pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
2b8a3f79c7
vuln-list-alt/oval/c9f2/ALT-PU-2021-3645/definitions.json
pepelyaevip 0707cb759b ALT Vulnerability
2024-04-16 14:26:14 +00:00

228 lines
11 KiB
JSON
Raw Blame History

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20213645",
"Version": "oval:org.altlinux.errata:def:20213645",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2021-3645: package `php7` update to version 7.4.27-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c9f2"
],
"Products": [
"ALT SPWorkstation",
"ALT SPServer"
]
}
],
"References": [
{
"RefID": "ALT-PU-2021-3645",
"RefURL": "https://errata.altlinux.org/ALT-PU-2021-3645",
"Source": "ALTPU"
},
{
"RefID": "BDU:2017-01814",
"RefURL": "https://bdu.fstec.ru/vul/2017-01814",
"Source": "BDU"
},
{
"RefID": "BDU:2021-03159",
"RefURL": "https://bdu.fstec.ru/vul/2021-03159",
"Source": "BDU"
},
{
"RefID": "BDU:2021-05228",
"RefURL": "https://bdu.fstec.ru/vul/2021-05228",
"Source": "BDU"
},
{
"RefID": "BDU:2021-06176",
"RefURL": "https://bdu.fstec.ru/vul/2021-06176",
"Source": "BDU"
},
{
"RefID": "BDU:2022-02394",
"RefURL": "https://bdu.fstec.ru/vul/2022-02394",
"Source": "BDU"
},
{
"RefID": "CVE-2017-8923",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-8923",
"Source": "CVE"
},
{
"RefID": "CVE-2021-21702",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-21702",
"Source": "CVE"
},
{
"RefID": "CVE-2021-21703",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-21703",
"Source": "CVE"
},
{
"RefID": "CVE-2021-21706",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-21706",
"Source": "CVE"
},
{
"RefID": "CVE-2021-21707",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-21707",
"Source": "CVE"
}
],
"Description": "This update upgrades php7 to version 7.4.27-alt1. \nSecurity Fix(es):\n\n * BDU:2017-01814: Уязвимость функции zend_string_extend интерпретатора PHP, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие\n\n * BDU:2021-03159: Уязвимость расширения SOAP интерпретатора PHP, позволяющая нарушителю вызвать аварийное завершение работы приложения\n\n * BDU:2021-05228: Уязвимость компонента SAPI расширения PHP-FPM интерпретатора языка программирования PHP, позволяющая нарушителю повысить свои привилегии до root\n\n * BDU:2021-06176: Уязвимость функции ZipArchive::extractTo интерпретатора PHP, позволяющая нарушителю создать или перезаписать файлы\n\n * BDU:2022-02394: Уязвимость функции simplexml_load_file() интерпретатора PHP , позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * CVE-2017-8923: The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.\n\n * CVE-2021-21702: In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.\n\n * CVE-2021-21703: In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root user.\n\n * CVE-2021-21706: In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.\n\n * CVE-2021-21707: In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2021-12-29"
},
"Updated": {
"Date": "2021-12-29"
},
"BDUs": [
{
"ID": "BDU:2017-01814",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"CWE": "CWE-20",
"Href": "https://bdu.fstec.ru/vul/2017-01814",
"Impact": "High",
"Public": "20170512"
},
{
"ID": "BDU:2021-03159",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://bdu.fstec.ru/vul/2021-03159",
"Impact": "High",
"Public": "20210214"
},
{
"ID": "BDU:2021-05228",
"CVSS": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-284, CWE-787",
"Href": "https://bdu.fstec.ru/vul/2021-05228",
"Impact": "High",
"Public": "20211025"
},
{
"ID": "BDU:2021-06176",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:C/A:N",
"CVSS3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"CWE": "CWE-22, CWE-24",
"Href": "https://bdu.fstec.ru/vul/2021-06176",
"Impact": "Low",
"Public": "20210906"
},
{
"ID": "BDU:2022-02394",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"CWE": "CWE-20, CWE-159",
"Href": "https://bdu.fstec.ru/vul/2022-02394",
"Impact": "Low",
"Public": "20211129"
}
],
"CVEs": [
{
"ID": "CVE-2017-8923",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-8923",
"Impact": "Critical",
"Public": "20170512"
},
{
"ID": "CVE-2021-21702",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21702",
"Impact": "High",
"Public": "20210215"
},
{
"ID": "CVE-2021-21703",
"CVSS": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"CVSS3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21703",
"Impact": "High",
"Public": "20211025"
},
{
"ID": "CVE-2021-21706",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"CWE": "CWE-22",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21706",
"Impact": "Low",
"Public": "20211004"
},
{
"ID": "CVE-2021-21707",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"CWE": "NVD-CWE-Other",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-21707",
"Impact": "Low",
"Public": "20211129"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:8.4",
"cpe:/o:alt:spserver:8.4"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:3001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20213645001",
"Comment": "php7 is earlier than 0:7.4.27-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20213645002",
"Comment": "php7-devel is earlier than 0:7.4.27-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20213645003",
"Comment": "php7-libs is earlier than 0:7.4.27-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20213645004",
"Comment": "php7-mysqlnd is earlier than 0:7.4.27-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20213645005",
"Comment": "rpm-build-php7-version is earlier than 0:7.4.27-alt1"
}
]
}
]
}
}
]
}
Reference in New Issue View Git Blame Copy Permalink