pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b1153fc0bf
vuln-list-alt/oval/c10f1/ALT-PU-2021-2943/definitions.json

280 lines
14 KiB
JSON
Raw Normal View History

ALT Vulnerability
2024-06-28 16:17:52 +03:00
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20212943",
"Version": "oval:org.altlinux.errata:def:20212943",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2021-2943: package `php7` update to version 7.4.24-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2021-2943",
"RefURL": "https://errata.altlinux.org/ALT-PU-2021-2943",
"Source": "ALTPU"
},
{
"RefID": "BDU:2017-01814",
"RefURL": "https://bdu.fstec.ru/vul/2017-01814",
"Source": "BDU"
},
{
"RefID": "BDU:2021-06176",
"RefURL": "https://bdu.fstec.ru/vul/2021-06176",
"Source": "BDU"
},
{
"RefID": "BDU:2022-02425",
"RefURL": "https://bdu.fstec.ru/vul/2022-02425",
"Source": "BDU"
},
ALT Vulnerability
2024-11-14 18:05:18 +03:00
{
"RefID": "BDU:2024-07676",
"RefURL": "https://bdu.fstec.ru/vul/2024-07676",
"Source": "BDU"
},
{
"RefID": "BDU:2024-07677",
"RefURL": "https://bdu.fstec.ru/vul/2024-07677",
"Source": "BDU"
},
{
"RefID": "BDU:2024-07679",
"RefURL": "https://bdu.fstec.ru/vul/2024-07679",
"Source": "BDU"
},
{
"RefID": "BDU:2024-07680",
"RefURL": "https://bdu.fstec.ru/vul/2024-07680",
"Source": "BDU"
},
ALT Vulnerability
2024-06-28 16:17:52 +03:00
{
"RefID": "CVE-2017-8923",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-8923",
"Source": "CVE"
},
{
"RefID": "CVE-2017-9120",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-9120",
"Source": "CVE"
},
{
"RefID": "CVE-2021-21706",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-21706",
"Source": "CVE"
ALT Vulnerability
2024-11-14 18:05:18 +03:00
},
{
"RefID": "CVE-2024-8925",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-8925",
"Source": "CVE"
},
{
"RefID": "CVE-2024-8926",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-8926",
"Source": "CVE"
},
{
"RefID": "CVE-2024-8927",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-8927",
"Source": "CVE"
},
{
"RefID": "CVE-2024-9026",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-9026",
"Source": "CVE"
ALT Vulnerability
2024-06-28 16:17:52 +03:00
}
],
ALT Vulnerability
2024-11-14 18:05:18 +03:00
"Description": "This update upgrades php7 to version 7.4.24-alt1. \nSecurity Fix(es):\n\n * BDU:2017-01814: Уязвимость функции zend_string_extend интерпретатора PHP, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие\n\n * BDU:2021-06176: Уязвимость функции ZipArchive::extractTo интерпретатора PHP, позволяющая нарушителю создать или перезаписать файлы\n\n * BDU:2022-02425: Уязвимость функции mysqli_real_escape_string интерпретатора языка программирования PHP, позволяющая нарушителю вызвать отказ в обслуживании или, возможно, оказать другое воздействие\n\n * BDU:2024-07676: Уязвимость интерпретатора языка программирования PHP, связанная с недостаточной проверкой входных данных, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2024-07677: Уязвимость интерпретатора языка программирования PHP, существующая из-за непринятия мер по нейтрализации специальных элементов, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2024-07679: Уязвимость сценария cgi.force_redirect интерпретатора языка программирования PHP, позволяющая нарушителю обойти существующие ограничения безопасности\n\n * BDU:2024-07680: Уязвимость интерпретатора языка программирования PHP, позволяющая нарушителю обойти существующие ограничения безопасности\n\n * CVE-2017-8923: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.\n\n * CVE-2017-9120: PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.\n\n * CVE-2021-21706: In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.\n\n * CVE-2024-8925: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.\n\n * CVE-2024-8926: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows \"Best Fit\" codepage behavior can be achieved. This may all
ALT Vulnerability
2024-06-28 16:17:52 +03:00
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2021-09-30"
},
"Updated": {
ALT Vulnerability
2024-11-14 18:05:18 +03:00
"Date": "2024-11-14"
ALT Vulnerability
2024-06-28 16:17:52 +03:00
},
"BDUs": [
{
"ID": "BDU:2017-01814",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"CWE": "CWE-20",
"Href": "https://bdu.fstec.ru/vul/2017-01814",
"Impact": "High",
"Public": "20170512"
},
{
"ID": "BDU:2021-06176",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:C/A:N",
"CVSS3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"CWE": "CWE-22, CWE-24",
"Href": "https://bdu.fstec.ru/vul/2021-06176",
"Impact": "Low",
"Public": "20210906"
},
{
"ID": "BDU:2022-02425",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-190",
"Href": "https://bdu.fstec.ru/vul/2022-02425",
"Impact": "Critical",
"Public": "20180802"
ALT Vulnerability
2024-11-14 18:05:18 +03:00
},
{
"ID": "BDU:2024-07676",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-20",
"Href": "https://bdu.fstec.ru/vul/2024-07676",
"Impact": "Critical",
"Public": "20240929"
},
{
"ID": "BDU:2024-07677",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-78",
"Href": "https://bdu.fstec.ru/vul/2024-07677",
"Impact": "Critical",
"Public": "20240929"
},
{
"ID": "BDU:2024-07679",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-254",
"Href": "https://bdu.fstec.ru/vul/2024-07679",
"Impact": "Critical",
"Public": "20240929"
},
{
"ID": "BDU:2024-07680",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-778",
"Href": "https://bdu.fstec.ru/vul/2024-07680",
"Impact": "Critical",
"Public": "20240929"
ALT Vulnerability
2024-06-28 16:17:52 +03:00
}
],
"CVEs": [
{
"ID": "CVE-2017-8923",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-8923",
"Impact": "Critical",
"Public": "20170512"
},
{
"ID": "CVE-2017-9120",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-190",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-9120",
"Impact": "Critical",
"Public": "20180802"
},
{
"ID": "CVE-2021-21706",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"CWE": "CWE-22",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21706",
"Impact": "Low",
"Public": "20211004"
ALT Vulnerability
2024-11-14 18:05:18 +03:00
},
{
"ID": "CVE-2024-8925",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"CWE": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-8925",
"Impact": "Low",
"Public": "20241008"
},
{
"ID": "CVE-2024-8926",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-78",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-8926",
"Impact": "High",
"Public": "20241008"
},
{
"ID": "CVE-2024-8927",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"CWE": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-8927",
"Impact": "High",
"Public": "20241008"
},
{
"ID": "CVE-2024-9026",
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"CWE": "NVD-CWE-Other",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-9026",
"Impact": "Low",
"Public": "20241008"
ALT Vulnerability
2024-06-28 16:17:52 +03:00
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20212943001",
"Comment": "php7 is earlier than 0:7.4.24-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212943002",
"Comment": "php7-devel is earlier than 0:7.4.24-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212943003",
"Comment": "php7-libs is earlier than 0:7.4.24-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212943004",
"Comment": "php7-mysqlnd is earlier than 0:7.4.24-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212943005",
"Comment": "rpm-build-php7-version is earlier than 0:7.4.24-alt1"
}
]
}
]
}
}
]
}
Reference in New Issue Copy Permalink