ALT-PU-2017-2110

Критический

ALT-PU-2017-2110: package tcsh update to version 6.20.00-alt2

Источник

errata.altlinux.org

Дата публикации

24.08.2017

Дата обновления

24.08.2017

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades tcsh to version 6.20.00-alt2.

Устраненные уязвимости1

CVE-2017-5226

Критический 10

Дата публикации: 29.03.2017

CWE-20

When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

CVSS 3.0

Критический 10

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Высокий 7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Ссылки

CVE-2017-5226 https://nvd.nist.gov/vuln/detail/CVE-2017-5226

Ссылки1

ALT-PU-2017-2110 https://errata.altlinux.org/ALT-PU-2017-2110

Связанные уязвимости

CVE-2017-5226

CVSS3: 10

ubuntu

больше 9 лет назад

CVE-2017-5226

CVSS3: 10

nvd

больше 9 лет назад

CVE-2017-5226

CVSS3: 10

debian

больше 9 лет назад

When executing a program via the bubblewrap sandbox, the nonpriv sessi ...

GHSA-m28g-vfcm-85ff

CVSS3: 10

github

больше 4 лет назад

ALT-PU-2017-1099

CVSS3: 10

altlinux

почти 10 лет назад

ALT-PU-2017-1099: package `bubblewrap` update to version 0.1.6-alt1