ALT Vulnerability
This commit is contained in:
parent
8a40c6ee37
commit
0dcdb9893e
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
111
oval/p10/ALT-PU-2024-9706/definitions.json
Normal file
111
oval/p10/ALT-PU-2024-9706/definitions.json
Normal file
@ -0,0 +1,111 @@
|
||||
{
|
||||
"Definition": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:def:20249706",
|
||||
"Version": "oval:org.altlinux.errata:def:20249706",
|
||||
"Class": "patch",
|
||||
"Metadata": {
|
||||
"Title": "ALT-PU-2024-9706: package `gst-plugins-good1.0` update to version 1.20.7-alt1",
|
||||
"AffectedList": [
|
||||
{
|
||||
"Family": "unix",
|
||||
"Platforms": [
|
||||
"ALT Linux branch p10"
|
||||
],
|
||||
"Products": [
|
||||
"ALT Server",
|
||||
"ALT Virtualization Server",
|
||||
"ALT Workstation",
|
||||
"ALT Workstation K",
|
||||
"ALT Education",
|
||||
"Simply Linux",
|
||||
"Starterkit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"References": [
|
||||
{
|
||||
"RefID": "ALT-PU-2024-9706",
|
||||
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-9706",
|
||||
"Source": "ALTPU"
|
||||
},
|
||||
{
|
||||
"RefID": "CVE-2023-37327",
|
||||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-37327",
|
||||
"Source": "CVE"
|
||||
}
|
||||
],
|
||||
"Description": "This update upgrades gst-plugins-good1.0 to version 1.20.7-alt1. \nSecurity Fix(es):\n\n * CVE-2023-37327: GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of FLAC audio files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20775.",
|
||||
"Advisory": {
|
||||
"From": "errata.altlinux.org",
|
||||
"Severity": "Low",
|
||||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||||
"Issued": {
|
||||
"Date": "2024-07-08"
|
||||
},
|
||||
"Updated": {
|
||||
"Date": "2024-07-08"
|
||||
},
|
||||
"BDUs": null,
|
||||
"CVEs": [
|
||||
{
|
||||
"ID": "CVE-2023-37327",
|
||||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-37327",
|
||||
"Impact": "None",
|
||||
"Public": "20240503"
|
||||
}
|
||||
],
|
||||
"AffectedCPEs": {
|
||||
"CPEs": [
|
||||
"cpe:/o:alt:kworkstation:10",
|
||||
"cpe:/o:alt:workstation:10",
|
||||
"cpe:/o:alt:server:10",
|
||||
"cpe:/o:alt:server-v:10",
|
||||
"cpe:/o:alt:education:10",
|
||||
"cpe:/o:alt:slinux:10",
|
||||
"cpe:/o:alt:starterkit:p10",
|
||||
"cpe:/o:alt:kworkstation:10.1",
|
||||
"cpe:/o:alt:workstation:10.1",
|
||||
"cpe:/o:alt:server:10.1",
|
||||
"cpe:/o:alt:server-v:10.1",
|
||||
"cpe:/o:alt:education:10.1",
|
||||
"cpe:/o:alt:slinux:10.1",
|
||||
"cpe:/o:alt:starterkit:10.1",
|
||||
"cpe:/o:alt:kworkstation:10.2",
|
||||
"cpe:/o:alt:workstation:10.2",
|
||||
"cpe:/o:alt:server:10.2",
|
||||
"cpe:/o:alt:server-v:10.2",
|
||||
"cpe:/o:alt:education:10.2",
|
||||
"cpe:/o:alt:slinux:10.2",
|
||||
"cpe:/o:alt:starterkit:10.2"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"Criteria": {
|
||||
"Operator": "AND",
|
||||
"Criterions": [
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:2001",
|
||||
"Comment": "ALT Linux must be installed"
|
||||
}
|
||||
],
|
||||
"Criterias": [
|
||||
{
|
||||
"Operator": "OR",
|
||||
"Criterions": [
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:20249706001",
|
||||
"Comment": "gst-plugins-good1.0 is earlier than 0:1.20.7-alt1"
|
||||
},
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:20249706002",
|
||||
"Comment": "gst-plugins-good1.0-qt5 is earlier than 0:1.20.7-alt1"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
40
oval/p10/ALT-PU-2024-9706/objects.json
Normal file
40
oval/p10/ALT-PU-2024-9706/objects.json
Normal file
@ -0,0 +1,40 @@
|
||||
{
|
||||
"TextFileContent54Objects": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:2001",
|
||||
"Version": "1",
|
||||
"Comment": "Evaluate `/etc/os-release` file content",
|
||||
"Path": {
|
||||
"Datatype": "string",
|
||||
"Text": "/etc"
|
||||
},
|
||||
"Filepath": {
|
||||
"Datatype": "string",
|
||||
"Text": "os-release"
|
||||
},
|
||||
"Pattern": {
|
||||
"Datatype": "string",
|
||||
"Operation": "pattern match",
|
||||
"Text": "cpe:\\/o:alt:(?!sp)[a-z\\-]+:p?(\\d+)(?:\\.\\d)*"
|
||||
},
|
||||
"Instance": {
|
||||
"Datatype": "int",
|
||||
"Text": "1"
|
||||
}
|
||||
}
|
||||
],
|
||||
"RPMInfoObjects": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:20249706001",
|
||||
"Version": "1",
|
||||
"Comment": "gst-plugins-good1.0 is installed",
|
||||
"Name": "gst-plugins-good1.0"
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:20249706002",
|
||||
"Version": "1",
|
||||
"Comment": "gst-plugins-good1.0-qt5 is installed",
|
||||
"Name": "gst-plugins-good1.0-qt5"
|
||||
}
|
||||
]
|
||||
}
|
23
oval/p10/ALT-PU-2024-9706/states.json
Normal file
23
oval/p10/ALT-PU-2024-9706/states.json
Normal file
@ -0,0 +1,23 @@
|
||||
{
|
||||
"TextFileContent54State": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:ste:2001",
|
||||
"Version": "1",
|
||||
"Text": {}
|
||||
}
|
||||
],
|
||||
"RPMInfoStates": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:ste:20249706001",
|
||||
"Version": "1",
|
||||
"Comment": "package EVR is earlier than 0:1.20.7-alt1",
|
||||
"Arch": {},
|
||||
"EVR": {
|
||||
"Text": "0:1.20.7-alt1",
|
||||
"Datatype": "evr_string",
|
||||
"Operation": "less than"
|
||||
},
|
||||
"Subexpression": {}
|
||||
}
|
||||
]
|
||||
}
|
42
oval/p10/ALT-PU-2024-9706/tests.json
Normal file
42
oval/p10/ALT-PU-2024-9706/tests.json
Normal file
@ -0,0 +1,42 @@
|
||||
{
|
||||
"TextFileContent54Tests": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:2001",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "ALT Linux based on branch 'p10' must be installed",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:2001"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:2001"
|
||||
}
|
||||
}
|
||||
],
|
||||
"RPMInfoTests": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:20249706001",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "gst-plugins-good1.0 is earlier than 0:1.20.7-alt1",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:20249706001"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:20249706001"
|
||||
}
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:20249706002",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "gst-plugins-good1.0-qt5 is earlier than 0:1.20.7-alt1",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:20249706002"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:20249706001"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
153
oval/p10/ALT-PU-2024-9708/definitions.json
Normal file
153
oval/p10/ALT-PU-2024-9708/definitions.json
Normal file
@ -0,0 +1,153 @@
|
||||
{
|
||||
"Definition": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:def:20249708",
|
||||
"Version": "oval:org.altlinux.errata:def:20249708",
|
||||
"Class": "patch",
|
||||
"Metadata": {
|
||||
"Title": "ALT-PU-2024-9708: package `gst-plugins-base1.0` update to version 1.20.7-alt1",
|
||||
"AffectedList": [
|
||||
{
|
||||
"Family": "unix",
|
||||
"Platforms": [
|
||||
"ALT Linux branch p10"
|
||||
],
|
||||
"Products": [
|
||||
"ALT Server",
|
||||
"ALT Virtualization Server",
|
||||
"ALT Workstation",
|
||||
"ALT Workstation K",
|
||||
"ALT Education",
|
||||
"Simply Linux",
|
||||
"Starterkit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"References": [
|
||||
{
|
||||
"RefID": "ALT-PU-2024-9708",
|
||||
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-9708",
|
||||
"Source": "ALTPU"
|
||||
},
|
||||
{
|
||||
"RefID": "BDU:2023-04340",
|
||||
"RefURL": "https://bdu.fstec.ru/vul/2023-04340",
|
||||
"Source": "BDU"
|
||||
},
|
||||
{
|
||||
"RefID": "CVE-2023-37327",
|
||||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-37327",
|
||||
"Source": "CVE"
|
||||
},
|
||||
{
|
||||
"RefID": "CVE-2023-37329",
|
||||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-37329",
|
||||
"Source": "CVE"
|
||||
}
|
||||
],
|
||||
"Description": "This update upgrades gst-plugins-base1.0 to version 1.20.7-alt1. \nSecurity Fix(es):\n\n * BDU:2023-04340: Уязвимость плагина Base (gst-plugins-base) мультимедийного фреймворка Gstreamer, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2023-37327: GStreamer FLAC File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of FLAC audio files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20775.\n\n * CVE-2023-37329: GStreamer SRT File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of SRT subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20968.",
|
||||
"Advisory": {
|
||||
"From": "errata.altlinux.org",
|
||||
"Severity": "High",
|
||||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||||
"Issued": {
|
||||
"Date": "2024-07-08"
|
||||
},
|
||||
"Updated": {
|
||||
"Date": "2024-07-08"
|
||||
},
|
||||
"BDUs": [
|
||||
{
|
||||
"ID": "BDU:2023-04340",
|
||||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||
"CWE": "CWE-122",
|
||||
"Href": "https://bdu.fstec.ru/vul/2023-04340",
|
||||
"Impact": "High",
|
||||
"Public": "20230612"
|
||||
}
|
||||
],
|
||||
"CVEs": [
|
||||
{
|
||||
"ID": "CVE-2023-37327",
|
||||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-37327",
|
||||
"Impact": "None",
|
||||
"Public": "20240503"
|
||||
},
|
||||
{
|
||||
"ID": "CVE-2023-37329",
|
||||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-37329",
|
||||
"Impact": "None",
|
||||
"Public": "20240503"
|
||||
}
|
||||
],
|
||||
"AffectedCPEs": {
|
||||
"CPEs": [
|
||||
"cpe:/o:alt:kworkstation:10",
|
||||
"cpe:/o:alt:workstation:10",
|
||||
"cpe:/o:alt:server:10",
|
||||
"cpe:/o:alt:server-v:10",
|
||||
"cpe:/o:alt:education:10",
|
||||
"cpe:/o:alt:slinux:10",
|
||||
"cpe:/o:alt:starterkit:p10",
|
||||
"cpe:/o:alt:kworkstation:10.1",
|
||||
"cpe:/o:alt:workstation:10.1",
|
||||
"cpe:/o:alt:server:10.1",
|
||||
"cpe:/o:alt:server-v:10.1",
|
||||
"cpe:/o:alt:education:10.1",
|
||||
"cpe:/o:alt:slinux:10.1",
|
||||
"cpe:/o:alt:starterkit:10.1",
|
||||
"cpe:/o:alt:kworkstation:10.2",
|
||||
"cpe:/o:alt:workstation:10.2",
|
||||
"cpe:/o:alt:server:10.2",
|
||||
"cpe:/o:alt:server-v:10.2",
|
||||
"cpe:/o:alt:education:10.2",
|
||||
"cpe:/o:alt:slinux:10.2",
|
||||
"cpe:/o:alt:starterkit:10.2"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"Criteria": {
|
||||
"Operator": "AND",
|
||||
"Criterions": [
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:2001",
|
||||
"Comment": "ALT Linux must be installed"
|
||||
}
|
||||
],
|
||||
"Criterias": [
|
||||
{
|
||||
"Operator": "OR",
|
||||
"Criterions": [
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:20249708001",
|
||||
"Comment": "gst-plugins-base1.0 is earlier than 0:1.20.7-alt1"
|
||||
},
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:20249708002",
|
||||
"Comment": "gst-plugins1.0-devel is earlier than 0:1.20.7-alt1"
|
||||
},
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:20249708003",
|
||||
"Comment": "gst-plugins1.0-gir-devel is earlier than 0:1.20.7-alt1"
|
||||
},
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:20249708004",
|
||||
"Comment": "gst-plugins1.0-tools is earlier than 0:1.20.7-alt1"
|
||||
},
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:20249708005",
|
||||
"Comment": "libgst-plugins1.0 is earlier than 0:1.20.7-alt1"
|
||||
},
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:20249708006",
|
||||
"Comment": "libgst-plugins1.0-gir is earlier than 0:1.20.7-alt1"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
64
oval/p10/ALT-PU-2024-9708/objects.json
Normal file
64
oval/p10/ALT-PU-2024-9708/objects.json
Normal file
@ -0,0 +1,64 @@
|
||||
{
|
||||
"TextFileContent54Objects": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:2001",
|
||||
"Version": "1",
|
||||
"Comment": "Evaluate `/etc/os-release` file content",
|
||||
"Path": {
|
||||
"Datatype": "string",
|
||||
"Text": "/etc"
|
||||
},
|
||||
"Filepath": {
|
||||
"Datatype": "string",
|
||||
"Text": "os-release"
|
||||
},
|
||||
"Pattern": {
|
||||
"Datatype": "string",
|
||||
"Operation": "pattern match",
|
||||
"Text": "cpe:\\/o:alt:(?!sp)[a-z\\-]+:p?(\\d+)(?:\\.\\d)*"
|
||||
},
|
||||
"Instance": {
|
||||
"Datatype": "int",
|
||||
"Text": "1"
|
||||
}
|
||||
}
|
||||
],
|
||||
"RPMInfoObjects": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:20249708001",
|
||||
"Version": "1",
|
||||
"Comment": "gst-plugins-base1.0 is installed",
|
||||
"Name": "gst-plugins-base1.0"
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:20249708002",
|
||||
"Version": "1",
|
||||
"Comment": "gst-plugins1.0-devel is installed",
|
||||
"Name": "gst-plugins1.0-devel"
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:20249708003",
|
||||
"Version": "1",
|
||||
"Comment": "gst-plugins1.0-gir-devel is installed",
|
||||
"Name": "gst-plugins1.0-gir-devel"
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:20249708004",
|
||||
"Version": "1",
|
||||
"Comment": "gst-plugins1.0-tools is installed",
|
||||
"Name": "gst-plugins1.0-tools"
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:20249708005",
|
||||
"Version": "1",
|
||||
"Comment": "libgst-plugins1.0 is installed",
|
||||
"Name": "libgst-plugins1.0"
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:20249708006",
|
||||
"Version": "1",
|
||||
"Comment": "libgst-plugins1.0-gir is installed",
|
||||
"Name": "libgst-plugins1.0-gir"
|
||||
}
|
||||
]
|
||||
}
|
23
oval/p10/ALT-PU-2024-9708/states.json
Normal file
23
oval/p10/ALT-PU-2024-9708/states.json
Normal file
@ -0,0 +1,23 @@
|
||||
{
|
||||
"TextFileContent54State": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:ste:2001",
|
||||
"Version": "1",
|
||||
"Text": {}
|
||||
}
|
||||
],
|
||||
"RPMInfoStates": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:ste:20249708001",
|
||||
"Version": "1",
|
||||
"Comment": "package EVR is earlier than 0:1.20.7-alt1",
|
||||
"Arch": {},
|
||||
"EVR": {
|
||||
"Text": "0:1.20.7-alt1",
|
||||
"Datatype": "evr_string",
|
||||
"Operation": "less than"
|
||||
},
|
||||
"Subexpression": {}
|
||||
}
|
||||
]
|
||||
}
|
90
oval/p10/ALT-PU-2024-9708/tests.json
Normal file
90
oval/p10/ALT-PU-2024-9708/tests.json
Normal file
@ -0,0 +1,90 @@
|
||||
{
|
||||
"TextFileContent54Tests": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:2001",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "ALT Linux based on branch 'p10' must be installed",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:2001"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:2001"
|
||||
}
|
||||
}
|
||||
],
|
||||
"RPMInfoTests": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:20249708001",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "gst-plugins-base1.0 is earlier than 0:1.20.7-alt1",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:20249708001"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:20249708001"
|
||||
}
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:20249708002",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "gst-plugins1.0-devel is earlier than 0:1.20.7-alt1",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:20249708002"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:20249708001"
|
||||
}
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:20249708003",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "gst-plugins1.0-gir-devel is earlier than 0:1.20.7-alt1",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:20249708003"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:20249708001"
|
||||
}
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:20249708004",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "gst-plugins1.0-tools is earlier than 0:1.20.7-alt1",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:20249708004"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:20249708001"
|
||||
}
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:20249708005",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "libgst-plugins1.0 is earlier than 0:1.20.7-alt1",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:20249708005"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:20249708001"
|
||||
}
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:20249708006",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "libgst-plugins1.0-gir is earlier than 0:1.20.7-alt1",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:20249708006"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:20249708001"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
126
oval/p10/ALT-PU-2024-9710/definitions.json
Normal file
126
oval/p10/ALT-PU-2024-9710/definitions.json
Normal file
@ -0,0 +1,126 @@
|
||||
{
|
||||
"Definition": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:def:20249710",
|
||||
"Version": "oval:org.altlinux.errata:def:20249710",
|
||||
"Class": "patch",
|
||||
"Metadata": {
|
||||
"Title": "ALT-PU-2024-9710: package `gst-plugins-bad1.0` update to version 1.20.7-alt1",
|
||||
"AffectedList": [
|
||||
{
|
||||
"Family": "unix",
|
||||
"Platforms": [
|
||||
"ALT Linux branch p10"
|
||||
],
|
||||
"Products": [
|
||||
"ALT Server",
|
||||
"ALT Virtualization Server",
|
||||
"ALT Workstation",
|
||||
"ALT Workstation K",
|
||||
"ALT Education",
|
||||
"Simply Linux",
|
||||
"Starterkit"
|
||||
]
|
||||
}
|
||||
],
|
||||
"References": [
|
||||
{
|
||||
"RefID": "ALT-PU-2024-9710",
|
||||
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-9710",
|
||||
"Source": "ALTPU"
|
||||
},
|
||||
{
|
||||
"RefID": "BDU:2023-03624",
|
||||
"RefURL": "https://bdu.fstec.ru/vul/2023-03624",
|
||||
"Source": "BDU"
|
||||
},
|
||||
{
|
||||
"RefID": "CVE-2023-37328",
|
||||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-37328",
|
||||
"Source": "CVE"
|
||||
}
|
||||
],
|
||||
"Description": "This update upgrades gst-plugins-bad1.0 to version 1.20.7-alt1. \nSecurity Fix(es):\n\n * BDU:2023-03624: Уязвимость компонента анализа субтитров subparse мультимедийного фреймворка Gstreamer, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2023-37328: GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the parsing of PGS subtitle files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20994.",
|
||||
"Advisory": {
|
||||
"From": "errata.altlinux.org",
|
||||
"Severity": "High",
|
||||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||||
"Issued": {
|
||||
"Date": "2024-07-08"
|
||||
},
|
||||
"Updated": {
|
||||
"Date": "2024-07-08"
|
||||
},
|
||||
"BDUs": [
|
||||
{
|
||||
"ID": "BDU:2023-03624",
|
||||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||
"CWE": "CWE-122",
|
||||
"Href": "https://bdu.fstec.ru/vul/2023-03624",
|
||||
"Impact": "High",
|
||||
"Public": "20230612"
|
||||
}
|
||||
],
|
||||
"CVEs": [
|
||||
{
|
||||
"ID": "CVE-2023-37328",
|
||||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-37328",
|
||||
"Impact": "None",
|
||||
"Public": "20240503"
|
||||
}
|
||||
],
|
||||
"AffectedCPEs": {
|
||||
"CPEs": [
|
||||
"cpe:/o:alt:kworkstation:10",
|
||||
"cpe:/o:alt:workstation:10",
|
||||
"cpe:/o:alt:server:10",
|
||||
"cpe:/o:alt:server-v:10",
|
||||
"cpe:/o:alt:education:10",
|
||||
"cpe:/o:alt:slinux:10",
|
||||
"cpe:/o:alt:starterkit:p10",
|
||||
"cpe:/o:alt:kworkstation:10.1",
|
||||
"cpe:/o:alt:workstation:10.1",
|
||||
"cpe:/o:alt:server:10.1",
|
||||
"cpe:/o:alt:server-v:10.1",
|
||||
"cpe:/o:alt:education:10.1",
|
||||
"cpe:/o:alt:slinux:10.1",
|
||||
"cpe:/o:alt:starterkit:10.1",
|
||||
"cpe:/o:alt:kworkstation:10.2",
|
||||
"cpe:/o:alt:workstation:10.2",
|
||||
"cpe:/o:alt:server:10.2",
|
||||
"cpe:/o:alt:server-v:10.2",
|
||||
"cpe:/o:alt:education:10.2",
|
||||
"cpe:/o:alt:slinux:10.2",
|
||||
"cpe:/o:alt:starterkit:10.2"
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"Criteria": {
|
||||
"Operator": "AND",
|
||||
"Criterions": [
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:2001",
|
||||
"Comment": "ALT Linux must be installed"
|
||||
}
|
||||
],
|
||||
"Criterias": [
|
||||
{
|
||||
"Operator": "OR",
|
||||
"Criterions": [
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:20249710001",
|
||||
"Comment": "gst-plugins-bad1.0 is earlier than 0:1.20.7-alt1"
|
||||
},
|
||||
{
|
||||
"TestRef": "oval:org.altlinux.errata:tst:20249710002",
|
||||
"Comment": "gst-plugins-bad1.0-devel is earlier than 0:1.20.7-alt1"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
40
oval/p10/ALT-PU-2024-9710/objects.json
Normal file
40
oval/p10/ALT-PU-2024-9710/objects.json
Normal file
@ -0,0 +1,40 @@
|
||||
{
|
||||
"TextFileContent54Objects": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:2001",
|
||||
"Version": "1",
|
||||
"Comment": "Evaluate `/etc/os-release` file content",
|
||||
"Path": {
|
||||
"Datatype": "string",
|
||||
"Text": "/etc"
|
||||
},
|
||||
"Filepath": {
|
||||
"Datatype": "string",
|
||||
"Text": "os-release"
|
||||
},
|
||||
"Pattern": {
|
||||
"Datatype": "string",
|
||||
"Operation": "pattern match",
|
||||
"Text": "cpe:\\/o:alt:(?!sp)[a-z\\-]+:p?(\\d+)(?:\\.\\d)*"
|
||||
},
|
||||
"Instance": {
|
||||
"Datatype": "int",
|
||||
"Text": "1"
|
||||
}
|
||||
}
|
||||
],
|
||||
"RPMInfoObjects": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:20249710001",
|
||||
"Version": "1",
|
||||
"Comment": "gst-plugins-bad1.0 is installed",
|
||||
"Name": "gst-plugins-bad1.0"
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:obj:20249710002",
|
||||
"Version": "1",
|
||||
"Comment": "gst-plugins-bad1.0-devel is installed",
|
||||
"Name": "gst-plugins-bad1.0-devel"
|
||||
}
|
||||
]
|
||||
}
|
23
oval/p10/ALT-PU-2024-9710/states.json
Normal file
23
oval/p10/ALT-PU-2024-9710/states.json
Normal file
@ -0,0 +1,23 @@
|
||||
{
|
||||
"TextFileContent54State": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:ste:2001",
|
||||
"Version": "1",
|
||||
"Text": {}
|
||||
}
|
||||
],
|
||||
"RPMInfoStates": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:ste:20249710001",
|
||||
"Version": "1",
|
||||
"Comment": "package EVR is earlier than 0:1.20.7-alt1",
|
||||
"Arch": {},
|
||||
"EVR": {
|
||||
"Text": "0:1.20.7-alt1",
|
||||
"Datatype": "evr_string",
|
||||
"Operation": "less than"
|
||||
},
|
||||
"Subexpression": {}
|
||||
}
|
||||
]
|
||||
}
|
42
oval/p10/ALT-PU-2024-9710/tests.json
Normal file
42
oval/p10/ALT-PU-2024-9710/tests.json
Normal file
@ -0,0 +1,42 @@
|
||||
{
|
||||
"TextFileContent54Tests": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:2001",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "ALT Linux based on branch 'p10' must be installed",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:2001"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:2001"
|
||||
}
|
||||
}
|
||||
],
|
||||
"RPMInfoTests": [
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:20249710001",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "gst-plugins-bad1.0 is earlier than 0:1.20.7-alt1",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:20249710001"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:20249710001"
|
||||
}
|
||||
},
|
||||
{
|
||||
"ID": "oval:org.altlinux.errata:tst:20249710002",
|
||||
"Version": "1",
|
||||
"Check": "all",
|
||||
"Comment": "gst-plugins-bad1.0-devel is earlier than 0:1.20.7-alt1",
|
||||
"Object": {
|
||||
"ObjectRef": "oval:org.altlinux.errata:obj:20249710002"
|
||||
},
|
||||
"State": {
|
||||
"StateRef": "oval:org.altlinux.errata:ste:20249710001"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
File diff suppressed because one or more lines are too long
Loading…
Reference in New Issue
Block a user