pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

clean up

Browse Source
This commit is contained in:
Ivan Pepelyaev 2024-04-12 12:50:11 +03:00
parent f3416c9f45
commit ec8d312f04
20404 changed files with 0 additions and 2190789 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1195
oval/c10f1/ALT-PU-2023-1869/definitions.json
View File

File diff suppressed because one or more lines are too long

1102
oval/c10f1/ALT-PU-2023-1869/objects.json
View File

File diff suppressed because it is too large Load Diff

23
oval/c10f1/ALT-PU-2023-1869/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20231869001",
"Version": "1",
"Comment": "package EVR is earlier than 0:8.0.0-alt1.p10",
"Arch": {},
"Evr": {
"Text": "0:8.0.0-alt1.p10",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

2166
oval/c10f1/ALT-PU-2023-1869/tests.json
View File

File diff suppressed because it is too large Load Diff

158
oval/c10f1/ALT-PU-2023-1887/definitions.json
View File

@ -1,158 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20231887",
"Version": "oval:org.altlinux.errata:def:20231887",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-1887: package `plymouth` update to version 22.02.122-alt2.20221016",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-1887",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-1887",
"Source": "ALTPU"
}
],
"Description": "This update upgrades plymouth to version 22.02.122-alt2.20221016. \nSecurity Fix(es):\n\n * #39326: Не показывается splash, если включен вывод на serial console\n\n * #44297: Не работает plymouth на UEFI с ядром un-def",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-05-26"
},
"Updated": {
"Date": "2023-05-26"
},
"bdu": null,
"Bugzilla": [
{
"Id": "39326",
"Href": "https://bugzilla.altlinux.org/39326",
"Data": "Не показывается splash, если включен вывод на serial console"
},
{
"Id": "44297",
"Href": "https://bugzilla.altlinux.org/44297",
"Data": "Не работает plymouth на UEFI с ядром un-def"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20231887001",
"Comment": "libplymouth is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887002",
"Comment": "libplymouth-graphics is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887003",
"Comment": "plymouth is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887004",
"Comment": "plymouth-devel is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887005",
"Comment": "plymouth-plugin-fade-throbber is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887006",
"Comment": "plymouth-plugin-label is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887007",
"Comment": "plymouth-plugin-script is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887008",
"Comment": "plymouth-plugin-space-flares is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887009",
"Comment": "plymouth-plugin-two-step is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887010",
"Comment": "plymouth-scripts is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887011",
"Comment": "plymouth-system-theme is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887012",
"Comment": "plymouth-theme-bgrt is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887013",
"Comment": "plymouth-theme-bgrt-alt is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887014",
"Comment": "plymouth-theme-charge is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887015",
"Comment": "plymouth-theme-fade-in is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887016",
"Comment": "plymouth-theme-glow is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887017",
"Comment": "plymouth-theme-script is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887018",
"Comment": "plymouth-theme-solar is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887019",
"Comment": "plymouth-theme-spinfinity is earlier than 1:22.02.122-alt2.20221016"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231887020",
"Comment": "plymouth-theme-spinner is earlier than 1:22.02.122-alt2.20221016"
}
]
}
]
}
}
]
}

148
oval/c10f1/ALT-PU-2023-1887/objects.json
View File

@ -1,148 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20231887001",
"Version": "1",
"comment": "libplymouth is installed",
"Name": "libplymouth"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887002",
"Version": "1",
"comment": "libplymouth-graphics is installed",
"Name": "libplymouth-graphics"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887003",
"Version": "1",
"comment": "plymouth is installed",
"Name": "plymouth"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887004",
"Version": "1",
"comment": "plymouth-devel is installed",
"Name": "plymouth-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887005",
"Version": "1",
"comment": "plymouth-plugin-fade-throbber is installed",
"Name": "plymouth-plugin-fade-throbber"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887006",
"Version": "1",
"comment": "plymouth-plugin-label is installed",
"Name": "plymouth-plugin-label"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887007",
"Version": "1",
"comment": "plymouth-plugin-script is installed",
"Name": "plymouth-plugin-script"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887008",
"Version": "1",
"comment": "plymouth-plugin-space-flares is installed",
"Name": "plymouth-plugin-space-flares"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887009",
"Version": "1",
"comment": "plymouth-plugin-two-step is installed",
"Name": "plymouth-plugin-two-step"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887010",
"Version": "1",
"comment": "plymouth-scripts is installed",
"Name": "plymouth-scripts"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887011",
"Version": "1",
"comment": "plymouth-system-theme is installed",
"Name": "plymouth-system-theme"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887012",
"Version": "1",
"comment": "plymouth-theme-bgrt is installed",
"Name": "plymouth-theme-bgrt"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887013",
"Version": "1",
"comment": "plymouth-theme-bgrt-alt is installed",
"Name": "plymouth-theme-bgrt-alt"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887014",
"Version": "1",
"comment": "plymouth-theme-charge is installed",
"Name": "plymouth-theme-charge"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887015",
"Version": "1",
"comment": "plymouth-theme-fade-in is installed",
"Name": "plymouth-theme-fade-in"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887016",
"Version": "1",
"comment": "plymouth-theme-glow is installed",
"Name": "plymouth-theme-glow"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887017",
"Version": "1",
"comment": "plymouth-theme-script is installed",
"Name": "plymouth-theme-script"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887018",
"Version": "1",
"comment": "plymouth-theme-solar is installed",
"Name": "plymouth-theme-solar"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887019",
"Version": "1",
"comment": "plymouth-theme-spinfinity is installed",
"Name": "plymouth-theme-spinfinity"
},
{
"ID": "oval:org.altlinux.errata:obj:20231887020",
"Version": "1",
"comment": "plymouth-theme-spinner is installed",
"Name": "plymouth-theme-spinner"
}
]
}

23
oval/c10f1/ALT-PU-2023-1887/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20231887001",
"Version": "1",
"Comment": "package EVR is earlier than 1:22.02.122-alt2.20221016",
"Arch": {},
"Evr": {
"Text": "1:22.02.122-alt2.20221016",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

258
oval/c10f1/ALT-PU-2023-1887/tests.json
View File

@ -1,258 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20231887001",
"Version": "1",
"Check": "all",
"Comment": "libplymouth is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887002",
"Version": "1",
"Check": "all",
"Comment": "libplymouth-graphics is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887003",
"Version": "1",
"Check": "all",
"Comment": "plymouth is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887004",
"Version": "1",
"Check": "all",
"Comment": "plymouth-devel is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887005",
"Version": "1",
"Check": "all",
"Comment": "plymouth-plugin-fade-throbber is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887006",
"Version": "1",
"Check": "all",
"Comment": "plymouth-plugin-label is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887006"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887007",
"Version": "1",
"Check": "all",
"Comment": "plymouth-plugin-script is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887007"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887008",
"Version": "1",
"Check": "all",
"Comment": "plymouth-plugin-space-flares is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887008"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887009",
"Version": "1",
"Check": "all",
"Comment": "plymouth-plugin-two-step is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887009"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887010",
"Version": "1",
"Check": "all",
"Comment": "plymouth-scripts is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887010"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887011",
"Version": "1",
"Check": "all",
"Comment": "plymouth-system-theme is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887011"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887012",
"Version": "1",
"Check": "all",
"Comment": "plymouth-theme-bgrt is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887012"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887013",
"Version": "1",
"Check": "all",
"Comment": "plymouth-theme-bgrt-alt is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887013"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887014",
"Version": "1",
"Check": "all",
"Comment": "plymouth-theme-charge is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887014"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887015",
"Version": "1",
"Check": "all",
"Comment": "plymouth-theme-fade-in is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887015"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887016",
"Version": "1",
"Check": "all",
"Comment": "plymouth-theme-glow is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887016"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887017",
"Version": "1",
"Check": "all",
"Comment": "plymouth-theme-script is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887017"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887018",
"Version": "1",
"Check": "all",
"Comment": "plymouth-theme-solar is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887018"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887019",
"Version": "1",
"Check": "all",
"Comment": "plymouth-theme-spinfinity is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887019"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231887020",
"Version": "1",
"Check": "all",
"Comment": "plymouth-theme-spinner is earlier than 1:22.02.122-alt2.20221016",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231887020"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231887001"
}
}
]
}

297
oval/c10f1/ALT-PU-2023-1900/definitions.json
View File

@ -1,297 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20231900",
"Version": "oval:org.altlinux.errata:def:20231900",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-1900: package `thunderbird` update to version 102.11.0-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-1900",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-1900",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-02803",
"RefURL": "https://bdu.fstec.ru/vul/2023-02803",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02804",
"RefURL": "https://bdu.fstec.ru/vul/2023-02804",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02805",
"RefURL": "https://bdu.fstec.ru/vul/2023-02805",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02806",
"RefURL": "https://bdu.fstec.ru/vul/2023-02806",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02809",
"RefURL": "https://bdu.fstec.ru/vul/2023-02809",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02810",
"RefURL": "https://bdu.fstec.ru/vul/2023-02810",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02813",
"RefURL": "https://bdu.fstec.ru/vul/2023-02813",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02814",
"RefURL": "https://bdu.fstec.ru/vul/2023-02814",
"Source": "BDU"
},
{
"RefID": "CVE-2023-32205",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32205",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32206",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32206",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32207",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32207",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32211",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32211",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32212",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32212",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32213",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32213",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32214",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32214",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32215",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32215",
"Source": "CVE"
}
],
"Description": "This update upgrades thunderbird to version 102.11.0-alt1. \nSecurity Fix(es):\n\n * BDU:2023-02803: Уязвимость браузеров Firefox и Firefox ESR и почтового клиента Thunderbird, вызванная выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2023-02804: Уязвимость браузеров Firefox и Firefox ESR, связанная с ошибками представления информации пользовательским интерфейсом, позволяющая нарушителю выполнить спуфинговую атаку\n\n * BDU:2023-02805: Уязвимость функции FileReader::DoReadData() браузеров Firefox и Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю выполнить произвольный код в целевой системе\n\n * BDU:2023-02806: Уязвимость браузеров Firefox и Firefox ESR, связанная с ошибками смешения типов данных, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2023-02809: Уязвимость браузеров Firefox и Firefox ESR и почтового клиента Thunderbird, связанная с ошибками представления информации пользовательским интерфейсом, позволяющая нарушителю выполнить спуфинговую атаку\n\n * BDU:2023-02810: Уязвимость браузеров Firefox и Firefox ESR и почтового клиента Thunderbird, существующая из-за некорректной работы обработчиков ms-cxh и ms-cxh-ful, позволяющая нарушителю вызвать аварийное завершение работы приложения\n\n * BDU:2023-02813: Уязвимость драйвера RLBox Expat браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать аварийное завершение работы приложения\n\n * BDU:2023-02814: Уязвимость браузеров Firefox и Firefox ESR, существующая из-за отсутствия задержки всплывающих уведомлений, позволяющая нарушителю получить несанкционированный доступ к определенным функциям браузера\n\n * CVE-2023-32205: In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32206: An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32207: A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32211: A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32212: An attacker could have positioned a \u003ccode\u003edatalist\u003c/code\u003e element to obscure the address bar. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32213: When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32214: Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service.\n*Note: This attack only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32215: Memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-05-27"
},
"Updated": {
"Date": "2023-05-27"
},
"bdu": [
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"Cwe": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2023-02803",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02803"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"Cwe": "CWE-451",
"Href": "https://bdu.fstec.ru/vul/2023-02804",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02804"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"Cwe": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2023-02805",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02805"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"Cwe": "CWE-843",
"Href": "https://bdu.fstec.ru/vul/2023-02806",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02806"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"Cwe": "CWE-451",
"Href": "https://bdu.fstec.ru/vul/2023-02809",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02809"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"Cwe": "CWE-939",
"Href": "https://bdu.fstec.ru/vul/2023-02810",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02810"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"Cwe": "CWE-125",
"Href": "https://bdu.fstec.ru/vul/2023-02813",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02813"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"Cwe": "CWE-254, CWE-275",
"Href": "https://bdu.fstec.ru/vul/2023-02814",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02814"
}
],
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"Cwe": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32205",
"Impact": "Low",
"Public": "20230602",
"CveID": "CVE-2023-32205"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-125",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32206",
"Impact": "Low",
"Public": "20230602",
"CveID": "CVE-2023-32206"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-290",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32207",
"Impact": "High",
"Public": "20230602",
"CveID": "CVE-2023-32207"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32211",
"Impact": "Low",
"Public": "20230602",
"CveID": "CVE-2023-32211"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"Cwe": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32212",
"Impact": "Low",
"Public": "20230602",
"CveID": "CVE-2023-32212"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-908",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32213",
"Impact": "High",
"Public": "20230602",
"CveID": "CVE-2023-32213"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32214",
"Impact": "High",
"Public": "20230619",
"CveID": "CVE-2023-32214"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32215",
"Impact": "High",
"Public": "20230602",
"CveID": "CVE-2023-32215"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20231900001",
"Comment": "rpm-build-thunderbird is earlier than 0:102.11.0-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231900002",
"Comment": "thunderbird is earlier than 0:102.11.0-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231900003",
"Comment": "thunderbird-wayland is earlier than 0:102.11.0-alt1"
}
]
}
]
}
}
]
}

46
oval/c10f1/ALT-PU-2023-1900/objects.json
View File

@ -1,46 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20231900001",
"Version": "1",
"comment": "rpm-build-thunderbird is installed",
"Name": "rpm-build-thunderbird"
},
{
"ID": "oval:org.altlinux.errata:obj:20231900002",
"Version": "1",
"comment": "thunderbird is installed",
"Name": "thunderbird"
},
{
"ID": "oval:org.altlinux.errata:obj:20231900003",
"Version": "1",
"comment": "thunderbird-wayland is installed",
"Name": "thunderbird-wayland"
}
]
}

23
oval/c10f1/ALT-PU-2023-1900/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20231900001",
"Version": "1",
"Comment": "package EVR is earlier than 0:102.11.0-alt1",
"Arch": {},
"Evr": {
"Text": "0:102.11.0-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

54
oval/c10f1/ALT-PU-2023-1900/tests.json
View File

@ -1,54 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20231900001",
"Version": "1",
"Check": "all",
"Comment": "rpm-build-thunderbird is earlier than 0:102.11.0-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231900001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231900001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231900002",
"Version": "1",
"Check": "all",
"Comment": "thunderbird is earlier than 0:102.11.0-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231900002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231900001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231900003",
"Version": "1",
"Check": "all",
"Comment": "thunderbird-wayland is earlier than 0:102.11.0-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231900003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231900001"
}
}
]
}

297
oval/c10f1/ALT-PU-2023-1901/definitions.json
View File

@ -1,297 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20231901",
"Version": "oval:org.altlinux.errata:def:20231901",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-1901: package `firefox-esr` update to version 102.11.0-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-1901",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-1901",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-02803",
"RefURL": "https://bdu.fstec.ru/vul/2023-02803",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02804",
"RefURL": "https://bdu.fstec.ru/vul/2023-02804",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02805",
"RefURL": "https://bdu.fstec.ru/vul/2023-02805",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02806",
"RefURL": "https://bdu.fstec.ru/vul/2023-02806",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02809",
"RefURL": "https://bdu.fstec.ru/vul/2023-02809",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02810",
"RefURL": "https://bdu.fstec.ru/vul/2023-02810",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02813",
"RefURL": "https://bdu.fstec.ru/vul/2023-02813",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02814",
"RefURL": "https://bdu.fstec.ru/vul/2023-02814",
"Source": "BDU"
},
{
"RefID": "CVE-2023-32205",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32205",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32206",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32206",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32207",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32207",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32211",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32211",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32212",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32212",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32213",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32213",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32214",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32214",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32215",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32215",
"Source": "CVE"
}
],
"Description": "This update upgrades firefox-esr to version 102.11.0-alt1. \nSecurity Fix(es):\n\n * BDU:2023-02803: Уязвимость браузеров Firefox и Firefox ESR и почтового клиента Thunderbird, вызванная выходом операции за границы буфера в памяти, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2023-02804: Уязвимость браузеров Firefox и Firefox ESR, связанная с ошибками представления информации пользовательским интерфейсом, позволяющая нарушителю выполнить спуфинговую атаку\n\n * BDU:2023-02805: Уязвимость функции FileReader::DoReadData() браузеров Firefox и Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю выполнить произвольный код в целевой системе\n\n * BDU:2023-02806: Уязвимость браузеров Firefox и Firefox ESR, связанная с ошибками смешения типов данных, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2023-02809: Уязвимость браузеров Firefox и Firefox ESR и почтового клиента Thunderbird, связанная с ошибками представления информации пользовательским интерфейсом, позволяющая нарушителю выполнить спуфинговую атаку\n\n * BDU:2023-02810: Уязвимость браузеров Firefox и Firefox ESR и почтового клиента Thunderbird, существующая из-за некорректной работы обработчиков ms-cxh и ms-cxh-ful, позволяющая нарушителю вызвать аварийное завершение работы приложения\n\n * BDU:2023-02813: Уязвимость драйвера RLBox Expat браузеров Firefox и Firefox ESR, позволяющая нарушителю вызвать аварийное завершение работы приложения\n\n * BDU:2023-02814: Уязвимость браузеров Firefox и Firefox ESR, существующая из-за отсутствия задержки всплывающих уведомлений, позволяющая нарушителю получить несанкционированный доступ к определенным функциям браузера\n\n * CVE-2023-32205: In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion and spoofing attacks. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32206: An out-of-bound read could have led to a crash in the RLBox Expat driver. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32207: A missing delay in popup notifications could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32211: A type checking bug would have led to invalid code being compiled. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32212: An attacker could have positioned a \u003ccode\u003edatalist\u003c/code\u003e element to obscure the address bar. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32213: When reading a file, an uninitialized value could have been used as read limit. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32214: Protocol handlers `ms-cxh` and `ms-cxh-full` could have been leveraged to trigger a denial of service.\n*Note: This attack only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.\n\n * CVE-2023-32215: Memory safety bugs present in Firefox 112 and Firefox ESR 102.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox \u003c 113, Firefox ESR \u003c 102.11, and Thunderbird \u003c 102.11.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-05-27"
},
"Updated": {
"Date": "2023-05-27"
},
"bdu": [
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"Cwe": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2023-02803",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02803"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"Cwe": "CWE-451",
"Href": "https://bdu.fstec.ru/vul/2023-02804",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02804"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"Cwe": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2023-02805",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02805"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"Cwe": "CWE-843",
"Href": "https://bdu.fstec.ru/vul/2023-02806",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02806"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"Cwe": "CWE-451",
"Href": "https://bdu.fstec.ru/vul/2023-02809",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02809"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"Cwe": "CWE-939",
"Href": "https://bdu.fstec.ru/vul/2023-02810",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02810"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"Cwe": "CWE-125",
"Href": "https://bdu.fstec.ru/vul/2023-02813",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02813"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"Cwe": "CWE-254, CWE-275",
"Href": "https://bdu.fstec.ru/vul/2023-02814",
"Impact": "Low",
"Public": "20230509",
"CveID": "BDU:2023-02814"
}
],
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"Cwe": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32205",
"Impact": "Low",
"Public": "20230602",
"CveID": "CVE-2023-32205"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-125",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32206",
"Impact": "Low",
"Public": "20230602",
"CveID": "CVE-2023-32206"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-290",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32207",
"Impact": "High",
"Public": "20230602",
"CveID": "CVE-2023-32207"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32211",
"Impact": "Low",
"Public": "20230602",
"CveID": "CVE-2023-32211"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"Cwe": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32212",
"Impact": "Low",
"Public": "20230602",
"CveID": "CVE-2023-32212"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-908",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32213",
"Impact": "High",
"Public": "20230602",
"CveID": "CVE-2023-32213"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32214",
"Impact": "High",
"Public": "20230619",
"CveID": "CVE-2023-32214"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32215",
"Impact": "High",
"Public": "20230602",
"CveID": "CVE-2023-32215"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20231901001",
"Comment": "firefox-esr is earlier than 0:102.11.0-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231901002",
"Comment": "firefox-esr-config-privacy is earlier than 0:102.11.0-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231901003",
"Comment": "firefox-esr-wayland is earlier than 0:102.11.0-alt1"
}
]
}
]
}
}
]
}

46
oval/c10f1/ALT-PU-2023-1901/objects.json
View File

@ -1,46 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20231901001",
"Version": "1",
"comment": "firefox-esr is installed",
"Name": "firefox-esr"
},
{
"ID": "oval:org.altlinux.errata:obj:20231901002",
"Version": "1",
"comment": "firefox-esr-config-privacy is installed",
"Name": "firefox-esr-config-privacy"
},
{
"ID": "oval:org.altlinux.errata:obj:20231901003",
"Version": "1",
"comment": "firefox-esr-wayland is installed",
"Name": "firefox-esr-wayland"
}
]
}

23
oval/c10f1/ALT-PU-2023-1901/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20231901001",
"Version": "1",
"Comment": "package EVR is earlier than 0:102.11.0-alt1",
"Arch": {},
"Evr": {
"Text": "0:102.11.0-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

54
oval/c10f1/ALT-PU-2023-1901/tests.json
View File

@ -1,54 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20231901001",
"Version": "1",
"Check": "all",
"Comment": "firefox-esr is earlier than 0:102.11.0-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231901001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231901001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231901002",
"Version": "1",
"Check": "all",
"Comment": "firefox-esr-config-privacy is earlier than 0:102.11.0-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231901002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231901001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231901003",
"Version": "1",
"Check": "all",
"Comment": "firefox-esr-wayland is earlier than 0:102.11.0-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231901003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231901001"
}
}
]
}

214
oval/c10f1/ALT-PU-2023-1976/definitions.json
View File

@ -1,214 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20231976",
"Version": "oval:org.altlinux.errata:def:20231976",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-1976: package `wireshark` update to version 4.0.6-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-1976",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-1976",
"Source": "ALTPU"
},
{
"RefID": "CVE-2023-0666",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-0666",
"Source": "CVE"
},
{
"RefID": "CVE-2023-0667",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-0667",
"Source": "CVE"
},
{
"RefID": "CVE-2023-0668",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-0668",
"Source": "CVE"
},
{
"RefID": "CVE-2023-2854",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-2854",
"Source": "CVE"
},
{
"RefID": "CVE-2023-2855",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-2855",
"Source": "CVE"
},
{
"RefID": "CVE-2023-2856",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-2856",
"Source": "CVE"
},
{
"RefID": "CVE-2023-2857",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-2857",
"Source": "CVE"
},
{
"RefID": "CVE-2023-2858",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-2858",
"Source": "CVE"
},
{
"RefID": "CVE-2023-2879",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-2879",
"Source": "CVE"
},
{
"RefID": "CVE-2023-2952",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-2952",
"Source": "CVE"
}
],
"Description": "This update upgrades wireshark to version 4.0.6-alt1. \nSecurity Fix(es):\n\n * CVE-2023-0666: Due to failure in validating the length provided by an attacker-crafted RTPS packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.\n\n * CVE-2023-0667: Due to failure in validating the length provided by an attacker-crafted MSMMS packet, Wireshark version 4.0.5 and prior, in an unusual configuration, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark\n\n * CVE-2023-0668: Due to failure in validating the length provided by an attacker-crafted IEEE-C37.118 packet, Wireshark version 4.0.5 and prior, by default, is susceptible to a heap-based buffer overflow, and possibly code execution in the context of the process running Wireshark.\n\n * CVE-2023-2854: BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file\n\n * CVE-2023-2855: Candump log parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file\n\n * CVE-2023-2856: VMS TCPIPtrace file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file\n\n * CVE-2023-2857: BLF file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file\n\n * CVE-2023-2858: NetScaler file parser crash in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via crafted capture file\n\n * CVE-2023-2879: GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file\n\n * CVE-2023-2952: XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-12"
},
"Updated": {
"Date": "2023-06-12"
},
"bdu": null,
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-0666",
"Impact": "Low",
"Public": "20230607",
"CveID": "CVE-2023-0666"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-0667",
"Impact": "Low",
"Public": "20230607",
"CveID": "CVE-2023-0667"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-0668",
"Impact": "Low",
"Public": "20230607",
"CveID": "CVE-2023-0668"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-2854",
"Impact": "Low",
"Public": "20230526",
"CveID": "CVE-2023-2854"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-2855",
"Impact": "Low",
"Public": "20230526",
"CveID": "CVE-2023-2855"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-2856",
"Impact": "Low",
"Public": "20230526",
"CveID": "CVE-2023-2856"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-2857",
"Impact": "Low",
"Public": "20230526",
"CveID": "CVE-2023-2857"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-2858",
"Impact": "Low",
"Public": "20230526",
"CveID": "CVE-2023-2858"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "CWE-835",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-2879",
"Impact": "High",
"Public": "20230526",
"CveID": "CVE-2023-2879"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-835",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-2952",
"Impact": "Low",
"Public": "20230530",
"CveID": "CVE-2023-2952"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20231976001",
"Comment": "tshark is earlier than 0:4.0.6-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231976002",
"Comment": "wireshark-base is earlier than 0:4.0.6-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231976003",
"Comment": "wireshark-devel is earlier than 0:4.0.6-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20231976004",
"Comment": "wireshark-qt5 is earlier than 0:4.0.6-alt1"
}
]
}
]
}
}
]
}

52
oval/c10f1/ALT-PU-2023-1976/objects.json
View File

@ -1,52 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20231976001",
"Version": "1",
"comment": "tshark is installed",
"Name": "tshark"
},
{
"ID": "oval:org.altlinux.errata:obj:20231976002",
"Version": "1",
"comment": "wireshark-base is installed",
"Name": "wireshark-base"
},
{
"ID": "oval:org.altlinux.errata:obj:20231976003",
"Version": "1",
"comment": "wireshark-devel is installed",
"Name": "wireshark-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20231976004",
"Version": "1",
"comment": "wireshark-qt5 is installed",
"Name": "wireshark-qt5"
}
]
}

23
oval/c10f1/ALT-PU-2023-1976/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20231976001",
"Version": "1",
"Comment": "package EVR is earlier than 0:4.0.6-alt1",
"Arch": {},
"Evr": {
"Text": "0:4.0.6-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

66
oval/c10f1/ALT-PU-2023-1976/tests.json
View File

@ -1,66 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20231976001",
"Version": "1",
"Check": "all",
"Comment": "tshark is earlier than 0:4.0.6-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231976001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231976001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231976002",
"Version": "1",
"Check": "all",
"Comment": "wireshark-base is earlier than 0:4.0.6-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231976002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231976001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231976003",
"Version": "1",
"Check": "all",
"Comment": "wireshark-devel is earlier than 0:4.0.6-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231976003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231976001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20231976004",
"Version": "1",
"Check": "all",
"Comment": "wireshark-qt5 is earlier than 0:4.0.6-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20231976004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20231976001"
}
}
]
}

93
oval/c10f1/ALT-PU-2023-2013/definitions.json
View File

@ -1,93 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20232013",
"Version": "oval:org.altlinux.errata:def:20232013",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-2013: package `yajl` update to version 2.1.0-alt3",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-2013",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-2013",
"Source": "ALTPU"
},
{
"RefID": "CVE-2023-33460",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-33460",
"Source": "CVE"
}
],
"Description": "This update upgrades yajl to version 2.1.0-alt3. \nSecurity Fix(es):\n\n * CVE-2023-33460: There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-16"
},
"Updated": {
"Date": "2023-06-16"
},
"bdu": null,
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-401",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-33460",
"Impact": "Low",
"Public": "20230606",
"CveID": "CVE-2023-33460"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20232013001",
"Comment": "libyajl is earlier than 0:2.1.0-alt3"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232013002",
"Comment": "libyajl-devel is earlier than 0:2.1.0-alt3"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232013003",
"Comment": "yajl is earlier than 0:2.1.0-alt3"
}
]
}
]
}
}
]
}

46
oval/c10f1/ALT-PU-2023-2013/objects.json
View File

@ -1,46 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232013001",
"Version": "1",
"comment": "libyajl is installed",
"Name": "libyajl"
},
{
"ID": "oval:org.altlinux.errata:obj:20232013002",
"Version": "1",
"comment": "libyajl-devel is installed",
"Name": "libyajl-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232013003",
"Version": "1",
"comment": "yajl is installed",
"Name": "yajl"
}
]
}

23
oval/c10f1/ALT-PU-2023-2013/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232013001",
"Version": "1",
"Comment": "package EVR is earlier than 0:2.1.0-alt3",
"Arch": {},
"Evr": {
"Text": "0:2.1.0-alt3",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

54
oval/c10f1/ALT-PU-2023-2013/tests.json
View File

@ -1,54 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232013001",
"Version": "1",
"Check": "all",
"Comment": "libyajl is earlier than 0:2.1.0-alt3",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232013001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232013001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232013002",
"Version": "1",
"Check": "all",
"Comment": "libyajl-devel is earlier than 0:2.1.0-alt3",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232013002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232013001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232013003",
"Version": "1",
"Check": "all",
"Comment": "yajl is earlier than 0:2.1.0-alt3",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232013003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232013001"
}
}
]
}

1450
oval/c10f1/ALT-PU-2023-2021/definitions.json
View File

File diff suppressed because one or more lines are too long

34
oval/c10f1/ALT-PU-2023-2021/objects.json
View File

@ -1,34 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232021001",
"Version": "1",
"comment": "yandex-browser-stable is installed",
"Name": "yandex-browser-stable"
}
]
}

23
oval/c10f1/ALT-PU-2023-2021/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232021001",
"Version": "1",
"Comment": "package EVR is earlier than 0:23.5.1.753-alt1",
"Arch": {},
"Evr": {
"Text": "0:23.5.1.753-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

30
oval/c10f1/ALT-PU-2023-2021/tests.json
View File

@ -1,30 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232021001",
"Version": "1",
"Check": "all",
"Comment": "yandex-browser-stable is earlier than 0:23.5.1.753-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232021001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232021001"
}
}
]
}

104
oval/c10f1/ALT-PU-2023-2041/definitions.json
View File

@ -1,104 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20232041",
"Version": "oval:org.altlinux.errata:def:20232041",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-2041: package `libheif` update to version 1.15.2-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-2041",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-2041",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-03407",
"RefURL": "https://bdu.fstec.ru/vul/2023-03407",
"Source": "BDU"
},
{
"RefID": "CVE-2023-29659",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-29659",
"Source": "CVE"
}
],
"Description": "This update upgrades libheif to version 1.15.2-alt1. \nSecurity Fix(es):\n\n * BDU:2023-03407: Уязвимость функции heif::Fraction::round() в box.cc декодера форматов файлов HEIF и AVIF libheif, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2023-29659: A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round() function in box.cc, which causes a denial of service.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-21"
},
"Updated": {
"Date": "2023-06-21"
},
"bdu": [
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-369",
"Href": "https://bdu.fstec.ru/vul/2023-03407",
"Impact": "Low",
"Public": "20230505",
"CveID": "BDU:2023-03407"
}
],
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-369",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-29659",
"Impact": "Low",
"Public": "20230505",
"CveID": "CVE-2023-29659"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20232041001",
"Comment": "libheif is earlier than 0:1.15.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232041002",
"Comment": "libheif-devel is earlier than 0:1.15.2-alt1"
}
]
}
]
}
}
]
}

40
oval/c10f1/ALT-PU-2023-2041/objects.json
View File

@ -1,40 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232041001",
"Version": "1",
"comment": "libheif is installed",
"Name": "libheif"
},
{
"ID": "oval:org.altlinux.errata:obj:20232041002",
"Version": "1",
"comment": "libheif-devel is installed",
"Name": "libheif-devel"
}
]
}

23
oval/c10f1/ALT-PU-2023-2041/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232041001",
"Version": "1",
"Comment": "package EVR is earlier than 0:1.15.2-alt1",
"Arch": {},
"Evr": {
"Text": "0:1.15.2-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

42
oval/c10f1/ALT-PU-2023-2041/tests.json
View File

@ -1,42 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232041001",
"Version": "1",
"Check": "all",
"Comment": "libheif is earlier than 0:1.15.2-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232041001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232041001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232041002",
"Version": "1",
"Check": "all",
"Comment": "libheif-devel is earlier than 0:1.15.2-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232041002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232041001"
}
}
]
}

112
oval/c10f1/ALT-PU-2023-2052/definitions.json
View File

@ -1,112 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20232052",
"Version": "oval:org.altlinux.errata:def:20232052",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-2052: package `cups-filters` update to version 1.28.11-alt2",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-2052",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-2052",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-02781",
"RefURL": "https://bdu.fstec.ru/vul/2023-02781",
"Source": "BDU"
},
{
"RefID": "CVE-2023-24805",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-24805",
"Source": "CVE"
}
],
"Description": "This update upgrades cups-filters to version 1.28.11-alt2. \nSecurity Fix(es):\n\n * BDU:2023-02781: Уязвимость компонента beh (Backend Error Handler) пакета для печати cups-filters, позволяющая нарушителю выполнить произвольные команды на сервере печати\n\n * CVE-2023-24805: cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backend Error Handler (beh) to create an accessible network printer, this security vulnerability can cause remote code execution. `beh.c` contains the line `retval = system(cmdline) \u003e\u003e 8;` which calls the `system` command with the operand `cmdline`. `cmdline` contains multiple user controlled, unsanitized values. As a result an attacker with network access to the hosted print server can exploit this vulnerability to inject system commands which are executed in the context of the running server. This issue has been addressed in commit `8f2740357` and is expected to be bundled in the next release. Users are advised to upgrade when possible and to restrict access to network printers in the meantime.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-23"
},
"Updated": {
"Date": "2023-06-23"
},
"bdu": [
{
"Cvss": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-78",
"Href": "https://bdu.fstec.ru/vul/2023-02781",
"Impact": "High",
"Public": "20230517",
"CveID": "BDU:2023-02781"
}
],
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-78",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-24805",
"Impact": "High",
"Public": "20230517",
"CveID": "CVE-2023-24805"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20232052001",
"Comment": "cups-backend-serial is earlier than 1:1.28.11-alt2"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232052002",
"Comment": "cups-filters is earlier than 0:1.28.11-alt2"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232052003",
"Comment": "cups-filters-devel is earlier than 0:1.28.11-alt2"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232052004",
"Comment": "cups-filters-libs is earlier than 0:1.28.11-alt2"
}
]
}
]
}
}
]
}

52
oval/c10f1/ALT-PU-2023-2052/objects.json
View File

@ -1,52 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232052001",
"Version": "1",
"comment": "cups-backend-serial is installed",
"Name": "cups-backend-serial"
},
{
"ID": "oval:org.altlinux.errata:obj:20232052002",
"Version": "1",
"comment": "cups-filters is installed",
"Name": "cups-filters"
},
{
"ID": "oval:org.altlinux.errata:obj:20232052003",
"Version": "1",
"comment": "cups-filters-devel is installed",
"Name": "cups-filters-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232052004",
"Version": "1",
"comment": "cups-filters-libs is installed",
"Name": "cups-filters-libs"
}
]
}

35
oval/c10f1/ALT-PU-2023-2052/states.json
View File

@ -1,35 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232052001",
"Version": "1",
"Comment": "package EVR is earlier than 1:1.28.11-alt2",
"Arch": {},
"Evr": {
"Text": "1:1.28.11-alt2",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
},
{
"ID": "oval:org.altlinux.errata:ste:20232052002",
"Version": "1",
"Comment": "package EVR is earlier than 0:1.28.11-alt2",
"Arch": {},
"Evr": {
"Text": "0:1.28.11-alt2",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

66
oval/c10f1/ALT-PU-2023-2052/tests.json
View File

@ -1,66 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232052001",
"Version": "1",
"Check": "all",
"Comment": "cups-backend-serial is earlier than 1:1.28.11-alt2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232052001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232052001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232052002",
"Version": "1",
"Check": "all",
"Comment": "cups-filters is earlier than 0:1.28.11-alt2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232052002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232052002"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232052003",
"Version": "1",
"Check": "all",
"Comment": "cups-filters-devel is earlier than 0:1.28.11-alt2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232052003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232052002"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232052004",
"Version": "1",
"Check": "all",
"Comment": "cups-filters-libs is earlier than 0:1.28.11-alt2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232052004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232052002"
}
}
]
}

105
oval/c10f1/ALT-PU-2023-2071/definitions.json
View File

@ -1,105 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20232071",
"Version": "oval:org.altlinux.errata:def:20232071",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-2071: package `python3-module-django` update to version 3.2.19-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-2071",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-2071",
"Source": "ALTPU"
},
{
"RefID": "CVE-2023-31047",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-31047",
"Source": "CVE"
}
],
"Description": "This update upgrades python3-module-django to version 3.2.19-alt1. \nSecurity Fix(es):\n\n * CVE-2023-31047: In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's \"Uploading multiple files\" documentation suggested otherwise.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-26"
},
"Updated": {
"Date": "2023-06-26"
},
"bdu": null,
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-20",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-31047",
"Impact": "Critical",
"Public": "20230507",
"CveID": "CVE-2023-31047"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20232071001",
"Comment": "python3-module-django is earlier than 0:3.2.19-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232071002",
"Comment": "python3-module-django-dbbackend-mysql is earlier than 0:3.2.19-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232071003",
"Comment": "python3-module-django-dbbackend-oracle is earlier than 0:3.2.19-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232071004",
"Comment": "python3-module-django-dbbackend-postgresql is earlier than 0:3.2.19-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232071005",
"Comment": "python3-module-django-dbbackend-sqlite3 is earlier than 0:3.2.19-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232071006",
"Comment": "python3-module-django-doc is earlier than 0:3.2.19-alt1"
}
]
}
]
}
}
]
}

64
oval/c10f1/ALT-PU-2023-2071/objects.json
View File

@ -1,64 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232071001",
"Version": "1",
"comment": "python3-module-django is installed",
"Name": "python3-module-django"
},
{
"ID": "oval:org.altlinux.errata:obj:20232071002",
"Version": "1",
"comment": "python3-module-django-dbbackend-mysql is installed",
"Name": "python3-module-django-dbbackend-mysql"
},
{
"ID": "oval:org.altlinux.errata:obj:20232071003",
"Version": "1",
"comment": "python3-module-django-dbbackend-oracle is installed",
"Name": "python3-module-django-dbbackend-oracle"
},
{
"ID": "oval:org.altlinux.errata:obj:20232071004",
"Version": "1",
"comment": "python3-module-django-dbbackend-postgresql is installed",
"Name": "python3-module-django-dbbackend-postgresql"
},
{
"ID": "oval:org.altlinux.errata:obj:20232071005",
"Version": "1",
"comment": "python3-module-django-dbbackend-sqlite3 is installed",
"Name": "python3-module-django-dbbackend-sqlite3"
},
{
"ID": "oval:org.altlinux.errata:obj:20232071006",
"Version": "1",
"comment": "python3-module-django-doc is installed",
"Name": "python3-module-django-doc"
}
]
}

23
oval/c10f1/ALT-PU-2023-2071/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232071001",
"Version": "1",
"Comment": "package EVR is earlier than 0:3.2.19-alt1",
"Arch": {},
"Evr": {
"Text": "0:3.2.19-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

90
oval/c10f1/ALT-PU-2023-2071/tests.json
View File

@ -1,90 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232071001",
"Version": "1",
"Check": "all",
"Comment": "python3-module-django is earlier than 0:3.2.19-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232071001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232071001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232071002",
"Version": "1",
"Check": "all",
"Comment": "python3-module-django-dbbackend-mysql is earlier than 0:3.2.19-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232071002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232071001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232071003",
"Version": "1",
"Check": "all",
"Comment": "python3-module-django-dbbackend-oracle is earlier than 0:3.2.19-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232071003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232071001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232071004",
"Version": "1",
"Check": "all",
"Comment": "python3-module-django-dbbackend-postgresql is earlier than 0:3.2.19-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232071004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232071001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232071005",
"Version": "1",
"Check": "all",
"Comment": "python3-module-django-dbbackend-sqlite3 is earlier than 0:3.2.19-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232071005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232071001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232071006",
"Version": "1",
"Check": "all",
"Comment": "python3-module-django-doc is earlier than 0:3.2.19-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232071006"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232071001"
}
}
]
}

85
oval/c10f1/ALT-PU-2023-2072/definitions.json
View File

@ -1,85 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20232072",
"Version": "oval:org.altlinux.errata:def:20232072",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-2072: package `etcd` update to version 3.5.9-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-2072",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-2072",
"Source": "ALTPU"
},
{
"RefID": "CVE-2023-32082",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32082",
"Source": "CVE"
}
],
"Description": "This update upgrades etcd to version 3.5.9-alt1. \nSecurity Fix(es):\n\n * CVE-2023-32082: etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-26"
},
"Updated": {
"Date": "2023-06-26"
},
"bdu": null,
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"Cwe": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32082",
"Impact": "Low",
"Public": "20230511",
"CveID": "CVE-2023-32082"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20232072001",
"Comment": "etcd is earlier than 0:3.5.9-alt1"
}
]
}
]
}
}
]
}

34
oval/c10f1/ALT-PU-2023-2072/objects.json
View File

@ -1,34 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232072001",
"Version": "1",
"comment": "etcd is installed",
"Name": "etcd"
}
]
}

23
oval/c10f1/ALT-PU-2023-2072/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232072001",
"Version": "1",
"Comment": "package EVR is earlier than 0:3.5.9-alt1",
"Arch": {},
"Evr": {
"Text": "0:3.5.9-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

30
oval/c10f1/ALT-PU-2023-2072/tests.json
View File

@ -1,30 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232072001",
"Version": "1",
"Check": "all",
"Comment": "etcd is earlier than 0:3.5.9-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232072001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232072001"
}
}
]
}

249
oval/c10f1/ALT-PU-2023-2074/definitions.json
View File

File diff suppressed because one or more lines are too long

34
oval/c10f1/ALT-PU-2023-2074/objects.json
View File

@ -1,34 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232074001",
"Version": "1",
"comment": "minio is installed",
"Name": "minio"
}
]
}

23
oval/c10f1/ALT-PU-2023-2074/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232074001",
"Version": "1",
"Comment": "package EVR is earlier than 0:2023.05.18-alt1",
"Arch": {},
"Evr": {
"Text": "0:2023.05.18-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

30
oval/c10f1/ALT-PU-2023-2074/tests.json
View File

@ -1,30 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232074001",
"Version": "1",
"Check": "all",
"Comment": "minio is earlier than 0:2023.05.18-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232074001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232074001"
}
}
]
}

101
oval/c10f1/ALT-PU-2023-2076/definitions.json
View File

@ -1,101 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20232076",
"Version": "oval:org.altlinux.errata:def:20232076",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-2076: package `fish` update to version 3.6.1-alt1.1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-2076",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-2076",
"Source": "ALTPU"
},
{
"RefID": "BDU:2022-01726",
"RefURL": "https://bdu.fstec.ru/vul/2022-01726",
"Source": "BDU"
},
{
"RefID": "CVE-2022-20001",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-20001",
"Source": "CVE"
}
],
"Description": "This update upgrades fish to version 3.6.1-alt1.1. \nSecurity Fix(es):\n\n * BDU:2022-01726: Уязвимость оболочки командной строки fish, связанная с недостатками процедуры нейтрализации особых элементов в выходных данных, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2022-20001: fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs `git` commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the `fish_git_prompt` function from the prompt.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-26"
},
"Updated": {
"Date": "2023-06-26"
},
"bdu": [
{
"Cvss": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-74",
"Href": "https://bdu.fstec.ru/vul/2022-01726",
"Impact": "High",
"Public": "20220312",
"CveID": "BDU:2022-01726"
}
],
"Cves": [
{
"Cvss": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-74",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-20001",
"Impact": "High",
"Public": "20220314",
"CveID": "CVE-2022-20001"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20232076001",
"Comment": "fish is earlier than 0:3.6.1-alt1.1"
}
]
}
]
}
}
]
}

34
oval/c10f1/ALT-PU-2023-2076/objects.json
View File

@ -1,34 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232076001",
"Version": "1",
"comment": "fish is installed",
"Name": "fish"
}
]
}

23
oval/c10f1/ALT-PU-2023-2076/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232076001",
"Version": "1",
"Comment": "package EVR is earlier than 0:3.6.1-alt1.1",
"Arch": {},
"Evr": {
"Text": "0:3.6.1-alt1.1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

30
oval/c10f1/ALT-PU-2023-2076/tests.json
View File

@ -1,30 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232076001",
"Version": "1",
"Check": "all",
"Comment": "fish is earlier than 0:3.6.1-alt1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232076001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232076001"
}
}
]
}

96
oval/c10f1/ALT-PU-2023-2079/definitions.json
View File

@ -1,96 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20232079",
"Version": "oval:org.altlinux.errata:def:20232079",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-2079: package `sysstat` update to version 12.7.2-alt2",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-2079",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-2079",
"Source": "ALTPU"
},
{
"RefID": "CVE-2023-33204",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-33204",
"Source": "CVE"
}
],
"Description": "This update upgrades sysstat to version 12.7.2-alt2. \nSecurity Fix(es):\n\n * CVE-2023-33204: sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists because of an incomplete fix for CVE-2022-39377.\n\n * #44518: Ошибка при отображении графика Memory Statistics в isag.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-27"
},
"Updated": {
"Date": "2023-06-27"
},
"bdu": null,
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-190",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-33204",
"Impact": "High",
"Public": "20230518",
"CveID": "CVE-2023-33204"
}
],
"Bugzilla": [
{
"Id": "44518",
"Href": "https://bugzilla.altlinux.org/44518",
"Data": "Ошибка при отображении графика Memory Statistics в isag."
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20232079001",
"Comment": "sysstat is earlier than 0:12.7.2-alt2"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232079002",
"Comment": "sysstat-isag is earlier than 0:12.7.2-alt2"
}
]
}
]
}
}
]
}

40
oval/c10f1/ALT-PU-2023-2079/objects.json
View File

@ -1,40 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232079001",
"Version": "1",
"comment": "sysstat is installed",
"Name": "sysstat"
},
{
"ID": "oval:org.altlinux.errata:obj:20232079002",
"Version": "1",
"comment": "sysstat-isag is installed",
"Name": "sysstat-isag"
}
]
}

23
oval/c10f1/ALT-PU-2023-2079/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232079001",
"Version": "1",
"Comment": "package EVR is earlier than 0:12.7.2-alt2",
"Arch": {},
"Evr": {
"Text": "0:12.7.2-alt2",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

42
oval/c10f1/ALT-PU-2023-2079/tests.json
View File

@ -1,42 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232079001",
"Version": "1",
"Check": "all",
"Comment": "sysstat is earlier than 0:12.7.2-alt2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232079001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232079001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232079002",
"Version": "1",
"Check": "all",
"Comment": "sysstat-isag is earlier than 0:12.7.2-alt2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232079002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232079001"
}
}
]
}

188
oval/c10f1/ALT-PU-2023-2083/definitions.json
View File

File diff suppressed because one or more lines are too long

76
oval/c10f1/ALT-PU-2023-2083/objects.json
View File

@ -1,76 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232083001",
"Version": "1",
"comment": "libcrypto1.1 is installed",
"Name": "libcrypto1.1"
},
{
"ID": "oval:org.altlinux.errata:obj:20232083002",
"Version": "1",
"comment": "libssl-devel is installed",
"Name": "libssl-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232083003",
"Version": "1",
"comment": "libssl-devel-static is installed",
"Name": "libssl-devel-static"
},
{
"ID": "oval:org.altlinux.errata:obj:20232083004",
"Version": "1",
"comment": "libssl1.1 is installed",
"Name": "libssl1.1"
},
{
"ID": "oval:org.altlinux.errata:obj:20232083005",
"Version": "1",
"comment": "openssl is installed",
"Name": "openssl"
},
{
"ID": "oval:org.altlinux.errata:obj:20232083006",
"Version": "1",
"comment": "openssl-doc is installed",
"Name": "openssl-doc"
},
{
"ID": "oval:org.altlinux.errata:obj:20232083007",
"Version": "1",
"comment": "openssl-engines is installed",
"Name": "openssl-engines"
},
{
"ID": "oval:org.altlinux.errata:obj:20232083008",
"Version": "1",
"comment": "tsget is installed",
"Name": "tsget"
}
]
}

23
oval/c10f1/ALT-PU-2023-2083/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232083001",
"Version": "1",
"Comment": "package EVR is earlier than 0:1.1.1u-alt1",
"Arch": {},
"Evr": {
"Text": "0:1.1.1u-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

114
oval/c10f1/ALT-PU-2023-2083/tests.json
View File

@ -1,114 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232083001",
"Version": "1",
"Check": "all",
"Comment": "libcrypto1.1 is earlier than 0:1.1.1u-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232083001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232083001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232083002",
"Version": "1",
"Check": "all",
"Comment": "libssl-devel is earlier than 0:1.1.1u-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232083002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232083001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232083003",
"Version": "1",
"Check": "all",
"Comment": "libssl-devel-static is earlier than 0:1.1.1u-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232083003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232083001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232083004",
"Version": "1",
"Check": "all",
"Comment": "libssl1.1 is earlier than 0:1.1.1u-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232083004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232083001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232083005",
"Version": "1",
"Check": "all",
"Comment": "openssl is earlier than 0:1.1.1u-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232083005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232083001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232083006",
"Version": "1",
"Check": "all",
"Comment": "openssl-doc is earlier than 0:1.1.1u-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232083006"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232083001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232083007",
"Version": "1",
"Check": "all",
"Comment": "openssl-engines is earlier than 0:1.1.1u-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232083007"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232083001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232083008",
"Version": "1",
"Check": "all",
"Comment": "tsget is earlier than 0:1.1.1u-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232083008"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232083001"
}
}
]
}

249
oval/c10f1/ALT-PU-2023-2089/definitions.json
View File

@ -1,249 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20232089",
"Version": "oval:org.altlinux.errata:def:20232089",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-2089: package `vim` update to version 9.0.1598-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-2089",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-2089",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-01856",
"RefURL": "https://bdu.fstec.ru/vul/2023-01856",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02159",
"RefURL": "https://bdu.fstec.ru/vul/2023-02159",
"Source": "BDU"
},
{
"RefID": "CVE-2023-1127",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-1127",
"Source": "CVE"
},
{
"RefID": "CVE-2023-1170",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-1170",
"Source": "CVE"
},
{
"RefID": "CVE-2023-1175",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-1175",
"Source": "CVE"
},
{
"RefID": "CVE-2023-1264",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-1264",
"Source": "CVE"
},
{
"RefID": "CVE-2023-1355",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-1355",
"Source": "CVE"
},
{
"RefID": "CVE-2023-2426",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-2426",
"Source": "CVE"
},
{
"RefID": "CVE-2023-2609",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-2609",
"Source": "CVE"
},
{
"RefID": "CVE-2023-2610",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-2610",
"Source": "CVE"
}
],
"Description": "This update upgrades vim to version 9.0.1598-alt1. \nSecurity Fix(es):\n\n * BDU:2023-01856: Уязвимость текстового редактора vim, связанная с ошибкой деления на ноль, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2023-02159: Уязвимость функции class_object_index() (vim9class.c) текстового редактора Vim, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2023-1127: Divide By Zero in GitHub repository vim/vim prior to 9.0.1367.\n\n * CVE-2023-1170: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1376.\n\n * CVE-2023-1175: Incorrect Calculation of Buffer Size in GitHub repository vim/vim prior to 9.0.1378.\n\n * CVE-2023-1264: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1392.\n\n * CVE-2023-1355: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.\n\n * CVE-2023-2426: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.\n\n * CVE-2023-2609: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.\n\n * CVE-2023-2610: Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-28"
},
"Updated": {
"Date": "2023-06-28"
},
"bdu": [
{
"Cvss": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-369",
"Href": "https://bdu.fstec.ru/vul/2023-01856",
"Impact": "High",
"Public": "20230301",
"CveID": "BDU:2023-01856"
},
{
"Cvss": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-476",
"Href": "https://bdu.fstec.ru/vul/2023-02159",
"Impact": "High",
"Public": "20230311",
"CveID": "BDU:2023-02159"
}
],
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-369",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-1127",
"Impact": "High",
"Public": "20230301",
"CveID": "CVE-2023-1127"
},
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"Cwe": "CWE-122",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-1170",
"Impact": "Low",
"Public": "20230303",
"CveID": "CVE-2023-1170"
},
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"Cwe": "CWE-131",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-1175",
"Impact": "Low",
"Public": "20230304",
"CveID": "CVE-2023-1175"
},
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-1264",
"Impact": "Low",
"Public": "20230307",
"CveID": "CVE-2023-1264"
},
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-1355",
"Impact": "Low",
"Public": "20230311",
"CveID": "CVE-2023-1355"
},
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "CWE-823",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-2426",
"Impact": "Low",
"Public": "20230429",
"CveID": "CVE-2023-2426"
},
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-2609",
"Impact": "Low",
"Public": "20230509",
"CveID": "CVE-2023-2609"
},
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-190",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-2610",
"Impact": "High",
"Public": "20230509",
"CveID": "CVE-2023-2610"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20232089001",
"Comment": "rpm-build-vim is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089002",
"Comment": "vim-X11 is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089003",
"Comment": "vim-X11-gnome2 is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089004",
"Comment": "vim-X11-gtk2 is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089005",
"Comment": "vim-X11-gtk3 is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089006",
"Comment": "vim-common is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089007",
"Comment": "vim-console is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089008",
"Comment": "vim-enhanced is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089009",
"Comment": "vim-minimal is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089010",
"Comment": "vim-spell-source is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089011",
"Comment": "vimtutor is earlier than 4:9.0.1598-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232089012",
"Comment": "xxd is earlier than 4:9.0.1598-alt1"
}
]
}
]
}
}
]
}

100
oval/c10f1/ALT-PU-2023-2089/objects.json
View File

@ -1,100 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232089001",
"Version": "1",
"comment": "rpm-build-vim is installed",
"Name": "rpm-build-vim"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089002",
"Version": "1",
"comment": "vim-X11 is installed",
"Name": "vim-X11"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089003",
"Version": "1",
"comment": "vim-X11-gnome2 is installed",
"Name": "vim-X11-gnome2"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089004",
"Version": "1",
"comment": "vim-X11-gtk2 is installed",
"Name": "vim-X11-gtk2"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089005",
"Version": "1",
"comment": "vim-X11-gtk3 is installed",
"Name": "vim-X11-gtk3"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089006",
"Version": "1",
"comment": "vim-common is installed",
"Name": "vim-common"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089007",
"Version": "1",
"comment": "vim-console is installed",
"Name": "vim-console"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089008",
"Version": "1",
"comment": "vim-enhanced is installed",
"Name": "vim-enhanced"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089009",
"Version": "1",
"comment": "vim-minimal is installed",
"Name": "vim-minimal"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089010",
"Version": "1",
"comment": "vim-spell-source is installed",
"Name": "vim-spell-source"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089011",
"Version": "1",
"comment": "vimtutor is installed",
"Name": "vimtutor"
},
{
"ID": "oval:org.altlinux.errata:obj:20232089012",
"Version": "1",
"comment": "xxd is installed",
"Name": "xxd"
}
]
}

23
oval/c10f1/ALT-PU-2023-2089/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232089001",
"Version": "1",
"Comment": "package EVR is earlier than 4:9.0.1598-alt1",
"Arch": {},
"Evr": {
"Text": "4:9.0.1598-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

162
oval/c10f1/ALT-PU-2023-2089/tests.json
View File

@ -1,162 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232089001",
"Version": "1",
"Check": "all",
"Comment": "rpm-build-vim is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089002",
"Version": "1",
"Check": "all",
"Comment": "vim-X11 is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089003",
"Version": "1",
"Check": "all",
"Comment": "vim-X11-gnome2 is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089004",
"Version": "1",
"Check": "all",
"Comment": "vim-X11-gtk2 is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089005",
"Version": "1",
"Check": "all",
"Comment": "vim-X11-gtk3 is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089006",
"Version": "1",
"Check": "all",
"Comment": "vim-common is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089006"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089007",
"Version": "1",
"Check": "all",
"Comment": "vim-console is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089007"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089008",
"Version": "1",
"Check": "all",
"Comment": "vim-enhanced is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089008"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089009",
"Version": "1",
"Check": "all",
"Comment": "vim-minimal is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089009"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089010",
"Version": "1",
"Check": "all",
"Comment": "vim-spell-source is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089010"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089011",
"Version": "1",
"Check": "all",
"Comment": "vimtutor is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089011"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232089012",
"Version": "1",
"Check": "all",
"Comment": "xxd is earlier than 4:9.0.1598-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232089012"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232089001"
}
}
]
}

222
oval/c10f1/ALT-PU-2023-2095/definitions.json
View File

@ -1,222 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20232095",
"Version": "oval:org.altlinux.errata:def:20232095",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-2095: package `ffmpeg` update to version 4.4.4-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-2095",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-2095",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-03348",
"RefURL": "https://bdu.fstec.ru/vul/2023-03348",
"Source": "BDU"
},
{
"RefID": "CVE-2022-3109",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-3109",
"Source": "CVE"
},
{
"RefID": "CVE-2022-3341",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-3341",
"Source": "CVE"
},
{
"RefID": "CVE-2022-3964",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-3964",
"Source": "CVE"
}
],
"Description": "This update upgrades ffmpeg to version 4.4.4-alt1. \nSecurity Fix(es):\n\n * BDU:2023-03348: Уязвимость функции decode_main_header() (libavformat/nutdec.c) мультимедийной библиотеки FFmpeg, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2022-3109: An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pointer dereference, impacting availability.\n\n * CVE-2022-3341: A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.\n\n * CVE-2022-3964: A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RPZA Video Encoder. The manipulation of the argument y_size leads to out-of-bounds read. It is possible to initiate the attack remotely. The name of the patch is 92f9b28ed84a77138105475beba16c146bdaf984. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213543.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-28"
},
"Updated": {
"Date": "2023-06-28"
},
"bdu": [
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"Cwe": "CWE-476",
"Href": "https://bdu.fstec.ru/vul/2023-03348",
"Impact": "Low",
"Public": "20220722",
"CveID": "BDU:2023-03348"
}
],
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-3109",
"Impact": "High",
"Public": "20221216",
"CveID": "CVE-2022-3109"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"Cwe": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-3341",
"Impact": "Low",
"Public": "20230112",
"CveID": "CVE-2022-3341"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"Cwe": "CWE-119",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-3964",
"Impact": "High",
"Public": "20221113",
"CveID": "CVE-2022-3964"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20232095001",
"Comment": "ffmpeg is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095002",
"Comment": "ffmpeg-doc is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095003",
"Comment": "ffplay is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095004",
"Comment": "ffplay-doc is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095005",
"Comment": "ffprobe is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095006",
"Comment": "ffprobe-doc is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095007",
"Comment": "ffserver-doc is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095008",
"Comment": "libavcodec-devel is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095009",
"Comment": "libavcodec58 is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095010",
"Comment": "libavdevice-devel is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095011",
"Comment": "libavdevice58 is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095012",
"Comment": "libavfilter-devel is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095013",
"Comment": "libavfilter7 is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095014",
"Comment": "libavformat-devel is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095015",
"Comment": "libavformat58 is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095016",
"Comment": "libavresample-devel is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095017",
"Comment": "libavresample4 is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095018",
"Comment": "libavutil-devel is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095019",
"Comment": "libavutil56 is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095020",
"Comment": "libpostproc-devel is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095021",
"Comment": "libpostproc55 is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095022",
"Comment": "libswresample-devel is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095023",
"Comment": "libswresample3 is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095024",
"Comment": "libswscale-devel is earlier than 2:4.4.4-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20232095025",
"Comment": "libswscale5 is earlier than 2:4.4.4-alt1"
}
]
}
]
}
}
]
}

178
oval/c10f1/ALT-PU-2023-2095/objects.json
View File

@ -1,178 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20232095001",
"Version": "1",
"comment": "ffmpeg is installed",
"Name": "ffmpeg"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095002",
"Version": "1",
"comment": "ffmpeg-doc is installed",
"Name": "ffmpeg-doc"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095003",
"Version": "1",
"comment": "ffplay is installed",
"Name": "ffplay"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095004",
"Version": "1",
"comment": "ffplay-doc is installed",
"Name": "ffplay-doc"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095005",
"Version": "1",
"comment": "ffprobe is installed",
"Name": "ffprobe"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095006",
"Version": "1",
"comment": "ffprobe-doc is installed",
"Name": "ffprobe-doc"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095007",
"Version": "1",
"comment": "ffserver-doc is installed",
"Name": "ffserver-doc"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095008",
"Version": "1",
"comment": "libavcodec-devel is installed",
"Name": "libavcodec-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095009",
"Version": "1",
"comment": "libavcodec58 is installed",
"Name": "libavcodec58"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095010",
"Version": "1",
"comment": "libavdevice-devel is installed",
"Name": "libavdevice-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095011",
"Version": "1",
"comment": "libavdevice58 is installed",
"Name": "libavdevice58"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095012",
"Version": "1",
"comment": "libavfilter-devel is installed",
"Name": "libavfilter-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095013",
"Version": "1",
"comment": "libavfilter7 is installed",
"Name": "libavfilter7"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095014",
"Version": "1",
"comment": "libavformat-devel is installed",
"Name": "libavformat-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095015",
"Version": "1",
"comment": "libavformat58 is installed",
"Name": "libavformat58"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095016",
"Version": "1",
"comment": "libavresample-devel is installed",
"Name": "libavresample-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095017",
"Version": "1",
"comment": "libavresample4 is installed",
"Name": "libavresample4"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095018",
"Version": "1",
"comment": "libavutil-devel is installed",
"Name": "libavutil-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095019",
"Version": "1",
"comment": "libavutil56 is installed",
"Name": "libavutil56"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095020",
"Version": "1",
"comment": "libpostproc-devel is installed",
"Name": "libpostproc-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095021",
"Version": "1",
"comment": "libpostproc55 is installed",
"Name": "libpostproc55"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095022",
"Version": "1",
"comment": "libswresample-devel is installed",
"Name": "libswresample-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095023",
"Version": "1",
"comment": "libswresample3 is installed",
"Name": "libswresample3"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095024",
"Version": "1",
"comment": "libswscale-devel is installed",
"Name": "libswscale-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20232095025",
"Version": "1",
"comment": "libswscale5 is installed",
"Name": "libswscale5"
}
]
}

23
oval/c10f1/ALT-PU-2023-2095/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20232095001",
"Version": "1",
"Comment": "package EVR is earlier than 2:4.4.4-alt1",
"Arch": {},
"Evr": {
"Text": "2:4.4.4-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

318
oval/c10f1/ALT-PU-2023-2095/tests.json
View File

@ -1,318 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20232095001",
"Version": "1",
"Check": "all",
"Comment": "ffmpeg is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095002",
"Version": "1",
"Check": "all",
"Comment": "ffmpeg-doc is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095003",
"Version": "1",
"Check": "all",
"Comment": "ffplay is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095004",
"Version": "1",
"Check": "all",
"Comment": "ffplay-doc is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095005",
"Version": "1",
"Check": "all",
"Comment": "ffprobe is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095006",
"Version": "1",
"Check": "all",
"Comment": "ffprobe-doc is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095006"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095007",
"Version": "1",
"Check": "all",
"Comment": "ffserver-doc is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095007"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095008",
"Version": "1",
"Check": "all",
"Comment": "libavcodec-devel is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095008"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095009",
"Version": "1",
"Check": "all",
"Comment": "libavcodec58 is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095009"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095010",
"Version": "1",
"Check": "all",
"Comment": "libavdevice-devel is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095010"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095011",
"Version": "1",
"Check": "all",
"Comment": "libavdevice58 is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095011"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095012",
"Version": "1",
"Check": "all",
"Comment": "libavfilter-devel is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095012"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095013",
"Version": "1",
"Check": "all",
"Comment": "libavfilter7 is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095013"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095014",
"Version": "1",
"Check": "all",
"Comment": "libavformat-devel is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095014"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095015",
"Version": "1",
"Check": "all",
"Comment": "libavformat58 is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095015"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095016",
"Version": "1",
"Check": "all",
"Comment": "libavresample-devel is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095016"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095017",
"Version": "1",
"Check": "all",
"Comment": "libavresample4 is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095017"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095018",
"Version": "1",
"Check": "all",
"Comment": "libavutil-devel is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095018"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095019",
"Version": "1",
"Check": "all",
"Comment": "libavutil56 is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095019"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095020",
"Version": "1",
"Check": "all",
"Comment": "libpostproc-devel is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095020"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095021",
"Version": "1",
"Check": "all",
"Comment": "libpostproc55 is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095021"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095022",
"Version": "1",
"Check": "all",
"Comment": "libswresample-devel is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095022"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095023",
"Version": "1",
"Check": "all",
"Comment": "libswresample3 is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095023"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095024",
"Version": "1",
"Check": "all",
"Comment": "libswscale-devel is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095024"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20232095025",
"Version": "1",
"Check": "all",
"Comment": "libswscale5 is earlier than 2:4.4.4-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20232095025"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20232095001"
}
}
]
}

177
oval/c10f1/ALT-PU-2023-4099/definitions.json
View File

@ -1,177 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20234099",
"Version": "oval:org.altlinux.errata:def:20234099",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-4099: package `golang` update to version 1.19.10-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-4099",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-4099",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-03200",
"RefURL": "https://bdu.fstec.ru/vul/2023-03200",
"Source": "BDU"
},
{
"RefID": "BDU:2023-03201",
"RefURL": "https://bdu.fstec.ru/vul/2023-03201",
"Source": "BDU"
},
{
"RefID": "CVE-2023-29402",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-29402",
"Source": "CVE"
},
{
"RefID": "CVE-2023-29403",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-29403",
"Source": "CVE"
},
{
"RefID": "CVE-2023-29404",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-29404",
"Source": "CVE"
},
{
"RefID": "CVE-2023-29405",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-29405",
"Source": "CVE"
}
],
"Description": "This update upgrades golang to version 1.19.10-alt1. \nSecurity Fix(es):\n\n * BDU:2023-03200: Уязвимость языка программирования Go, связанная с небезопасным внешним контролем за критическими данными состояния, позволяющая нарушителю повысить свои привилегии и получить доступ на чтение, изменение или удаление данных\n\n * BDU:2023-03201: Уязвимость модуля Cgo языка программирования Go, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2023-29402: The go command may generate unexpected code at build time when using cgo. This may result in unexpected behavior when running a go program which uses cgo. This may occur when running an untrusted module which contains directories with newline characters in their names. Modules which are retrieved using the go command, i.e. via \"go get\", are not affected (modules retrieved using GOPATH-mode, i.e. GO111MODULE=off, may be affected).\n\n * CVE-2023-29403: On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as when dumping memory state, or assuming the status of standard i/o file descriptors. If a setuid/setgid binary is executed with standard I/O file descriptors closed, opening any files can result in unexpected content being read or written with elevated privileges. Similarly, if a setuid/setgid program is terminated, either via panic or signal, it may leak the contents of its registers.\n\n * CVE-2023-29404: The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. The arguments for a number of flags which are non-optional are incorrectly considered optional, allowing disallowed flags to be smuggled through the LDFLAGS sanitization. This affects usage of both the gc and gccgo compilers.\n\n * CVE-2023-29405: The go command may execute arbitrary code at build time when using cgo. This may occur when running \"go get\" on a malicious module, or when running any other command which builds untrusted code. This is can by triggered by linker flags, specified via a \"#cgo LDFLAGS\" directive. Flags containing embedded spaces are mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in the argument of another flag. This only affects usage of the gccgo compiler.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-30"
},
"Updated": {
"Date": "2023-06-30"
},
"bdu": [
{
"Cvss": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"Cvss3": "AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
"Cwe": "CWE-642",
"Href": "https://bdu.fstec.ru/vul/2023-03200",
"Impact": "Low",
"Public": "20230405",
"CveID": "BDU:2023-03200"
},
{
"Cvss": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"Cwe": "CWE-94",
"Href": "https://bdu.fstec.ru/vul/2023-03201",
"Impact": "High",
"Public": "20230405",
"CveID": "BDU:2023-03201"
}
],
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-94",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-29402",
"Impact": "Critical",
"Public": "20230608",
"CveID": "CVE-2023-29402"
},
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-668",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-29403",
"Impact": "High",
"Public": "20230608",
"CveID": "CVE-2023-29403"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-94",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-29404",
"Impact": "Critical",
"Public": "20230608",
"CveID": "CVE-2023-29404"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-74",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-29405",
"Impact": "Critical",
"Public": "20230608",
"CveID": "CVE-2023-29405"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20234099001",
"Comment": "golang is earlier than 0:1.19.10-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234099002",
"Comment": "golang-docs is earlier than 0:1.19.10-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234099003",
"Comment": "golang-gdb is earlier than 0:1.19.10-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234099004",
"Comment": "golang-misc is earlier than 0:1.19.10-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234099005",
"Comment": "golang-shared is earlier than 0:1.19.10-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234099006",
"Comment": "golang-src is earlier than 0:1.19.10-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234099007",
"Comment": "golang-tests is earlier than 0:1.19.10-alt1"
}
]
}
]
}
}
]
}

70
oval/c10f1/ALT-PU-2023-4099/objects.json
View File

@ -1,70 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20234099001",
"Version": "1",
"comment": "golang is installed",
"Name": "golang"
},
{
"ID": "oval:org.altlinux.errata:obj:20234099002",
"Version": "1",
"comment": "golang-docs is installed",
"Name": "golang-docs"
},
{
"ID": "oval:org.altlinux.errata:obj:20234099003",
"Version": "1",
"comment": "golang-gdb is installed",
"Name": "golang-gdb"
},
{
"ID": "oval:org.altlinux.errata:obj:20234099004",
"Version": "1",
"comment": "golang-misc is installed",
"Name": "golang-misc"
},
{
"ID": "oval:org.altlinux.errata:obj:20234099005",
"Version": "1",
"comment": "golang-shared is installed",
"Name": "golang-shared"
},
{
"ID": "oval:org.altlinux.errata:obj:20234099006",
"Version": "1",
"comment": "golang-src is installed",
"Name": "golang-src"
},
{
"ID": "oval:org.altlinux.errata:obj:20234099007",
"Version": "1",
"comment": "golang-tests is installed",
"Name": "golang-tests"
}
]
}

23
oval/c10f1/ALT-PU-2023-4099/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20234099001",
"Version": "1",
"Comment": "package EVR is earlier than 0:1.19.10-alt1",
"Arch": {},
"Evr": {
"Text": "0:1.19.10-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

102
oval/c10f1/ALT-PU-2023-4099/tests.json
View File

@ -1,102 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20234099001",
"Version": "1",
"Check": "all",
"Comment": "golang is earlier than 0:1.19.10-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234099001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234099001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234099002",
"Version": "1",
"Check": "all",
"Comment": "golang-docs is earlier than 0:1.19.10-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234099002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234099001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234099003",
"Version": "1",
"Check": "all",
"Comment": "golang-gdb is earlier than 0:1.19.10-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234099003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234099001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234099004",
"Version": "1",
"Check": "all",
"Comment": "golang-misc is earlier than 0:1.19.10-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234099004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234099001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234099005",
"Version": "1",
"Check": "all",
"Comment": "golang-shared is earlier than 0:1.19.10-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234099005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234099001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234099006",
"Version": "1",
"Check": "all",
"Comment": "golang-src is earlier than 0:1.19.10-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234099006"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234099001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234099007",
"Version": "1",
"Check": "all",
"Comment": "golang-tests is earlier than 0:1.19.10-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234099007"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234099001"
}
}
]
}

86
oval/c10f1/ALT-PU-2023-4103/definitions.json
View File

@ -1,86 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20234103",
"Version": "oval:org.altlinux.errata:def:20234103",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-4103: package `phpldapadmin` update to version 1.2.6.6-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-4103",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-4103",
"Source": "ALTPU"
},
{
"RefID": "CVE-2020-35132",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-35132",
"Source": "CVE"
}
],
"Description": "This update upgrades phpldapadmin to version 1.2.6.6-alt1. \nSecurity Fix(es):\n\n * CVE-2020-35132: An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-07-05"
},
"Updated": {
"Date": "2023-07-05"
},
"bdu": null,
"Cves": [
{
"Cvss": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"Cwe": "CWE-79",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-35132",
"Impact": "Low",
"Public": "20201211",
"CveID": "CVE-2020-35132"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20234103001",
"Comment": "phpldapadmin is earlier than 0:1.2.6.6-alt1"
}
]
}
]
}
}
]
}

34
oval/c10f1/ALT-PU-2023-4103/objects.json
View File

@ -1,34 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20234103001",
"Version": "1",
"comment": "phpldapadmin is installed",
"Name": "phpldapadmin"
}
]
}

23
oval/c10f1/ALT-PU-2023-4103/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20234103001",
"Version": "1",
"Comment": "package EVR is earlier than 0:1.2.6.6-alt1",
"Arch": {},
"Evr": {
"Text": "0:1.2.6.6-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

30
oval/c10f1/ALT-PU-2023-4103/tests.json
View File

@ -1,30 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20234103001",
"Version": "1",
"Check": "all",
"Comment": "phpldapadmin is earlier than 0:1.2.6.6-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234103001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234103001"
}
}
]
}

331
oval/c10f1/ALT-PU-2023-4120/definitions.json
View File

@ -1,331 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20234120",
"Version": "oval:org.altlinux.errata:def:20234120",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-4120: package `expat` update to version 2.5.0-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-4120",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-4120",
"Source": "ALTPU"
},
{
"RefID": "BDU:2022-00999",
"RefURL": "https://bdu.fstec.ru/vul/2022-00999",
"Source": "BDU"
},
{
"RefID": "BDU:2022-01062",
"RefURL": "https://bdu.fstec.ru/vul/2022-01062",
"Source": "BDU"
},
{
"RefID": "BDU:2022-01063",
"RefURL": "https://bdu.fstec.ru/vul/2022-01063",
"Source": "BDU"
},
{
"RefID": "BDU:2022-01064",
"RefURL": "https://bdu.fstec.ru/vul/2022-01064",
"Source": "BDU"
},
{
"RefID": "BDU:2022-01065",
"RefURL": "https://bdu.fstec.ru/vul/2022-01065",
"Source": "BDU"
},
{
"RefID": "BDU:2022-01071",
"RefURL": "https://bdu.fstec.ru/vul/2022-01071",
"Source": "BDU"
},
{
"RefID": "BDU:2022-01702",
"RefURL": "https://bdu.fstec.ru/vul/2022-01702",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02596",
"RefURL": "https://bdu.fstec.ru/vul/2023-02596",
"Source": "BDU"
},
{
"RefID": "BDU:2023-02688",
"RefURL": "https://bdu.fstec.ru/vul/2023-02688",
"Source": "BDU"
},
{
"RefID": "CVE-2022-23852",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-23852",
"Source": "CVE"
},
{
"RefID": "CVE-2022-23990",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-23990",
"Source": "CVE"
},
{
"RefID": "CVE-2022-25235",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-25235",
"Source": "CVE"
},
{
"RefID": "CVE-2022-25236",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-25236",
"Source": "CVE"
},
{
"RefID": "CVE-2022-25313",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-25313",
"Source": "CVE"
},
{
"RefID": "CVE-2022-25314",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-25314",
"Source": "CVE"
},
{
"RefID": "CVE-2022-25315",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-25315",
"Source": "CVE"
},
{
"RefID": "CVE-2022-40674",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-40674",
"Source": "CVE"
},
{
"RefID": "CVE-2022-43680",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-43680",
"Source": "CVE"
}
],
"Description": "This update upgrades expat to version 2.5.0-alt1. \nSecurity Fix(es):\n\n * BDU:2022-00999: Уязвимость функции doProlog() библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2022-01062: Уязвимость функции copyString библиотеки Expat, связанная с целочисленным переполнением, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2022-01063: Уязвимость компонента xmltok_impl.c библиотеки Expat, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2022-01064: Уязвимость функции build_model библиотеки Expat, связанная с переполнением буфера в стеке, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2022-01065: Уязвимость компонента xmlparse.c библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2022-01071: Уязвимость функции storeRawNames библиотеки Expat, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2022-01702: Уязвимость библиотеки синтаксического анализатора XML libexpat, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2023-02596: Уязвимость функции doContent файла xmlparse.c библиотеки синтаксического анализатора XML libexpat, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2023-02688: Уязвимость функции XML_ExternalEntityParserCreate библиотеки синтаксического анализатора XML libexpat, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2022-23852: Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.\n\n * CVE-2022-23990: Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.\n\n * CVE-2022-25235: xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.\n\n * CVE-2022-25236: xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.\n\n * CVE-2022-25313: In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.\n\n * CVE-2022-25314: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.\n\n * CVE-2022-25315: In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.\n\n * CVE-2022-40674: libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.\n\n * CVE-2022-43680: In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-07-06"
},
"Updated": {
"Date": "2023-07-06"
},
"bdu": [
{
"Cvss": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-190",
"Href": "https://bdu.fstec.ru/vul/2022-00999",
"Impact": "Critical",
"Public": "20220126",
"CveID": "BDU:2022-00999"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "CWE-190",
"Href": "https://bdu.fstec.ru/vul/2022-01062",
"Impact": "High",
"Public": "20220221",
"CveID": "BDU:2022-01062"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-94",
"Href": "https://bdu.fstec.ru/vul/2022-01063",
"Impact": "Critical",
"Public": "20220221",
"CveID": "BDU:2022-01063"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-121",
"Href": "https://bdu.fstec.ru/vul/2022-01064",
"Impact": "Critical",
"Public": "20220221",
"CveID": "BDU:2022-01064"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"Cwe": "CWE-668",
"Href": "https://bdu.fstec.ru/vul/2022-01065",
"Impact": "Low",
"Public": "20220221",
"CveID": "BDU:2022-01065"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "CWE-190",
"Href": "https://bdu.fstec.ru/vul/2022-01071",
"Impact": "High",
"Public": "20220221",
"CveID": "BDU:2022-01071"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-190",
"Href": "https://bdu.fstec.ru/vul/2022-01702",
"Impact": "Critical",
"Public": "20220125",
"CveID": "BDU:2022-01702"
},
{
"Cvss": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-416",
"Href": "https://bdu.fstec.ru/vul/2023-02596",
"Impact": "High",
"Public": "20220914",
"CveID": "BDU:2023-02596"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "CWE-416",
"Href": "https://bdu.fstec.ru/vul/2023-02688",
"Impact": "High",
"Public": "20221024",
"CveID": "BDU:2023-02688"
}
],
"Cves": [
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-190",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-23852",
"Impact": "Critical",
"Public": "20220124",
"CveID": "CVE-2022-23852"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "CWE-190",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-23990",
"Impact": "High",
"Public": "20220126",
"CveID": "CVE-2022-23990"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-116",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-25235",
"Impact": "Critical",
"Public": "20220216",
"CveID": "CVE-2022-25235"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-668",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-25236",
"Impact": "Critical",
"Public": "20220216",
"CveID": "CVE-2022-25236"
},
{
"Cvss": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"Cwe": "CWE-674",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-25313",
"Impact": "Low",
"Public": "20220218",
"CveID": "CVE-2022-25313"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "CWE-190",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-25314",
"Impact": "High",
"Public": "20220218",
"CveID": "CVE-2022-25314"
},
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-190",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-25315",
"Impact": "Critical",
"Public": "20220218",
"CveID": "CVE-2022-25315"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-416",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-40674",
"Impact": "High",
"Public": "20220914",
"CveID": "CVE-2022-40674"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "CWE-416",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-43680",
"Impact": "High",
"Public": "20221024",
"CveID": "CVE-2022-43680"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20234120001",
"Comment": "expat is earlier than 0:2.5.0-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234120002",
"Comment": "libexpat is earlier than 0:2.5.0-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234120003",
"Comment": "libexpat-devel is earlier than 0:2.5.0-alt1"
}
]
}
]
}
}
]
}

46
oval/c10f1/ALT-PU-2023-4120/objects.json
View File

@ -1,46 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20234120001",
"Version": "1",
"comment": "expat is installed",
"Name": "expat"
},
{
"ID": "oval:org.altlinux.errata:obj:20234120002",
"Version": "1",
"comment": "libexpat is installed",
"Name": "libexpat"
},
{
"ID": "oval:org.altlinux.errata:obj:20234120003",
"Version": "1",
"comment": "libexpat-devel is installed",
"Name": "libexpat-devel"
}
]
}

23
oval/c10f1/ALT-PU-2023-4120/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20234120001",
"Version": "1",
"Comment": "package EVR is earlier than 0:2.5.0-alt1",
"Arch": {},
"Evr": {
"Text": "0:2.5.0-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

54
oval/c10f1/ALT-PU-2023-4120/tests.json
View File

@ -1,54 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20234120001",
"Version": "1",
"Check": "all",
"Comment": "expat is earlier than 0:2.5.0-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234120001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234120001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234120002",
"Version": "1",
"Check": "all",
"Comment": "libexpat is earlier than 0:2.5.0-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234120002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234120001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234120003",
"Version": "1",
"Check": "all",
"Comment": "libexpat-devel is earlier than 0:2.5.0-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234120003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234120001"
}
}
]
}

199
oval/c10f1/ALT-PU-2023-4121/definitions.json
View File

@ -1,199 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20234121",
"Version": "oval:org.altlinux.errata:def:20234121",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-4121: package `zoneminder` update to version 1.36.33-alt1.1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-4121",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-4121",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-01079",
"RefURL": "https://bdu.fstec.ru/vul/2023-01079",
"Source": "BDU"
},
{
"RefID": "CVE-2023-25825",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-25825",
"Source": "CVE"
},
{
"RefID": "CVE-2023-26032",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-26032",
"Source": "CVE"
},
{
"RefID": "CVE-2023-26034",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-26034",
"Source": "CVE"
},
{
"RefID": "CVE-2023-26035",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-26035",
"Source": "CVE"
},
{
"RefID": "CVE-2023-26036",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-26036",
"Source": "CVE"
},
{
"RefID": "CVE-2023-26037",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-26037",
"Source": "CVE"
},
{
"RefID": "CVE-2023-26038",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-26038",
"Source": "CVE"
},
{
"RefID": "CVE-2023-26039",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-26039",
"Source": "CVE"
}
],
"Description": "This update upgrades zoneminder to version 1.36.33-alt1.1. \nSecurity Fix(es):\n\n * BDU:2023-01079: Уязвимость функции shell_exec() программного обеспечения для организации видеонаблюдения ZoneMinder, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2023-25825: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field. This is unescaped when viewing the logs in the web ui. This issue is patched in version 1.36.33. \n\n * CVE-2023-26032: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain SQL Injection via malicious jason web token. The Username field of the JWT token was trusted when performing an SQL query to load the user. If an attacker could determine the HASH key used by ZoneMinder, they could generate a malicious JWT token and use it to execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.\n\n * CVE-2023-26034: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are affected by a SQL Injection vulnerability. The (blind) SQL Injection vulnerability is present within the `filter[Query][terms][0][attr]` query string parameter of the `/zm/index.php` endpoint. A user with the View or Edit permissions of Events may execute arbitrary SQL. The resulting impact can include unauthorized data access (and modification), authentication and/or authorization bypass, and remote code execution.\n\n * CVE-2023-26035: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. There are no permissions check on the snapshot action, which expects an id to fetch an existing monitor but can be passed an object to create a new one instead. TriggerOn ends up calling shell_exec using the supplied Id. This issue is fixed in This issue is fixed in versions 1.36.33 and 1.37.33.\n\n * CVE-2023-26036: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling $view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the path. This can be exploited by constructing paths like \"..././\", which get replaced by \"../\". This issue is patched in versions 1.36.33 and 1.37.33.\n\n * CVE-2023-26037: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an SQL Injection. The minTime and maxTime request parameters are not properly validated and could be used execute arbitrary SQL. This issue is fixed in versions 1.36.33 and 1.37.33.\n\n * CVE-2023-26038: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33.\n\n * CVE-2023-26039: ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain an OS Command Injection via daemonControl() in (/web/api/app/Controller/HostController.php). Any authenticated user can construct an api command to execute any shell command as the web user. This issue is patched in versions 1.36.33 and 1.37.33.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-07-05"
},
"Updated": {
"Date": "2023-07-05"
},
"bdu": [
{
"Cvss": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"Cvss3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"Cwe": "CWE-862",
"Href": "https://bdu.fstec.ru/vul/2023-01079",
"Impact": "High",
"Public": "20230217",
"CveID": "BDU:2023-01079"
}
],
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"Cwe": "CWE-79",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-25825",
"Impact": "Low",
"Public": "20230225",
"CveID": "CVE-2023-25825"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-89",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-26032",
"Impact": "High",
"Public": "20230225",
"CveID": "CVE-2023-26032"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-89",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-26034",
"Impact": "High",
"Public": "20230225",
"CveID": "CVE-2023-26034"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-862",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-26035",
"Impact": "Critical",
"Public": "20230225",
"CveID": "CVE-2023-26035"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-426",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-26036",
"Impact": "Critical",
"Public": "20230225",
"CveID": "CVE-2023-26036"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-89",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-26037",
"Impact": "Critical",
"Public": "20230225",
"CveID": "CVE-2023-26037"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"Cwe": "CWE-426",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-26038",
"Impact": "Low",
"Public": "20230225",
"CveID": "CVE-2023-26038"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"Cwe": "CWE-78",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-26039",
"Impact": "High",
"Public": "20230225",
"CveID": "CVE-2023-26039"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20234121001",
"Comment": "zoneminder is earlier than 0:1.36.33-alt1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234121002",
"Comment": "zoneminder-api is earlier than 0:1.36.33-alt1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234121003",
"Comment": "zoneminder-nginx is earlier than 0:1.36.33-alt1.1"
}
]
}
]
}
}
]
}

46
oval/c10f1/ALT-PU-2023-4121/objects.json
View File

@ -1,46 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20234121001",
"Version": "1",
"comment": "zoneminder is installed",
"Name": "zoneminder"
},
{
"ID": "oval:org.altlinux.errata:obj:20234121002",
"Version": "1",
"comment": "zoneminder-api is installed",
"Name": "zoneminder-api"
},
{
"ID": "oval:org.altlinux.errata:obj:20234121003",
"Version": "1",
"comment": "zoneminder-nginx is installed",
"Name": "zoneminder-nginx"
}
]
}

23
oval/c10f1/ALT-PU-2023-4121/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20234121001",
"Version": "1",
"Comment": "package EVR is earlier than 0:1.36.33-alt1.1",
"Arch": {},
"Evr": {
"Text": "0:1.36.33-alt1.1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

54
oval/c10f1/ALT-PU-2023-4121/tests.json
View File

@ -1,54 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20234121001",
"Version": "1",
"Check": "all",
"Comment": "zoneminder is earlier than 0:1.36.33-alt1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234121001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234121001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234121002",
"Version": "1",
"Check": "all",
"Comment": "zoneminder-api is earlier than 0:1.36.33-alt1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234121002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234121001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234121003",
"Version": "1",
"Check": "all",
"Comment": "zoneminder-nginx is earlier than 0:1.36.33-alt1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234121003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234121001"
}
}
]
}

101
oval/c10f1/ALT-PU-2023-4125/definitions.json
View File

@ -1,101 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20234125",
"Version": "oval:org.altlinux.errata:def:20234125",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-4125: package `php8.0` update to version 8.0.29-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-4125",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-4125",
"Source": "ALTPU"
},
{
"RefID": "CVE-2023-3247",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-3247",
"Source": "CVE"
}
],
"Description": "This update upgrades php8.0 to version 8.0.29-alt1. \nSecurity Fix(es):\n\n * CVE-2023-3247: In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce. \n\n",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-30"
},
"Updated": {
"Date": "2023-06-30"
},
"bdu": null,
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"Cwe": "CWE-330",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-3247",
"Impact": "Low",
"Public": "20230722",
"CveID": "CVE-2023-3247"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20234125001",
"Comment": "php8.0 is earlier than 0:8.0.29-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234125002",
"Comment": "php8.0-devel is earlier than 0:8.0.29-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234125003",
"Comment": "php8.0-libs is earlier than 0:8.0.29-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234125004",
"Comment": "php8.0-mysqlnd is earlier than 0:8.0.29-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234125005",
"Comment": "rpm-build-php8.0-version is earlier than 0:8.0.29-alt1"
}
]
}
]
}
}
]
}

58
oval/c10f1/ALT-PU-2023-4125/objects.json
View File

@ -1,58 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20234125001",
"Version": "1",
"comment": "php8.0 is installed",
"Name": "php8.0"
},
{
"ID": "oval:org.altlinux.errata:obj:20234125002",
"Version": "1",
"comment": "php8.0-devel is installed",
"Name": "php8.0-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20234125003",
"Version": "1",
"comment": "php8.0-libs is installed",
"Name": "php8.0-libs"
},
{
"ID": "oval:org.altlinux.errata:obj:20234125004",
"Version": "1",
"comment": "php8.0-mysqlnd is installed",
"Name": "php8.0-mysqlnd"
},
{
"ID": "oval:org.altlinux.errata:obj:20234125005",
"Version": "1",
"comment": "rpm-build-php8.0-version is installed",
"Name": "rpm-build-php8.0-version"
}
]
}

23
oval/c10f1/ALT-PU-2023-4125/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20234125001",
"Version": "1",
"Comment": "package EVR is earlier than 0:8.0.29-alt1",
"Arch": {},
"Evr": {
"Text": "0:8.0.29-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

78
oval/c10f1/ALT-PU-2023-4125/tests.json
View File

@ -1,78 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20234125001",
"Version": "1",
"Check": "all",
"Comment": "php8.0 is earlier than 0:8.0.29-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234125001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234125001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234125002",
"Version": "1",
"Check": "all",
"Comment": "php8.0-devel is earlier than 0:8.0.29-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234125002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234125001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234125003",
"Version": "1",
"Check": "all",
"Comment": "php8.0-libs is earlier than 0:8.0.29-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234125003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234125001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234125004",
"Version": "1",
"Check": "all",
"Comment": "php8.0-mysqlnd is earlier than 0:8.0.29-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234125004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234125001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234125005",
"Version": "1",
"Check": "all",
"Comment": "rpm-build-php8.0-version is earlier than 0:8.0.29-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234125005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234125001"
}
}
]
}

139
oval/c10f1/ALT-PU-2023-4130/definitions.json
View File

@ -1,139 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20234130",
"Version": "oval:org.altlinux.errata:def:20234130",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-4130: package `yandex-browser-stable` update to version 23.5.1.793-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-4130",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-4130",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-03159",
"RefURL": "https://bdu.fstec.ru/vul/2023-03159",
"Source": "BDU"
},
{
"RefID": "CVE-2023-3214",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-3214",
"Source": "CVE"
},
{
"RefID": "CVE-2023-3215",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-3215",
"Source": "CVE"
},
{
"RefID": "CVE-2023-3216",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-3216",
"Source": "CVE"
},
{
"RefID": "CVE-2023-3217",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-3217",
"Source": "CVE"
}
],
"Description": "This update upgrades yandex-browser-stable to version 23.5.1.793-alt1. \nSecurity Fix(es):\n\n * BDU:2023-03159: Уязвимость функции автозаполнения Autofill Payments браузера Google Chrome, повыполнить произвольный код\n\n * CVE-2023-3214: Use after free in Autofill payments in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)\n\n * CVE-2023-3215: Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)\n\n * CVE-2023-3216: Type confusion in V8 in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)\n\n * CVE-2023-3217: Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-30"
},
"Updated": {
"Date": "2023-06-30"
},
"bdu": [
{
"Cvss": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"Cvss3": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-416",
"Href": "https://bdu.fstec.ru/vul/2023-03159",
"Impact": "High",
"Public": "20230613",
"CveID": "BDU:2023-03159"
}
],
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-416",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-3214",
"Impact": "High",
"Public": "20230613",
"CveID": "CVE-2023-3214"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-416",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-3215",
"Impact": "High",
"Public": "20230613",
"CveID": "CVE-2023-3215"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-843",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-3216",
"Impact": "High",
"Public": "20230613",
"CveID": "CVE-2023-3216"
},
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-416",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-3217",
"Impact": "High",
"Public": "20230613",
"CveID": "CVE-2023-3217"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20234130001",
"Comment": "yandex-browser-stable is earlier than 0:23.5.1.793-alt1"
}
]
}
]
}
}
]
}

34
oval/c10f1/ALT-PU-2023-4130/objects.json
View File

@ -1,34 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20234130001",
"Version": "1",
"comment": "yandex-browser-stable is installed",
"Name": "yandex-browser-stable"
}
]
}

23
oval/c10f1/ALT-PU-2023-4130/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20234130001",
"Version": "1",
"Comment": "package EVR is earlier than 0:23.5.1.793-alt1",
"Arch": {},
"Evr": {
"Text": "0:23.5.1.793-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

30
oval/c10f1/ALT-PU-2023-4130/tests.json
View File

@ -1,30 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20234130001",
"Version": "1",
"Check": "all",
"Comment": "yandex-browser-stable is earlier than 0:23.5.1.793-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234130001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234130001"
}
}
]
}

101
oval/c10f1/ALT-PU-2023-4147/definitions.json
View File

@ -1,101 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20234147",
"Version": "oval:org.altlinux.errata:def:20234147",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-4147: package `php8.1` update to version 8.1.20-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-4147",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-4147",
"Source": "ALTPU"
},
{
"RefID": "CVE-2023-3247",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-3247",
"Source": "CVE"
}
],
"Description": "This update upgrades php8.1 to version 8.1.20-alt1. \nSecurity Fix(es):\n\n * CVE-2023-3247: In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce. \n\n",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-06-30"
},
"Updated": {
"Date": "2023-06-30"
},
"bdu": null,
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"Cwe": "CWE-330",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-3247",
"Impact": "Low",
"Public": "20230722",
"CveID": "CVE-2023-3247"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20234147001",
"Comment": "php8.1 is earlier than 0:8.1.20-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234147002",
"Comment": "php8.1-devel is earlier than 0:8.1.20-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234147003",
"Comment": "php8.1-libs is earlier than 0:8.1.20-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234147004",
"Comment": "php8.1-mysqlnd is earlier than 0:8.1.20-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20234147005",
"Comment": "rpm-build-php8.1-version is earlier than 0:8.1.20-alt1"
}
]
}
]
}
}
]
}

58
oval/c10f1/ALT-PU-2023-4147/objects.json
View File

@ -1,58 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20234147001",
"Version": "1",
"comment": "php8.1 is installed",
"Name": "php8.1"
},
{
"ID": "oval:org.altlinux.errata:obj:20234147002",
"Version": "1",
"comment": "php8.1-devel is installed",
"Name": "php8.1-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20234147003",
"Version": "1",
"comment": "php8.1-libs is installed",
"Name": "php8.1-libs"
},
{
"ID": "oval:org.altlinux.errata:obj:20234147004",
"Version": "1",
"comment": "php8.1-mysqlnd is installed",
"Name": "php8.1-mysqlnd"
},
{
"ID": "oval:org.altlinux.errata:obj:20234147005",
"Version": "1",
"comment": "rpm-build-php8.1-version is installed",
"Name": "rpm-build-php8.1-version"
}
]
}

23
oval/c10f1/ALT-PU-2023-4147/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20234147001",
"Version": "1",
"Comment": "package EVR is earlier than 0:8.1.20-alt1",
"Arch": {},
"Evr": {
"Text": "0:8.1.20-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

78
oval/c10f1/ALT-PU-2023-4147/tests.json
View File

@ -1,78 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20234147001",
"Version": "1",
"Check": "all",
"Comment": "php8.1 is earlier than 0:8.1.20-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234147001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234147001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234147002",
"Version": "1",
"Check": "all",
"Comment": "php8.1-devel is earlier than 0:8.1.20-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234147002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234147001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234147003",
"Version": "1",
"Check": "all",
"Comment": "php8.1-libs is earlier than 0:8.1.20-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234147003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234147001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234147004",
"Version": "1",
"Check": "all",
"Comment": "php8.1-mysqlnd is earlier than 0:8.1.20-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234147004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234147001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20234147005",
"Version": "1",
"Check": "all",
"Comment": "rpm-build-php8.1-version is earlier than 0:8.1.20-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234147005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234147001"
}
}
]
}

129
oval/c10f1/ALT-PU-2023-4153/definitions.json
View File

@ -1,129 +0,0 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20234153",
"Version": "oval:org.altlinux.errata:def:20234153",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-4153: package `redis` update to version 6.2.8-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-4153",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-4153",
"Source": "ALTPU"
},
{
"RefID": "BDU:2022-02940",
"RefURL": "https://bdu.fstec.ru/vul/2022-02940",
"Source": "BDU"
},
{
"RefID": "BDU:2022-02945",
"RefURL": "https://bdu.fstec.ru/vul/2022-02945",
"Source": "BDU"
},
{
"RefID": "CVE-2022-24735",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-24735",
"Source": "CVE"
},
{
"RefID": "CVE-2022-24736",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-24736",
"Source": "CVE"
}
],
"Description": "This update upgrades redis to version 6.2.8-alt1. \nSecurity Fix(es):\n\n * BDU:2022-02940: Уязвимость системы управления базами данных Redis, связанная с ошибками разыменования указателей, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2022-02945: Уязвимость системы управления базами данных Redis, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2022-24735: Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the (potentially higher) privileges of another Redis user. The Lua script execution environment in Redis provides some measures that prevent a script from creating side effects that persist and can affect the execution of the same, or different script, at a later time. Several weaknesses of these measures have been publicly known for a long time, but they had no security impact as the Redis security model did not endorse the concept of users or privileges. With the introduction of ACLs in Redis 6.0, these weaknesses can be exploited by a less privileged users to inject Lua code that will execute at a later time, when a privileged user executes a Lua script. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.\n\n * CVE-2022-24736: Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and 6.2.7. An additional workaround to mitigate this problem without patching the redis-server executable, if Lua scripting is not being used, is to block access to `SCRIPT LOAD` and `EVAL` commands using ACL rules.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-07-07"
},
"Updated": {
"Date": "2023-07-07"
},
"bdu": [
{
"Cvss": "AV:L/AC:L/Au:S/C:N/I:N/A:P",
"Cvss3": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"Cwe": "CWE-476",
"Href": "https://bdu.fstec.ru/vul/2022-02940",
"Impact": "Low",
"Public": "20220427",
"CveID": "BDU:2022-02940"
},
{
"Cvss": "AV:L/AC:L/Au:S/C:P/I:P/A:N",
"Cvss3": "AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"Cwe": "CWE-74, CWE-94",
"Href": "https://bdu.fstec.ru/vul/2022-02945",
"Impact": "Low",
"Public": "20220210",
"CveID": "BDU:2022-02945"
}
],
"Cves": [
{
"Cvss": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"Cwe": "CWE-94",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-24735",
"Impact": "High",
"Public": "20220427",
"CveID": "CVE-2022-24735"
},
{
"Cvss": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"Cwe": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-24736",
"Impact": "Low",
"Public": "20220427",
"CveID": "CVE-2022-24736"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20234153001",
"Comment": "redis is earlier than 0:6.2.8-alt1"
}
]
}
]
}
}
]
}

34
oval/c10f1/ALT-PU-2023-4153/objects.json
View File

@ -1,34 +0,0 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20234153001",
"Version": "1",
"comment": "redis is installed",
"Name": "redis"
}
]
}

23
oval/c10f1/ALT-PU-2023-4153/states.json
View File

@ -1,23 +0,0 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20234153001",
"Version": "1",
"Comment": "package EVR is earlier than 0:6.2.8-alt1",
"Arch": {},
"Evr": {
"Text": "0:6.2.8-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

30
oval/c10f1/ALT-PU-2023-4153/tests.json
View File

@ -1,30 +0,0 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20234153001",
"Version": "1",
"Check": "all",
"Comment": "redis is earlier than 0:6.2.8-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20234153001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20234153001"
}
}
]
}

Some files were not shown because too many files have changed in this diff Show More