ALT-PU-2017-1099

Критический

ALT-PU-2017-1099: package bubblewrap update to version 0.1.6-alt1

Источник

errata.altlinux.org

Дата публикации

29.01.2017

Дата обновления

29.01.2017

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades bubblewrap to version 0.1.6-alt1.

Устраненные уязвимости1

CVE-2017-5226

Критический 10

Дата публикации: 29.03.2017

CWE-20

When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

CVSS 3.0

Критический 10

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Высокий 7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Ссылки

CVE-2017-5226 https://nvd.nist.gov/vuln/detail/CVE-2017-5226

Ссылки1

ALT-PU-2017-1099 https://errata.altlinux.org/ALT-PU-2017-1099

Связанные уязвимости

CVE-2017-5226

CVSS3: 10

ubuntu

больше 9 лет назад

CVE-2017-5226

CVSS3: 10

nvd

больше 9 лет назад

CVE-2017-5226

CVSS3: 10

debian

больше 9 лет назад

When executing a program via the bubblewrap sandbox, the nonpriv sessi ...

GHSA-m28g-vfcm-85ff

CVSS3: 10

github

больше 4 лет назад

ALT-PU-2017-2110

CVSS3: 10

altlinux

около 9 лет назад

ALT-PU-2017-2110: package `tcsh` update to version 6.20.00-alt2