1 build Alexey Gladkov, 2020-07-04
- New release (78.0.1).
- Fixes:
+ CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing
+ CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster
+ CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64
+ CVE-2020-12418: Information disclosure due to manipulated URL object
+ CVE-2020-12419: Use-after-free in nsGlobalWindowInner
+ CVE-2020-12420: Use-After-Free when trying to connect to a STUN server
+ CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack
+ CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates
+ CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer
+ CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library
+ CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process
+ CVE-2020-12425: Out of bound read in Date.parse()
+ CVE-2020-12426: Memory safety bugs fixed in Firefox 78
wireshark-3.2.5-alt1 build Anton Farygin, 2020-07-03
- 3.2.5
- fixes:
* GVCP dissector infinite loop. CVE-2020-15466
bind-9.11.20-alt1 build Stanislav Levin, 2020-06-29
- 9.11.19 -> 9.11.20 (fixes: CVE-2020-8619).
gem-rails-5.2.4.3-alt1 build Pavel Skrylev, 2020-06-29
- ^ 5.2.4.1 -> 5.2.4.3
- ! bugfixes
+ - CVE-2020-8162
+ - CVE-2020-8164
+ - CVE-2020-8165
+ - CVE-2020-8166
+ - CVE-2020-8167
mariadb-10.4.13-alt1 build Alexey Shabalin, 2020-06-28
- 10.4.13
- Fixes for the following security vulnerabilities:
+ CVE-2020-2752
+ CVE-2020-2812
+ CVE-2020-2814
+ CVE-2020-2760
+ CVE-2020-13249
ceph-14.2.10-alt1 build Alexey Shabalin, 2020-06-28
- 14.2.10
- Fixes for the following security vulnerabilities:
+ CVE-2020-10753 HTTP header injection via CORS ExposeHeader tag
vlc-3.0.11-alt1 build Anton Farygin, 2020-06-26
- 3.0.11
- fixes:
* CVE-2020-13428 - a remote user could create a specifically
crafted file that could trigger a buffer overflow in VLC's H26X packetizer
libjpeg8-2.0.5-alt1 build Leontiy Volodin, 2020-06-25
- New version (2.0.5) with rpmgs script.
- Updated license tag.
- Fixes:
+ CVE-2020-13790.
curl-7.71.0-alt1 build Anton Farygin, 2020-06-24
- 7.71.0
- fixes:
* CVE-2020-8177: curl overwrite local file with -J
* CVE-2020-8169: Partial password leak over DNS on HTTP redirect
libgupnp1.2-1.2.3-alt1 build Yuri N. Sedunov, 2020-06-23
- 1.2.3 (Add mitigations for CVE-2020-12695 (CallStranger),
Implement UDA 2.0 April 17 2020 Addendum (Partial fix for CVE-2020-12695))
projeto & código: Vladimir Lettiev aka crux © 2004-2005,
Andrew Avramenko aka liks © 2007-2008
mantenedor atual: Michael Shigorin
mantenedor da tradução: Fernando Martini aka fmartini © 2009
mantenedor atual: Michael Shigorin
mantenedor da tradução: Fernando Martini aka fmartini © 2009