Security fix for the ALT Linux 9 package glpi version 9.5.8-alt1

9.5.8-alt1 built July 11, 2022 Pavel Zilke in task 303295 July 4, 2022 Pavel Zilke - New version 9.5.8 - This is a security release, upgrading is recommended - Security fixes: + CVE-2022-31061 : SQL injection on login page + CVE-2022-24868 : XSS / open redirect via SVG file upload + CVE-2022-2486...

Security fix for the ALT Linux 10 package openssl1.1 version 1.1.1q-alt1

1.1.1q-alt1 built July 8, 2022 Gleb Fotengauer-Malinovskiy in task 303207 July 5, 2022 Gleb Fotengauer-Malinovskiy - Updated to 1.1.1q fixes CVE-2022-2068...

ALPINE-CVE-2022-32207

When curl 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the...

AZL-10103 CVE-2022-32207 affecting package curl for versions less than 7.84.0-1

When curl 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the...

Security fix for the ALT Linux 10 package glpi version 9.5.8-alt1

9.5.8-alt1 built July 7, 2022 Pavel Zilke in task 303183 July 4, 2022 Pavel Zilke - New version 9.5.8 - This is a security release, upgrading is recommended - Security fixes: + CVE-2022-31061 : SQL injection on login page + CVE-2022-24868 : XSS / open redirect via SVG file upload + CVE-2022-24869...

CVE-2022-32207

CVE-2022-32207 affects curl: when saving cookies, alt-svc and HSTS data, the final rename can widen target file permissions, exposing updates to more users. Affected versions are curl before 7.84.0; remediation is to upgrade to 7.84.0 or newer (as indicated by multiple advisories).

Security fix for the ALT Linux 10 package mysql-connector-odbc version 8.0.29-alt1

8.0.29-alt1 built July 6, 2022 Nikolai Kostrigin in task 303150 --- May 12, 2022 Nikolai Kostrigin - New version fixes: CVE-2022-0778...

Security fix for the ALT Linux 10 package MySQL version 8.0.29-alt1

8.0.29-alt1 built July 5, 2022 Nikolai Kostrigin in task 302902 --- June 30, 2022 Nikolai Kostrigin - new version + fixes: CVE-2021-22570, CVE-2022-0778, CVE-2022-21454, CVE-2022-21457 + fixes: CVE-2022-21425, CVE-2022-21440, CVE-2022-21459, CVE-2022-21478 + fixes: CVE-2022-21479, CVE-2022-21418,...

Security fix for the ALT Linux 9 package openssl1.1 version 1.1.1q-alt1

July 5, 2022 Gleb Fotengauer-Malinovskiy 1.1.1q-alt1 - Updated to 1.1.1q fixes CVE-2022-2068...

Security fix for the ALT Linux 10 package firefox-esr version 91.11.0-alt1

June 29, 2022 Pavel Vasenkov 91.11.0-alt1 - New ESR version. - Security fixes: + CVE-2022-34479 A popup window could be resized in a way to overlay the address bar with web content + CVE-2022-34470 Use-after-free in nsSHistory + CVE-2022-34468 CSP sandbox header without allow-scripts can be...

Security fix for the ALT Linux 10 package thunderbird version 102.0-alt1

June 29, 2022 Pavel Vasenkov 102.0-alt1 - New version. - Security fixes: + CVE-2022-34479 A popup window could be resized in a way to overlay the address bar with web content + CVE-2022-34470 Use-after-free in nsSHistory + CVE-2022-34468 CSP sandbox header without allow-scripts can be bypassed vi...

Non-preserved file permissions

When curl saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target filename. In that rename operation, it might accidentally widen the permissions for the target file, leaving the updated...

PT-2022-5939

Name of the Vulnerable Software and Affected Versions curl versions prior to 7.84.0 Description The issue is related to how curl saves cookies, alt-svc, and hsts data to local files. When curl performs this operation, it uses a temporary file that is later renamed to the final target filename...

CVE-2022-32207

When curl 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final target file name.In that rename operation, it might accidentally widen the permissions for the target file, leaving the...

Security fix for the ALT Linux 10 package openssl1.1 version 1.1.1p-alt1

1.1.1p-alt1 built June 24, 2022 Gleb Fotengauer-Malinovskiy in task 302511 June 22, 2022 Gleb Fotengauer-Malinovskiy - Updated to 1.1.1p fixes CVE-2022-1292, CVE-2022-2068...

Security fix for the ALT Linux 10 package libexo version 4.16.4-alt1

4.16.4-alt1 built June 24, 2022 Mikhail Efremov in task 302058 --- June 14, 2022 Mikhail Efremov - Updated to 4.16.4 fixes: CVE-2022-32278...

Jenkins 跨站脚本漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins suffers from a cross-site scripting vulnerability that stems from the title attribute and alt attribute not being...

Security fix for the ALT Linux 10 package openscad version 2021.01-alt4

2021.01-alt4 built June 23, 2022 Anton Midyukov in task 302498 --- June 20, 2022 Anton Midyukov - Fixes: + CVE-2022-0496 Out-of-bounds memory access in DXF loader path identification + CVE-2022-0497 Out-of-bounds memory access in comment parser + Fix build issue with overloaded join. - cleanup sp...

Security fix for the ALT Linux 10 package git version 2.33.4-alt1

June 23, 2022 Dmitry V. Levin 2.33.4-alt1 - 2.33.3 - 2.33.4 fixes: CVE-2022-29187...

Security fix for the ALT Linux 10 package php8.1 version 8.1.7-alt1

8.1.7-alt1 built June 22, 2022 Anton Farygin in task 302231 June 16, 2022 Anton Farygin - 8.1.6 - 8.1.7 Fixes: CVE-2022-31626, CVE-2022-31625...