ALSA-2020:4451
Vulnerability from osv_almalinux – Published: 2020-11-03 12:05 – Updated: 2021-11-12 10:20 – Source website
VLAI
Summary
Moderate: GNOME security, bug fix, and enhancement update
Details
GNOME is the default desktop environment of AlmaLinux.
The following packages have been upgraded to a later upstream version: gnome-remote-desktop (0.1.8), pipewire (0.3.6), vte291 (0.52.4), webkit2gtk3 (2.28.4), xdg-desktop-portal (1.6.0), xdg-desktop-portal-gtk (1.6.0). (BZ#1775345, BZ#1779691, BZ#1817143, BZ#1832347, BZ#1837406)
Security Fix(es):
-
webkitgtk: Multiple security issues (CVE-2019-8625, CVE-2019-8710, CVE-2019-8720, CVE-2019-8743, CVE-2019-8764, CVE-2019-8766, CVE-2019-8769, CVE-2019-8771, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8813, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8823, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846, CVE-2020-3862, CVE-2020-3864, CVE-2020-3865, CVE-2020-3867, CVE-2020-3868, CVE-2020-3885, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-9802, CVE-2020-9803, CVE-2020-9805, CVE-2020-9806, CVE-2020-9807, CVE-2020-9843, CVE-2020-9850, CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925, CVE-2020-10018, CVE-2020-11793)
-
gnome-settings-daemon: AlmaLinux Customer Portal password logged and passed as command line argument when user registers through GNOME control center (CVE-2020-14391)
-
LibRaw: lack of thumbnail size range check can lead to buffer overflow (CVE-2020-15503)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
References
{
"affected": [
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "LibRaw-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.19.5-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "PackageKit"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.12-6.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "PackageKit-command-not-found"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.12-6.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "PackageKit-cron"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.12-6.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "PackageKit-glib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.12-6.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "PackageKit-glib-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.12-6.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "PackageKit-gstreamer-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.12-6.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "PackageKit-gtk3-module"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.12-6.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "dleyna-renderer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.0-3.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "frei0r-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-7.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "frei0r-plugins"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-7.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "frei0r-plugins-opencv"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.1-7.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "gnome-remote-desktop"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.8-3.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "gtk-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "gvfs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.36.2-10.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libsoup"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.62.3-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "libsoup-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.62.3-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "mutter-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.32.2-48.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "nautilus"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.28.1-14.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "nautilus-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.28.1-14.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pipewire"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.6-1.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pipewire-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.6-1.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pipewire-doc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.6-1.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pipewire-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.6-1.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pipewire-utils"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.6-1.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pipewire0.2-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.7-6.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pipewire0.2-libs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.7-6.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "potrace"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15-3.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "pygobject3-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.28.3-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "python3-gobject"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.28.3-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "python3-gobject-base"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.28.3-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "tracker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.5-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "tracker-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.5-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "vte-profile"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.52.4-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "vte291"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.52.4-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "vte291-devel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.52.4-2.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "webrtc-audio-processing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3-9.el8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "AlmaLinux:8",
"name": "xdg-desktop-portal-gtk"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.0-1.el8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"details": "GNOME is the default desktop environment of AlmaLinux.\n\nThe following packages have been upgraded to a later upstream version: gnome-remote-desktop (0.1.8), pipewire (0.3.6), vte291 (0.52.4), webkit2gtk3 (2.28.4), xdg-desktop-portal (1.6.0), xdg-desktop-portal-gtk (1.6.0). (BZ#1775345, BZ#1779691, BZ#1817143, BZ#1832347, BZ#1837406)\n\nSecurity Fix(es):\n\n* webkitgtk: Multiple security issues (CVE-2019-8625, CVE-2019-8710, CVE-2019-8720, CVE-2019-8743, CVE-2019-8764, CVE-2019-8766, CVE-2019-8769, CVE-2019-8771, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8813, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8823, CVE-2019-8835, CVE-2019-8844, CVE-2019-8846, CVE-2020-3862, CVE-2020-3864, CVE-2020-3865, CVE-2020-3867, CVE-2020-3868, CVE-2020-3885, CVE-2020-3894, CVE-2020-3895, CVE-2020-3897, CVE-2020-3899, CVE-2020-3900, CVE-2020-3901, CVE-2020-3902, CVE-2020-9802, CVE-2020-9803, CVE-2020-9805, CVE-2020-9806, CVE-2020-9807, CVE-2020-9843, CVE-2020-9850, CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925, CVE-2020-10018, CVE-2020-11793)\n\n* gnome-settings-daemon: AlmaLinux Customer Portal password logged and passed as command line argument when user registers through GNOME control center (CVE-2020-14391)\n\n* LibRaw: lack of thumbnail size range check can lead to buffer overflow (CVE-2020-15503)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.",
"id": "ALSA-2020:4451",
"modified": "2021-11-12T10:20:56Z",
"published": "2020-11-03T12:05:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.almalinux.org/8/ALSA-2020-4451.html"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8625"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8710"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8720"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8743"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8764"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8766"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8769"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8771"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8782"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8783"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8808"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8811"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8812"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8813"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8814"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8815"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8816"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8819"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8820"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8823"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8835"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8844"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2019-8846"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-10018"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-11793"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-14391"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-15503"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3862"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3864"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3865"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3867"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3868"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3885"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3894"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3895"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3897"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3899"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3900"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3901"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-3902"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9802"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9803"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9805"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9806"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9807"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9843"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9850"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9862"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9893"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9894"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9895"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9915"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9925"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2020-9952"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2021-30666"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2021-30761"
},
{
"type": "REPORT",
"url": "https://vulners.com/cve/CVE-2021-30762"
}
],
"related": [
"CVE-2019-8625",
"CVE-2019-8710",
"CVE-2019-8720",
"CVE-2019-8743",
"CVE-2019-8764",
"CVE-2019-8766",
"CVE-2019-8769",
"CVE-2019-8771",
"CVE-2019-8782",
"CVE-2019-8783",
"CVE-2019-8808",
"CVE-2019-8811",
"CVE-2019-8812",
"CVE-2019-8813",
"CVE-2019-8814",
"CVE-2019-8815",
"CVE-2019-8816",
"CVE-2019-8819",
"CVE-2019-8820",
"CVE-2019-8823",
"CVE-2019-8835",
"CVE-2019-8844",
"CVE-2019-8846",
"CVE-2020-3862",
"CVE-2020-3864",
"CVE-2020-3865",
"CVE-2020-3867",
"CVE-2020-3868",
"CVE-2020-3885",
"CVE-2020-3894",
"CVE-2020-3895",
"CVE-2020-3897",
"CVE-2020-3899",
"CVE-2020-3900",
"CVE-2020-3901",
"CVE-2020-3902",
"CVE-2020-9802",
"CVE-2020-9803",
"CVE-2020-9805",
"CVE-2020-9806",
"CVE-2020-9807",
"CVE-2020-9843",
"CVE-2020-9850",
"CVE-2020-9862",
"CVE-2020-9893",
"CVE-2020-9894",
"CVE-2020-9895",
"CVE-2020-9915",
"CVE-2020-9925",
"CVE-2020-10018",
"CVE-2020-11793",
"CVE-2020-14391",
"CVE-2020-15503"
],
"summary": "Moderate: GNOME security, bug fix, and enhancement update"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…