Репозиторій Sisyphus
Останнє оновлення: 2018-02-19 08:06:51 +0300 | Пакетів: 18274 | Sign in or Sign up
en ru uk br
Security fixes

qemu-2.11.1-alt1  build 2018-02-16

Group: Емулятори
Про пакет: QEMU CPU Emulator
Зміни:

- 2.11.1
- This update contains new functionality needed to enable mitigations
for Spectre/Meltdown (CVE-2017-5715)
- fixes for potential host DoS attacks via VGA devices (CVE-2018-5683)
and VNC clients (CVE-2017-15124)
- revert define MAX_RESERVED_VA for arm

rsync-3.1.3-alt1  build 2018-02-15

Group: Мережі/Передача файлів
Про пакет: A program for synchronizing files over a network
Зміни:

- v3.1.2 -> v3.1.3 (fixes CVE-2018-5764).
- Fixed running with an unknown current directory
(by Florian Weimer; fixes upstream bug 6422).
- Added --noatime option (based on patch from Nicolas George;
fixes upstream bug 7249).

kf5-plasma-workspace-5.11.5-alt2.S1  build 2018-02-12

Group: Графічні оболонки/KDE
Про пакет: KDE Workspace 5 Plasma
Зміни:

- security fix: CVE-2018-6791

mpv-0.27.1-alt1  build 2018-02-12

Group: Відео
Про пакет: mpv is a free and open-source general-purpose video player based on MPlayer and mplayer2.
Зміни:

- 0.27.1
- Fixes:
+ CVE-2018-6360

firefox-58.0.2-alt1  build 2018-02-11

Group: Мережі/WWW
Про пакет: The Mozilla Firefox project is a redesign of Mozilla's browser
Зміни:

- New release (58.0.2).
- Fixed:
+ CVE-2018-5091: Use-after-free with DTMF timers
+ CVE-2018-5092: Use-after-free in Web Workers
+ CVE-2018-5093: Buffer overflow in WebAssembly during Memory/Table resizing
+ CVE-2018-5094: Buffer overflow in WebAssembly with garbage collection on uninitialized memory
+ CVE-2018-5095: Integer overflow in Skia library during edge builder allocation
+ CVE-2018-5097: Use-after-free when source document is manipulated during XSLT
+ CVE-2018-5098: Use-after-free while manipulating form input elements
+ CVE-2018-5099: Use-after-free with widget listener
+ CVE-2018-5100: Use-after-free when IsPotentiallyScrollable arguments are freed from memory
+ CVE-2018-5101: Use-after-free with floating first-letter style elements
+ CVE-2018-5102: Use-after-free in HTML media elements
+ CVE-2018-5103: Use-after-free during mouse event handling
+ CVE-2018-5104: Use-after-free during font face manipulation
+ CVE-2018-5105: WebExtensions can save and execute files on local file system without user prompts
+ CVE-2018-5106: Developer Tools can expose style editor information cross-origin through service worker
+ CVE-2018-5107: Printing process will follow symlinks for local file access
+ CVE-2018-5108: Manually entered blob URL can be accessed by subsequent private browsing tabs
+ CVE-2018-5109: Audio capture prompts and starts with incorrect origin attribution
+ CVE-2018-5110: Cursor can be made invisible on OS X
+ CVE-2018-5111: URL spoofing in addressbar through drag and drop
+ CVE-2018-5112: Extension development tools panel can open a non-relative URL in the panel
+ CVE-2018-5113: WebExtensions can load non-HTTPS pages with browser.identity.launchWebAuthFlow
+ CVE-2018-5114: The old value of a cookie changed to HttpOnly remains accessible to scripts
+ CVE-2018-5115: Background network requests can open HTTP authentication in unrelated foreground tabs
+ CVE-2018-5116: WebExtension ActiveTab permission allows cross-origin frame content access
+ CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right
+ CVE-2018-5118: Activity Stream images can attempt to load local content through file:
+ CVE-2018-5119: Reader view will load cross-origin content in violation of CORS headers
+ CVE-2018-5121: OS X Tibetan characters render incompletely in the addressbar
+ CVE-2018-5122: Potential integer overflow in DoCrypt
+ CVE-2018-5090: Memory safety bugs fixed in Firefox 58
+ CVE-2018-5089: Memory safety bugs fixed in Firefox 58 and Firefox ESR 52.6
+ CVE-2018-5124: Sanitize HTML fragments created for chrome-privileged documents

dotnet-bootstrap-2.0.5-alt1  build 2018-02-05

Group: Розробка/Інше
Про пакет: .NET Core SDK binaries
Зміни:

- new version (2.0.5) with rpmgs script
- CVE-2018-0764, CVE-2018-0786

kernel-image-std-pae-1:4.4.115-alt1  build 2018-02-05

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.4.115 (Fixes: CVE-2017-5715)

kernel-image-std-def-1:4.9.79-alt1  build 2018-01-31

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.9.79 (Fixes: CVE-2017-5715)

kernel-image-un-def-1:4.14.16-alt1  build 2018-01-31

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.14.16 (Fixes: CVE-2017-5715)

php5-5.6.33-alt1.S1  build 2018-01-31

Group: Розробка/Інше
Про пакет: The PHP5 scripting language
Зміни:

- new version (fixes: CVE-2018-5711, CVE-2018-5712)

libxslt-1.1.32-alt2  build 2018-01-31

Group: Система/Бібліотеки
Про пакет: Library providing XSLT support
Зміни:

- Actually updated source to 1.1.32.
- Upstream support for SOURCE_DATE_EPOCH (ALT#32814).
- Fixes:
+ CVE-2017-5029 generation of text nodes integer overflow,
+ CVE-2016-1684 integer overflow (mishandle the i format token for
xsl:number),
+ CVE-2016-1683 out-of-bounds heap memory access (mishandle namespace nodes).

glibc-6:2.26.9000.0.1248.407552c-alt1  build 2018-01-30

Group: Система/Основа
Про пакет: The GNU libc libraries
Зміни:

- Updated to glibc-2.26.9000-1248-g407552c.
- Switched IDNA implementation to libidn2 (by Florian Weimer;
fixes: CVE-2016-6261, CVE-2016-6263, CVE-2017-14062).

thunderbird-52.6.0-alt1  build 2018-01-29

Group: Мережі/Пошта
Про пакет: Thunderbird is Mozilla's e-mail client
Зміни:

- New version (52.6.0)
- Fixes:
+ CVE-2018-5095 Integer overflow in Skia library during edge builder allocation
+ CVE-2018-5096 Use-after-free while editing form elements
+ CVE-2018-5097 Use-after-free when source document is manipulated during XSLT
+ CVE-2018-5098 Use-after-free while manipulating form input elements
+ CVE-2018-5099 Use-after-free with widget listener
+ CVE-2018-5102 Use-after-free in HTML media elements
+ CVE-2018-5103 Use-after-free during mouse event handling
+ CVE-2018-5104 Use-after-free during font face manipulation
+ CVE-2018-5117 URL spoofing with right-to-left text aligned left-to-right
+ CVE-2018-5089 Memory safety bugs fixed in Firefox 58, Firefox ESR 52.6, and Thunderbird 52.6

clamav-0.99.3-alt1  build 2018-01-28

Group: Робота з файлами
Про пакет: Clam Antivirus scanner
Зміни:

- 0.99.3 (multiple CVE's, look to README)
- removed cve-2017-6418.patch and cve-2017-6420.patch (in upstream now)

chromium-64.0.3282.119-alt1  build 2018-01-25

Group: Мережі/WWW
Про пакет: An open source web browser developed by Google
Зміни:

- - New version (64.0.3282.119).
- Security fixes:
- CVE-2018-6031: Use after free in PDFium.
- CVE-2018-6032: Same origin bypass in Shared Worker.
- CVE-2018-6033: Race when opening downloaded files.
- CVE-2018-6034: Integer overflow in Blink.
- CVE-2018-6035: Insufficient isolation of devtools from extensions.
- CVE-2018-6036: Integer underflow in WebAssembly.
- CVE-2018-6037: Insufficient user gesture requirements in autofill.
- CVE-2018-6038: Heap buffer overflow in WebGL.
- CVE-2018-6039: XSS in DevTools.
- CVE-2018-6040: Content security policy bypass.
- CVE-2018-6041: URL spoof in Navigation.
- CVE-2018-6042: URL spoof in OmniBox.
- CVE-2018-6043: Insufficient escaping with external URL handlers.
- CVE-2018-6045: Insufficient isolation of devtools from extensions.
- CVE-2018-6046: Insufficient isolation of devtools from extensions.
- CVE-2018-6047: Cross origin URL leak in WebGL.
- CVE-2018-6048: Referrer policy bypass in Blink.
- CVE-2017-15420: URL spoofing in Omnibox.
- CVE-2018-6049: UI spoof in Permissions.
- CVE-2018-6050: URL spoof in OmniBox.
- CVE-2018-6051: Referrer leak in XSS Auditor.
- CVE-2018-6052: Incomplete no-referrer policy implementation.
- CVE-2018-6053: Leak of page thumbnails in New Tab Page.
- CVE-2018-6054: Use after free in WebUI.

curl-7.58.0-alt1.S1  build 2018-01-24

Group: Мережі/Передача файлів
Про пакет: Gets a file from a FTP, GOPHER or HTTP server
Зміни:

- new version
- fixes:
* CVE-2018-1000005 HTTP/2 trailer out-of-bounds read
* CVE-2018-1000007 HTTP authentication leak in redirects

libwebkitgtk4-2.18.6-alt1  build 2018-01-24

Group: Система/Бібліотеки
Про пакет: Web browser engine
Зміни:

- 2.18.6 (fixed CVE-2018-4088, CVE-2017-13885, CVE-2017-7165,
CVE-2017-13884, CVE-2017-7160, CVE-2017-7153, CVE-2017-7153,
CVE-2017-7161, CVE-2018-4096)

xen-4.10.0-alt4.S1  build 2018-01-23

Group: Емулятори
Про пакет: Xen is a virtual machine monitor (hypervisor)
Зміни:

- upstream updates (Xen hypervisor):
+ x86: allow Meltdown band-aid to be disabled (thx Jan Beulich).
+ x86: Meltdown band-aid against malicious 64-bit PV guests (thx Jan Beulich).
+ x86/mm: Always set _PAGE_ACCESSED on L4e updates (thx Andrew Cooper).
+ x86: Don't use potentially incorrect CPUID values for topology
information (thx Jan H. Schonherr).
+ x86/entry: Remove support for partial cpu_user_regs frames (thx Andrew Cooper).
+ x86/upcall: inject a spurious event after setting upcall vector (thx Roger Pau Monne).
+ x86/E820: don't overrun array (thx Jan Beulich).
+ x86/IRQ: conditionally preserve access permission on map
error paths (thx Jan Beulich).
+ xen/arm: bootfdt: Use proper default for #address-cells and
+ xen/arm: gic-v3: Bail out if gicv3_cpu_init fail (thx Julien Grall).
- upstream updates (Qemu-xen device-model):
+ Update version for 2.10.2 release (thx Michael Roth).
+ spapr: don't initialize PATB entry if max-cpu-compat < power9 (thx Laurent Vivier).
+ target/ppc: Update setting of cpu features to account for
compat modes (thx Suraj Jitindar Singh).
+ vfio: Fix vfio-kvm group registration (thx Alex Williamson).
+ spapr: Include "pre-plugged" DIMMS in ram size calculation
at reset (thx David Gibson).
+ vga: handle cirrus vbe mode wraparounds. (thx Gerd Hoffmann).
+ vga: drop line_offset variable (thx Gerd Hoffmann).
+ nbd/client: Don't hard-disconnect on ESHUTDOWN from server (thx Eric Blake).
+ nbd-client: Refuse read-only client with BDRV_O_RDWR (thx Eric Blake).
+ nbd/server: fix nbd_negotiate_handle_info (thx Vladimir Sementsov-Ogievskiy).
+ vhost: fix error check in vhost_verify_ring_mappings() (thx Greg Kurz).
+ nbd/server: CVE-2017-15118 Stack smash on large export name (thx Eric Blake).
+ nbd/server: CVE-2017-15119 Reject options larger than 32M (thx Eric Blake).
+ virtio-net: don't touch virtqueue if vm is stopped (thx Jason Wang).
+ block/nfs: fix nfs_client_open for filesize greater than 1TB (thx Peter Lieven).
+ scripts/make-release: ship u-boot source as a tarball (thx Michael Roth).
+ spapr: reset DRCs after devices (thx Greg Kurz).
+ hw/ppc: clear pending_events on machine reset (thx Daniel Henrique Barboza).
+ vhost: restore avail index from vring used index on disconnection (thx Maxime Coquelin).
+ virtio: Add queue interface to restore avail index from vring
used index (thx Maxime Coquelin).
+ util/stats64: Fix min/max comparisons (thx Max Reitz).
+ nbd/client: Use error_prepend() correctly (thx Eric Blake).
+ net: fix check for number of parameters to -netdev socket (thx Jens Freimann).
+ net/socket: fix coverity issue (thx Jens Freimann).
+ hw/intc/arm_gicv3_its: Don't abort on table save failure (thx Eric Auger).
+ translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD (thx Peter Maydell).
+ ppc: fix setting of compat mode (thx Greg Kurz).
+ io: monitor encoutput buffer size from websocket GSource (thx Daniel P. Berrange).
+ nios2: define tcg_env (thx Paolo Bonzini).
+ iotests: Add cluster_size=64k to 125 (thx Max Reitz).
+ qcow2: Always execute preallocate() in a coroutine (thx Max Reitz).
+ qcow2: Fix unaligned preallocated truncation (thx Max Reitz).
+ hw/sd: fix out-of-bounds check for multi block reads (thx Michael Olbrich).
+ memory: fix off-by-one error in memory_region_notify_one() (thx Maxime Coquelin).
+ exec: simplify address_space_get_iotlb_entry (thx Peter Xu).
+ exec: add page_mask for flatview_do_translate (thx Peter Xu).
+ memory: Share special empty FlatView (thx Alexey Kardashevskiy).
+ memory: seek FlatView sharing candidates among children
subregions (thx Paolo Bonzini).
+ memory: trace FlatView creation and destruction (thx Paolo Bonzini).
+ memory: Create FlatView directly (thx Alexey Kardashevskiy).
+ memory: Get rid of address_space_init_shareable (thx Alexey Kardashevskiy).
+ memory: Do not allocate FlatView in address_space_init (thx Alexey Kardashevskiy).
+ memory: Share FlatView's and dispatch trees between address
spaces (thx Alexey Kardashevskiy).
+ memory: Move address_space_update_ioeventfds (thx Alexey Kardashevskiy).
+ memory: Alloc dispatch tree where topology is generared (thx Alexey Kardashevskiy).
+ memory: Store physical root MR in FlatView (thx Alexey Kardashevskiy).
+ memory: Rename mem_begin/mem_commit/mem_add helpers (thx Alexey Kardashevskiy).
+ memory: Cleanup after switching to FlatView (thx Alexey Kardashevskiy).
+ memory: Switch memory from using AddressSpace to FlatView (thx Alexey Kardashevskiy).
+ memory: avoid "resurrection" of dead FlatViews (thx Paolo Bonzini).
+ memory: Remove AddressSpace pointer from AddressSpaceDispatch (thx Alexey Kardashevskiy).
+ memory: Move AddressSpaceDispatch from AddressSpace to FlatView (thx Alexey Kardashevskiy).
+ memory: Move FlatView allocation to a helper (thx Alexey Kardashevskiy).
+ memory: Open code FlatView rendering (thx Alexey Kardashevskiy).
+ exec: Explicitly export target AS from
address_space_translate_internal (thx Alexey Kardashevskiy).
+ block: Perform copy-on-read in loop (thx Eric Blake).
+ kvmclock: use the updated system_timer_msr (thx Jim Somerville).
+ block/mirror: check backing in bdrv_mirror_top_flush (thx Vladimir Sementsov-Ogievskiy).
+ hw/usb/bus: Remove bad object_unparent() from
usb_try_create_simple() (thx Thomas Huth).

gcab-1.0-alt1  build 2018-01-23

Group: Робота з файлами
Про пакет: M$ Cabinet archive library and tool
Зміни:

- 1.0 (fixed CVE-2018-5345)

icecast-2.4.3-alt1  build 2018-01-22

Group: Система/Сервери
Про пакет: Streaming Media Server
Зміни:

- Updated to upstream version 2.4.3 (Fixes: CVE-2011-4612).
- Fixed localstatedir.

kernel-image-un-def-1:4.14.14-alt1  build 2018-01-17

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.14.14 (Fixes: CVE-2017-1000410, CVE-2017-17741, CVE-2017-5753)

kernel-image-std-def-1:4.9.77-alt1  build 2018-01-17

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.9.77 (Fixes: CVE-2017-1000410, CVE-2017-17741, CVE-2017-5753)

bind-9.11.2.P1-alt1  build 2018-01-17

Group: Система/Сервери
Про пакет: ISC BIND - DNS server
Зміни:

- 9.11.2 -> 9.11.2-P1 (fixes: CVE-2017-3145).

kernel-image-std-pae-1:4.4.112-alt1  build 2018-01-17

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.4.112 (Fixes: CVE-2017-1000410, CVE-2017-17741, CVE-2017-5753)

wireshark-2.4.4-alt1.S1  build 2018-01-17

Group: Моніторинг
Про пакет: The BugTraq Award Winning Network Traffic Analyzer
Зміни:

- 2.4.4
- fixes:
* wnpa-sec-2018-01 Multiple dissectors could crash. CVE-2018-5336
* wnpa-sec-2018-03 The IxVeriWave file parser could crash. CVE-2018-5334
* wnpa-sec-2018-04 The WCP dissector could crash. CVE-2018-5335

glibc-6:2.26.0.131.fabef2e-alt1  build 2018-01-12

Group: Система/Основа
Про пакет: The GNU libc libraries
Зміни:

- Updated to glibc-2.26-131-gfabef2e from 2.26 branch
with assorted backports from master (fixes CVE-2018-1000001).

firmware-intel-ucode-1:3.20180108-alt1  build 2018-01-10

Group: Система/Ядро та обладнання
Про пакет: Microcode definitions for Intel processors
Зміни:

- Update to 20180108 (adapted debian changelog is below):
* New upstream microcode data file 20180108
+ Updated Microcodes:
sig 0x000306c3, pf_mask 0x32, 2017-11-20, rev 0x0023, size 23552
sig 0x000306d4, pf_mask 0xc0, 2017-11-17, rev 0x0028, size 18432
sig 0x000306e4, pf_mask 0xed, 2017-12-01, rev 0x042a, size 15360
sig 0x000306f2, pf_mask 0x6f, 2017-11-17, rev 0x003b, size 33792
sig 0x000306f4, pf_mask 0x80, 2017-11-17, rev 0x0010, size 17408
sig 0x00040651, pf_mask 0x72, 2017-11-20, rev 0x0021, size 22528
sig 0x00040661, pf_mask 0x32, 2017-11-20, rev 0x0018, size 25600
sig 0x00040671, pf_mask 0x22, 2017-11-17, rev 0x001b, size 13312
sig 0x000406e3, pf_mask 0xc0, 2017-11-16, rev 0x00c2, size 99328
sig 0x00050654, pf_mask 0xb7, 2017-12-08, rev 0x200003c, size 27648
sig 0x00050662, pf_mask 0x10, 2017-12-16, rev 0x0014, size 31744
sig 0x00050663, pf_mask 0x10, 2017-12-16, rev 0x7000011, size 22528
sig 0x000506e3, pf_mask 0x36, 2017-11-16, rev 0x00c2, size 99328
sig 0x000706a1, pf_mask 0x01, 2017-12-26, rev 0x0022, size 73728
sig 0x000806e9, pf_mask 0xc0, 2018-01-04, rev 0x0080, size 98304
sig 0x000806ea, pf_mask 0xc0, 2018-01-04, rev 0x0080, size 98304
sig 0x000906e9, pf_mask 0x2a, 2018-01-04, rev 0x0080, size 98304
sig 0x000906ea, pf_mask 0x22, 2018-01-04, rev 0x0080, size 97280
sig 0x000906eb, pf_mask 0x02, 2018-01-04, rev 0x0080, size 98304
+ Implements IBRS/IBPB support and enhances LFENCE: mitigation
against Spectre (fixes CVE-2017-5715)
+ Very likely fixes several other errata on some of the processors
* supplementary-ucode-CVE-2017-5715.d/: remove.
+ Downgraded microcodes:
sig 0x000406f1, pf_mask 0xef, 2017-03-01, rev 0xb000021, size 26624
sig 0x000506c9, pf_mask 0x03, 2017-03-25, rev 0x002c, size 16384
+ This removes IBRS/IBPB support for these two platforms when compared
with the previous (and unofficial) release, 20171215. We don't know
why Intel declined to include these microcode updates (as well as
several others) in the release.
* source: remove superseded upstream data file: 20171117

libwebkitgtk4-2.18.5-alt1  build 2018-01-10

Group: Система/Бібліотеки
Про пакет: Web browser engine
Зміни:

- 2.18.5 (fixed CVE-2017-5753, CVE-2017-5715)

mariadb-10.1.30-alt1.S1  build 2018-01-09

Group: Бази даних
Про пакет: A very fast and reliable SQL database engine
Зміни:

- 10.1.30
- Fixes for the following security vulnerabilities:
+ CVE-2017-15365

firefox-57.0.4-alt1  build 2018-01-06

Group: Мережі/WWW
Про пакет: The Mozilla Firefox project is a redesign of Mozilla's browser
Зміни:

- New release (57.0.4).
- Fixed:
+ Speculative execution side-channel attack ("Spectre")
+ CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9

firmware-linux-20180104-alt1.1  build 2018-01-05

Group: Система/Ядро та обладнання
Про пакет: Firmware files used by the Linux kernel
Зміни:

- amd-ucode: Add microcode_amd_fam17h.bin (bsc#1068032 CVE-2017-5715)

firmware-intel-ucode-1:3-alt1.20171121  build 2018-01-04

Group: Система/Ядро та обладнання
Про пакет: Microcode definitions for Intel processors
Зміни:

- Added new CPU microcodes (microcode counterpart of the CVE-2017-5715
kernel mitigation):
+ sig 0x000306f2, pf_mask 0x6f, 2017-11-17, rev 0x003b, size 33792
+ sig 0x000406f1, pf_mask 0xef, 2017-11-18, rev 0xb000025, size 27648
+ sig 0x00050654, pf_mask 0xb7, 2017-11-21, rev 0x200003a, size 27648

proftpd-1.3.5-alt4.rel.e  build 2018-01-02

Group: Система/Сервери
Про пакет: ProFTPd -- Professional FTP Server
Зміни:

- 1.3.5e release:
+ Backported fix for "AllowChrootSymlinks off" checking each component
for symlinks (CVE-2017-7418).
- minor .spec cleanup.

kernel-image-un-def-1:4.14.8-alt1.1  build 2017-12-25

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- SMACK enabled
- kernel.unprivileged_bpf_disabled set by default (Fixes: CVE-2017-16995, CVE-2017-16996)

kernel-image-std-def-1:4.9.72-alt1  build 2017-12-25

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.9.72 (Fixes: CVE-2017-16995)

kernel-image-un-def-1:4.14.9-alt1  build 2017-12-25

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.14.9 (Fixes: CVE-2017-16995, CVE-2017-16996)

kernel-image-std-def-1:4.9.71-alt1.1  build 2017-12-25

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- SMACK enabled
- kernel.unprivileged_bpf_disabled set by default (Fixes: CVE-2017-16995)

thunderbird-52.5.2-alt1  build 2017-12-25

Group: Мережі/Пошта
Про пакет: Thunderbird is Mozilla's e-mail client
Зміни:

- New version (52.5.2)
- Enigmail 1.9.9
- Fixes:
+ CVE-2017-7846 JavaScript Execution via RSS in mailbox:// origin
+ CVE-2017-7847 Local path string can be leaked from RSS feed
+ CVE-2017-7848 RSS Feed vulnerable to new line Injection
+ CVE-2017-7829 Mailsploit part 1: From address with encoded null character is cut off in message header display

adobe-flash-player-ppapi-3:28-alt1.S1  build 2017-12-25

Group: Мережі/WWW
Про пакет: Adobe Flash Player
Зміни:

- new version (ALT#34369)
- security fixes:
CVE-2017-3114, CVE-2017-3112, CVE-2017-11225, CVE-2017-11215,
CVE-2017-11213, CVE-2017-11305

libwebkitgtk4-2.18.4-alt1  build 2017-12-20

Group: Система/Бібліотеки
Про пакет: Web browser engine
Зміни:

- 2.18.4 (fixed CVE-2017-13866, CVE-2017-13870, CVE-2017-7156, CVE-2017-13856)

kernel-image-std-pae-1:4.4.106-alt1  build 2017-12-17

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.4.106 (Fixes: CVE-2017-0861, CVE-2017-1000407)

chromium-63.0.3239.108-alt1  build 2017-12-16

Group: Мережі/WWW
Про пакет: An open source web browser developed by Google
Зміни:

- New version (63.0.3239.108).
- Security fixes:
- CVE-2017-15429: UXSS in V8.

kernel-image-std-def-1:4.9.69-alt1  build 2017-12-15

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.9.69 (Fixes: CVE-2017-0861, CVE-2017-1000407)

kernel-image-un-def-1:4.14.6-alt1  build 2017-12-15

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.14.6 (Fixes: CVE-2017-0861, CVE-2017-1000407)

firefox-esr-52.5.2-alt1  build 2017-12-10

Group: Мережі/WWW
Про пакет: The Mozilla Firefox project is a redesign of Mozilla's browser
Зміни:

- New ESR version (52.5.2)
- Fixes:
+ CVE-2017-7843 Web worker in Private Browsing mode can write IndexedDB data
- Build with DBUS support (ALT #34302)

wireshark-2.4.3-alt1.S1  build 2017-12-09

Group: Моніторинг
Про пакет: The BugTraq Award Winning Network Traffic Analyzer
Зміни:

- 2.4.3
- fixes:
* wnpa-sec-2017-49 CIP Safety dissector crash CVE-2017-17085
* wnpa-sec-2017-48 NetBIOS dissector crash CVE-2017-17083
* wnpa-sec-2017-47 IWARP_MPA dissector crash CVE-2017-17084

pve-qemu-2.9.1-alt4  build 2017-12-07

Group: Емулятори
Про пакет: QEMU CPU Emulator
Зміни:

- fixes:
+ CVE-2017-17381 fix and backup race condition fix

openssl10-1.0.2n-alt1  build 2017-12-07

Group: Система/Основа
Про пакет: OpenSSL - Secure Sockets Layer and cryptography shared libraries and tools
Зміни:

- Updated to v1.0.2n (fixes CVE-2017-3737, CVE-2017-3738).
- Added --disable tsget knob.
- Added support of s390x and mips* architectures.

kernel-image-un-def-1:4.14.4-alt1  build 2017-12-06

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.14.4 (Fixes: CVE-2011-1161, CVE-2017-8824)

kernel-image-std-pae-1:4.4.104-alt1  build 2017-12-06

Group: Система/Ядро та обладнання
Про пакет: The Linux kernel (the core of the Linux operating system)
Зміни:

- v4.4.104 (Fixes: CVE-2017-8824)

  1         3     4     5            Остання »  

 
© 2009–2018 Ігор Зубков