Репозиторий Sisyphus
Последнее обновление: 23 июня 2017 | Пакетов: 17958 | Посещений: 9508575
en ru br
Исправления уязвимостей

thunderbird-52.2.0-alt1   сборка Andrey Cherepanov, 2017-06-22


- New version (52.2.0)
- Security fixes:
+ CVE-2017-5472: Use-after-free using destroyed node when regenerating trees
+ CVE-2017-7749: Use-after-free during docshell reloading
+ CVE-2017-7750: Use-after-free with track elements
+ CVE-2017-7751: Use-after-free with content viewer listeners
+ CVE-2017-7752: Use-after-free with IME input
+ CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object
+ CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors
+ CVE-2017-7757: Use-after-free in IndexedDB
+ CVE-2017-7778: Vulnerabilities in the Graphite 2 library
+ CVE-2017-7758: Out-of-bounds read in Opus encoder
+ CVE-2017-7763: Mac fonts render some unicode characters as spaces
+ CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks
+ CVE-2017-7765: Mark of the Web bypass when saving executable files
+ CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2, and Thunderbird 52.2

libwebkitgtk4-2.16.4-alt1   сборка Yuri N. Sedunov, 2017-06-22


- 2.16.4 (fixed CVE-2017-2538)

openvpn-2.4.3-alt1   сборка Nikolay A. Fetisov, 2017-06-21


- New version
- Security fixes:
+ CVE-2017-7522 Post-authentication --x509-track remote DoS
+ CVE-2017-7521 Post-authentication remote-triggerable memory leaks
+ CVE-2017-7521 Potential post-authentication remote code execution
on servers that use the --x509-username-field option
+ CVE-2017-7520 Pre-authentication remote crash / information disclosure
for clients
+ CVE-2017-7508 Remotely-triggerable ASSERT() on malformed IPv6 packet
- Force to use built-in PIN prompt with PKCS11 regardless
of systemd presence (OpenVPN bug 538)

firefox-esr-52.2.0-alt1   сборка Andrey Cherepanov, 2017-06-21


- New ESR version (52.2.0)
- Security fixes:
+ CVE-2017-5472: Use-after-free using destroyed node when regenerating trees
+ CVE-2017-7749: Use-after-free during docshell reloading
+ CVE-2017-7750: Use-after-free with track elements
+ CVE-2017-7751: Use-after-free with content viewer listeners
+ CVE-2017-7752: Use-after-free with IME input
+ CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object
+ CVE-2017-7755: Privilege escalation through Firefox Installer with same directory DLL files
+ CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors
+ CVE-2017-7757: Use-after-free in IndexedDB
+ CVE-2017-7778: Vulnerabilities in the Graphite 2 library
+ CVE-2017-7758: Out-of-bounds read in Opus encoder
+ CVE-2017-7760: File manipulation and privilege escalation via callback parameter in Mozilla Windows Updater and Maintenance Service
+ CVE-2017-7761: File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application
+ CVE-2017-7763: Mac fonts render some unicode characters as spaces
+ CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks
+ CVE-2017-7765: Mark of the Web bypass when saving executable files
+ CVE-2017-7766: File execution and privilege escalation through updater.ini, Mozilla Windows Updater, and Mozilla Maintenance Service
+ CVE-2017-7767: Privilege escalation and arbitrary file overwrites through Mozilla Windows Updater and Mozilla Maintenance Service
+ CVE-2017-7768: 32 byte arbitrary file read through Mozilla Maintenance Service
+ CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2

kernel-image-std-def-4.9.33-alt3   сборка Kernel Bot, 2017-06-19


- (Fixes: CVE-2017-1000364)

curl-7.54.1-alt1.S1   сборка Anton Farygin, 2017-06-14


- new version with security fixes:
CVE-2017-9502: URL file scheme drive letter buffer overflow

adobe-flash-player-ppapi-26-alt1.S1   сборка Sergey V Turchin, 2017-06-14


- new version
- security fixes:
CVE-2017-3075, CVE-2017-3081, CVE-2017-3083, CVE-2017-3084,
CVE-2017-3076, CVE-2017-3077, CVE-2017-3078, CVE-2017-3079,
CVE-2017-3082

chromium-59.0.3071.86-alt1   сборка Alexey Gladkov, 2017-06-09


- New version (59.0.3071.86).
- Security fixes:
- CVE-2017-5070: Type confusion in V8. Reported by Zhao Qixun(@S0rryMybad) of Qihoo 360 Vulcan Team on 2017-05-16
- CVE-2017-5071: Out of bounds read in V8. Reported by Choongwoo Han on 2017-04-26
- CVE-2017-5072: Address spoofing in Omnibox. Reported by Rayyan Bijoora on 2017-04-07
- CVE-2017-5073: Use after free in print preview. Reported by Khalil Zhani on 2017-04-28
- CVE-2017-5074: Use after free in Apps Bluetooth. Reported by anonymous on 2017-03-09
- CVE-2017-5075: Information leak in CSP reporting. Reported by Emmanuel Gil Peyrot on 2017-01-05
- CVE-2017-5086: Address spoofing in Omnibox. Reported by Rayyan Bijoora on 2017-05-16
- CVE-2017-5076: Address spoofing in Omnibox. Reported by Samuel Erb on 2017-05-06
- CVE-2017-5077: Heap buffer overflow in Skia. Reported by Sweetchip on 2017-04-28
- CVE-2017-5078: Possible command injection in mailto handling. Reported by Jose Carlos Exposito Bueno on 2017-04-12
- CVE-2017-5079: UI spoofing in Blink. Reported by Khalil Zhani on 2017-04-20
- CVE-2017-5080: Use after free in credit card autofill. Reported by Khalil Zhani on 2017-04-05
- CVE-2017-5081: Extension verification bypass. Reported by Andrey Kovalev (@L1kvID) Yandex Security Team on 2016-12-07
- CVE-2017-5082: Insufficient hardening in credit card editor. Reported by Nightwatch Cybersecurity Research on 2017-05-11
- CVE-2017-5083: UI spoofing in Blink. Reported by Khalil Zhani on 2017-04-24
- CVE-2017-5085: Inappropriate javascript execution on WebUI pages. Reported by Zhiyang Zeng of Tencent security platform department on 2017-02-15

wireshark-2.2.7-alt1.S1   сборка Anton Farygin, 2017-06-04


- new version with these security fixes:
* wnpa-sec-2017-22 Bazaar dissector infinite loop CVE-2017-9352
* wnpa-sec-2017-23 DOF dissector read overflow CVE-2017-9348
* wnpa-sec-2017-24 DHCP dissector read overflow CVE-2017-9351
* wnpa-sec-2017-25 SoulSeek dissector infinite loop CVE-2017-9346
* wnpa-sec-2017-26 DNS dissector infinite loop CVE-2017-9345
* wnpa-sec-2017-27 DICOM dissector infinite loop CVE-2017-9349
* wnpa-sec-2017-28 openSAFETY dissector memory exhaustion CVE-2017-9350
* wnpa-sec-2017-29 BT L2CAP dissector divide by zero CVE-2017-9344
* wnpa-sec-2017-30 MSNIP dissector crash CVE-2017-9343
* wnpa-sec-2017-31 ROS dissector crash CVE-2017-9347
* wnpa-sec-2017-32 RGMP dissector crash CVE-2017-9354
* wnpa-sec-2017-30 MSNIP dissector crash CVE-2017-9343
* wnpa-sec-2017-31 ROS dissector crash CVE-2017-9347
* wnpa-sec-2017-32 RGMP dissector crash CVE-2017-9354
* wnpa-sec-2017-33 IPv6 dissector crash CVE-2017-9353

libquicktime111-1.2.4-alt4   сборка Anton Farygin, 2017-06-03


- rebuilt with ffmpeg-3.3.1
- fixed integer overflow in the quicktime_read_pascal (Fixes: CVE-2016-2399)

sudo-1.8.20p1-alt1.S1   сборка Evgeny Sinelnikov, 2017-05-31


- Update to spring security release ((Fixes: CVE-2017-1000367)

libwebkitgtk4-2.16.3-alt1   сборка Yuri N. Sedunov, 2017-05-27


- 2.16.3 (fixed CVE-2017-2496, CVE-2017-2539, CVE-2017-2510)

samba-DC-4.6.4-alt1.S1   сборка Evgeny Sinelnikov, 2017-05-24


- Update to second spring security release
- Fix longtime initialization bug in ldb proxy
- Security fixes:
+ CVE-2017-7494 Remote code execution from a writable share

samba-4.6.4-alt1.S1   сборка Evgeny Sinelnikov, 2017-05-24


- Update to second spring security release
- Fix longtime initialization bug in ldb proxy
- Security fixes:
+ CVE-2017-7494 Remote code execution from a writable share

kde5-smb4k-2.0.1-alt1.S1   сборка Sergey V Turchin, 2017-05-19


- security fixes: CVE-2017-8849

apache2-2.4.25-alt1   сборка Anton Farygin, 2017-05-18


- updated to 2.4.25 witch security fixes:
+ CVE-2016-8740 mod_http2: Mitigate DoS memory exhaustion via endless CONTINUATION frames.
+ CVE-2016-5387 core: Mitigate [f]cgi "httpoxy" issues
+ CVE-2016-2161 mod_auth_digest: Prevent segfaults during client entry allocation when the shared memory space is exhausted.
+ CVE-2016-0736 mod_session_crypto: Authenticate the session data/cookie with a MAC (SipHash) to prevent deciphering or tampering with a padding oracle attack.
- increased service startup time (closes: #33491)
- cleanup spec and patches

openvpn-2.4.2-alt1   сборка Nikolay A. Fetisov, 2017-05-14


- New version
- Security fixes:
+ CVE-2017-7478 Don't assert out on receiving too-large control packets
+ CVE-2017-7479 Drop packets instead of assert out if packet id rolls over

git-2.10.3-alt1   сборка Dmitry V. Levin, 2017-05-11


- 2.10.2 -> 2.10.3 (fixes: CVE-2017-8386).

jq-1.5-alt1.S1   сборка Anton Farygin, 2017-05-10


- new version with security fixes (CVE-2015-8863)

adobe-flash-player-ppapi-25-alt3.S1   сборка Sergey V Turchin, 2017-05-10


- new version
- security fixes:
CVE-2017-3068, CVE-2017-3069, CVE-2017-3070, CVE-2017-3071,
CVE-2017-3072, CVE-2017-3073, CVE-2017-3074

firefox-esr-52.0-alt1   сборка Andrey Cherepanov, 2017-05-08


- New release (52.0) based on legion@ build.
- Built with internal icu.
- Fixed:
+ CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
+ CVE-2017-5401: Memory Corruption when handling ErrorResult
+ CVE-2017-5402: Use-after-free working with events in FontFace objects
+ CVE-2017-5403: Use-after-free using addRange to add range to an incorrect root object
+ CVE-2017-5404: Use-after-free working with ranges in selections
+ CVE-2017-5406: Segmentation fault in Skia with canvas operations
+ CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters
+ CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping
+ CVE-2017-5411: Use-after-free in Buffer Storage in libGLES
+ CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service
+ CVE-2017-5408: Cross-origin reading of video captions in violation of CORS
+ CVE-2017-5412: Buffer overflow read in SVG filters
+ CVE-2017-5413: Segmentation fault during bidirectional operations
+ CVE-2017-5414: File picker can choose incorrect default directory
+ CVE-2017-5415: Addressbar spoofing through blob URL
+ CVE-2017-5416: Null dereference crash in HttpChannel
+ CVE-2017-5417: Addressbar spoofing by draging and dropping URLs
+ CVE-2017-5425: Overly permissive Gecko Media Plugin sandbox regular expression access
+ CVE-2017-5426: Gecko Media Plugin sandbox is not started if seccomp-bpf filter is running
+ CVE-2017-5427: Non-existent chrome.manifest file loaded during startup
+ CVE-2017-5418: Out of bounds read when parsing HTTP digest authorization responses
+ CVE-2017-5419: Repeated authentication prompts lead to DOS attack
+ CVE-2017-5420: Javascript: URLs can obfuscate addressbar location
+ CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports
+ CVE-2017-5421: Print preview spoofing
+ CVE-2017-5422: DOS attack by using view-source: protocol repeatedly in one hyperlink
+ CVE-2017-5399: Memory safety bugs fixed in Firefox 52
+ CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8

firefox-esr-52.1.1-alt1   сборка Andrey Cherepanov, 2017-05-08


- New ESR version (52.1.1)
- Set plugin.load_flash_only setting to false to allow use all NPAPI plugins
- Security fixes since 52.0:
+ CVE-2016-10196: Vulnerabilities in Libevent library
+ CVE-2017-5031: Use after free in ANGLE
+ CVE-2017-5428: integer overflow in createImageBitmap()
+ CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR
+ CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR
+ CVE-2017-5435: Use-after-free during transaction processing in the
+ CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT
+ CVE-2017-5440: Use-after-free in txExecutionState destructor during
+ CVE-2017-5444: Buffer overflow while parsing
+ CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent
+ CVE-2017-5451: Addressbar spoofing with onblur event
+ CVE-2017-5454: Sandbox escape allowing file system read access through
+ CVE-2017-5455: Sandbox escape through internal feed reader APIs
+ CVE-2017-5456: Sandbox escape allowing local file system access
+ CVE-2017-5464: Memory corruption with accessibility and DOM
+ CVE-2017-5466: Origin confusion when reloading isolated data:text/html
+ CVE-2017-5467: Memory corruption when drawing Skia content

firefox-53.0.2-alt1   сборка Alexey Gladkov, 2017-05-07


- New release (53.0.2).
- Fixed:
+ CVE-2017-5031: Use after free in ANGLE

mariadb-10.1.23-alt1.S1   сборка Alexey Shabalin, 2017-05-05


- 10.1.23
- add maria-backup package
- Fixes for the following security vulnerabilities:
+ CVE-2017-3302
+ CVE-2017-3313
+ CVE-2017-3308
+ CVE-2017-3309
+ CVE-2017-3453
+ CVE-2017-3456
+ CVE-2017-3464

LibreSSL-2.5.4-alt1   сборка Vladimir D. Seleznev, 2017-05-03


- 2.5.4
- Fixes:
+ CVE-2017-8301
 
дизайн и разработка: Vladimir Lettiev aka crux © 2004-2005, Andrew Avramenko aka liks © 2007-2008
текущий майнтейнер: Michael Shigorin