USN-5462-1 fixed several vulnerabilities in Ruby. This update provides
the corresponding CVE-2022-28739 update for ruby2.3 on Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that Ruby incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
BI Launchpad and CMC in SAP Business Objects Business Intelligence Platform, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. Exploit is possible only when the bttoken in victim’s session is active.
libtiff-4.4.0-1.fc34
https://gitlab.com/libtiff/libtiff/-/blob/master/ChangeLog
Fixed CVEs:
CVE-2022-1354
CVE-2022-1355
CVE-2022-1622
CVE-2022-1623
It was discovered that Ruby incorrectly handled certain regular expressions.
An attacker could possibly use this issue to execute arbitrary code. This
issue only affected Ubuntu 22.04 LTS. (2022-28738)
It was discovered that Ruby incorrectly handled certain inputs.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2022-28739)
It was discovered that FreeRDP incorrectly handled empty password values. A
remote attacker could use this issue to bypass server authentication. This
issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10.
(CVE-2022-24882)
It was discovered that FreeRDP incorrectly handled server configurations
with an invalid SAM file path. A remote attacker could use this issue to
bypass server authentication. (CVE-2022-24883)
It was discovered that Vim was incorrectly processing Vim buffers.
An attacker could possibly use this issue to perform illegal memory
access and expose sensitive information. (CVE-2022-0554)
It was discovered that Vim was not properly performing bounds checks
for column numbers when replacing tabs with spaces or spaces with
tabs, which could cause a heap buffer overflow. An attacker could
possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2022-0572)
It was discovered that Vim was not properly performing validation of
data that contained special multi-byte characters, which could cause
an out-of-bounds read. An attacker could possibly use this issue to
cause a denial of service. (CVE-2022-0685)
It was discovered that Vim was incorrectly processing data used to
define indentation in a file, which could cause a heap buffer
overflow. An attacker could possibly use this issue to cause a denial
of service. (CVE-2022-0714)
It was discovered that Vim was incorrectly processing certain regular
expression patterns and strings, which could cause an out-of-bounds
read. An attacker could possibly use this issue to cause a denial of
service. (CVE-2022-0729)
It was discovered that Vim was not properly performing bounds checks
when executing spell suggestion commands, which could cause a heap
buffer overflow. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2022-0943)
It was discovered that Vim was incorrectly performing bounds checks
when processing invalid commands with composing characters in Ex
mode, which could cause a buffer overflow. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary
code. (CVE-2022-1616)
It was discovered that Vim was not properly processing latin1 data
when issuing Ex commands, which could cause a heap buffer overflow.
An attacker could possibly use this issue to cause a denial of
service or execute arbitrary code. (CVE-2022-1619)
It was discovered that Vim was not properly performing memory
management when dealing with invalid regular expression patterns in
buffers, which could cause a NULL pointer dereference. An attacker
could possibly use this issue to cause a denial of service.
(CVE-2022-1620)
It was discovered that Vim was not properly processing invalid bytes
when performing spell check operations, which could cause a heap
buffer overflow. An attacker could possibly use this issue to cause a
denial of service or execute arbitrary code. (CVE-2022-1621)
libtiff-4.4.0-1.fc36
https://gitlab.com/libtiff/libtiff/-/blob/master/ChangeLog
Fixed CVEs:
CVE-2022-1354
CVE-2022-1355
CVE-2022-1622
CVE-2022-1623
libtiff-4.4.0-1.fc35
https://gitlab.com/libtiff/libtiff/-/blob/master/ChangeLog
Fixed CVEs:
CVE-2022-1354
CVE-2022-1355
CVE-2022-1622
CVE-2022-1623
containerd-1.6.6-1.fc35
golang-github-containerd-cni-1.1.6-1.fc35
golang-github-containernetworking-cni-1.1.1-1.fc35
golang-x-sys-0-23.20220604gitbc2c85a.fc35
golang-x-sys: Bump to commit bc2c85ada10aa9b6aa9607e9ac9ad0761b95cf1d
golang-github-containernetworking-cni: Update to 1.1.1.
golang-github-containerd-cni: Update to 1.1.6. Fixes rhbz#2092632.
containerd: Update to 1.6.6. Mitigates GHSA-5ffw-gxpp-mxpf / CVE-2022-31030.
containerd-1.6.6-1.fc36
golang-github-containerd-cni-1.1.6-1.fc36
golang-github-containernetworking-cni-1.1.1-1.fc36
golang-x-sys-0-23.20220604gitbc2c85a.fc36
golang-x-sys: Bump to commit bc2c85ada10aa9b6aa9607e9ac9ad0761b95cf1d
golang-github-containernetworking-cni: Update to 1.1.1.
golang-github-containerd-cni: Update to 1.1.6. Fixes rhbz#2092632.
containerd: Update to 1.6.6. Mitigates GHSA-5ffw-gxpp-mxpf / CVE-2022-31030.
