ALT-PU-2019-1414

Высокий

ALT-PU-2019-1414: package nextcloud update to version 15.0.5-alt1

Источник

errata.altlinux.org

Дата публикации

13.03.2019

Дата обновления

13.03.2019

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades nextcloud to version 15.0.5-alt1.

Устраненные уязвимости6

CVE-2018-16464

Средний 5.7

Дата публикации: 30.10.2018

CWE-287

A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.

CVSS 3.0

Средний 5.7

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS 2.0

Низкий 3.5

AV:N/AC:M/Au:S/C:P/I:N/A:N

Access vector: Network
Complexity: Medium
Authentication: Single
Confidentiality: Partial
Integrity: None
Availability: None

Ссылки

CVE-2018-16464 https://nvd.nist.gov/vuln/detail/CVE-2018-16464

Ссылки1

ALT-PU-2019-1414 https://errata.altlinux.org/ALT-PU-2019-1414

Связанные уязвимости

CVE-2018-16464

CVSS3: 5.7

nvd

около 8 лет назад

A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.

CVE-2018-16464

CVSS3: 5.7

debian

около 8 лет назад

A missing access check in Nextcloud Server prior to 14.0.0 could lead ...

GHSA-j92w-qfjr-c5j9

CVSS3: 5.7

github

больше 4 лет назад

A missing access check in Nextcloud Server prior to 14.0.0 could lead to continued access to password protected link shares when the owner had changed the password.

CVE-2018-16465

CVSS3: 5.3

nvd

около 8 лет назад

Missing state in Nextcloud Server prior to 14.0.0 would not enforce the use of a second factor at login if the the provider of the second factor failed to load.

CVE-2018-16465

CVSS3: 5.3

debian

около 8 лет назад

Missing state in Nextcloud Server prior to 14.0.0 would not enforce th ...