vuln-list-alt/oval/p9/ALT-PU-2020-1853/definitions.json

{
  "Definition": [
    {
      "ID": "oval:org.altlinux.errata:def:20201853",
      "Version": "oval:org.altlinux.errata:def:20201853",
      "Class": "patch",
      "Metadata": {
        "Title": "ALT-PU-2020-1853: package `php7` update to version 7.3.17-alt1",
        "AffectedList": [
          {
            "Family": "unix",
            "Platforms": [
              "ALT Linux branch p9"
            ],
            "Products": [
              "ALT Server",
              "ALT Virtualization Server",
              "ALT Workstation",
              "ALT Workstation K",
              "ALT Education",
              "Simply Linux",
              "Starterkit"
            ]
          }
        ],
        "References": [
          {
            "RefID": "ALT-PU-2020-1853",
            "RefURL": "https://errata.altlinux.org/ALT-PU-2020-1853",
            "Source": "ALTPU"
          },
          {
            "RefID": "BDU:2020-05806",
            "RefURL": "https://bdu.fstec.ru/vul/2020-05806",
            "Source": "BDU"
          },
          {
            "RefID": "CVE-2020-7067",
            "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-7067",
            "Source": "CVE"
          }
        ],
        "Description": "This update upgrades php7 to version 7.3.17-alt1. \nSecurity Fix(es):\n\n * BDU:2020-05806: Уязвимость функции urldecode() интерпретатора языка программирования PHP, связанная с чтением за допустимыми границами буфера данных, позволяющая нарушителю получить доступ к защищаемой информации\n\n * CVE-2020-7067: In PHP versions 7.2.x below 7.2.30, 7.3.x below 7.3.17 and 7.4.x below 7.4.5, if PHP is compiled with EBCDIC support (uncommon), urldecode() function can be made to access locations past the allocated memory, due to erroneously using signed numbers as array indexes.",
        "Advisory": {
          "From": "errata.altlinux.org",
          "Severity": "High",
          "Rights": "Copyright 2024 BaseALT Ltd.",
          "Issued": {
            "Date": "2020-04-24"
          },
          "Updated": {
            "Date": "2020-04-24"
          },
          "BDUs": [
            {
              "ID": "BDU:2020-05806",
              "CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
              "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "CWE": "CWE-125",
              "Href": "https://bdu.fstec.ru/vul/2020-05806",
              "Impact": "High",
              "Public": "20200414"
            }
          ],
          "CVEs": [
            {
              "ID": "CVE-2020-7067",
              "CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "CWE": "CWE-125",
              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-7067",
              "Impact": "High",
              "Public": "20200427"
            }
          ],
          "AffectedCPEs": {
            "CPEs": [
              "cpe:/o:alt:kworkstation:9",
              "cpe:/o:alt:workstation:9",
              "cpe:/o:alt:server:9",
              "cpe:/o:alt:server-v:9",
              "cpe:/o:alt:education:9",
              "cpe:/o:alt:slinux:9",
              "cpe:/o:alt:starterkit:p9"
            ]
          }
        }
      },
      "Criteria": {
        "Operator": "AND",
        "Criterions": [
          {
            "TestRef": "oval:org.altlinux.errata:tst:1001",
            "Comment": "ALT Linux must be installed"
          }
        ],
        "Criterias": [
          {
            "Operator": "OR",
            "Criterions": [
              {
                "TestRef": "oval:org.altlinux.errata:tst:20201853001",
                "Comment": "php7 is earlier than 0:7.3.17-alt1"
              },
              {
                "TestRef": "oval:org.altlinux.errata:tst:20201853002",
                "Comment": "php7-devel is earlier than 0:7.3.17-alt1"
              },
              {
                "TestRef": "oval:org.altlinux.errata:tst:20201853003",
                "Comment": "php7-libs is earlier than 0:7.3.17-alt1"
              },
              {
                "TestRef": "oval:org.altlinux.errata:tst:20201853004",
                "Comment": "php7-mysqlnd is earlier than 0:7.3.17-alt1"
              },
              {
                "TestRef": "oval:org.altlinux.errata:tst:20201853005",
                "Comment": "rpm-build-php7-version is earlier than 0:7.3.17-alt1"
              }
            ]
          }
        ]
      }
    }
  ]
}