vuln-list-alt/oval/c10f1/ALT-PU-2020-1409/definitions.json
2024-06-28 13:17:52 +00:00

117 lines
4.2 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20201409",
"Version": "oval:org.altlinux.errata:def:20201409",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2020-1409: package `flac` update to version 1.3.3-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2020-1409",
"RefURL": "https://errata.altlinux.org/ALT-PU-2020-1409",
"Source": "ALTPU"
},
{
"RefID": "BDU:2021-03353",
"RefURL": "https://bdu.fstec.ru/vul/2021-03353",
"Source": "BDU"
},
{
"RefID": "CVE-2017-6888",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-6888",
"Source": "CVE"
}
],
"Description": "This update upgrades flac to version 1.3.3-alt1. \nSecurity Fix(es):\n\n * BDU:2021-03353: Уязвимость функции read_metadata_vorbiscomment_() компонента src/libFLAC/stream_decoder.c аудиокодека FLAC, связанная с отсутствием освобождения ресурса после истечения действительного срока его эксплуатирования, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2017-6888: An error in the \"read_metadata_vorbiscomment_()\" function (src/libFLAC/stream_decoder.c) in FLAC version 1.3.2 can be exploited to cause a memory leak via a specially crafted FLAC file.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2020-02-28"
},
"Updated": {
"Date": "2020-02-28"
},
"BDUs": [
{
"ID": "BDU:2021-03353",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"CWE": "CWE-772",
"Href": "https://bdu.fstec.ru/vul/2021-03353",
"Impact": "Low",
"Public": "20170314"
}
],
"CVEs": [
{
"ID": "CVE-2017-6888",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"CWE": "CWE-772",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-6888",
"Impact": "Low",
"Public": "20180425"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20201409001",
"Comment": "flac is earlier than 0:1.3.3-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201409002",
"Comment": "libflac++-devel is earlier than 0:1.3.3-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201409003",
"Comment": "libflac++6 is earlier than 0:1.3.3-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201409004",
"Comment": "libflac-devel is earlier than 0:1.3.3-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201409005",
"Comment": "libflac8 is earlier than 0:1.3.3-alt1"
}
]
}
]
}
}
]
}