aports issueshttps://gitlab.alpinelinux.org/alpine/aports/-/issues2019-07-23T11:33:00Zhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8761/etc/machine-id not available for some programs that need it2019-07-23T11:33:00Zalgitbot/etc/machine-id not available for some programs that need itReproduction 1
- fresh alpine install
- apk add transmission
- run transmission-gtk
=
process 5699: D-Bus library appears to be incorrectly set up; failed to read machine uuid: Failed to open "/etc/machine-id": No such file or di...Reproduction 1
- fresh alpine install
- apk add transmission
- run transmission-gtk
=
process 5699: D-Bus library appears to be incorrectly set up; failed to read machine uuid: Failed to open "/etc/machine-id": No such file or directory
See the manual page for dbus-uuidgen to correct this issue.
=
Reproduction 2
- fresh alpine install
- apk add gnumeric
- run gnumeric
=
process 5722: D-Bus library appears to be incorrectly set up; failed to read machine uuid: Failed to open "/etc/machine-id": No such file or directory
See the manual page for dbus-uuidgen to correct this issue.
=
Reproduction 3
- fresh alpine install
- apk add gnumeric
- run gnumeric
=
process 5732: D-Bus library appears to be incorrectly set up; failed to read machine uuid: Failed to open "/etc/machine-id": No such file or directory
See the manual page for dbus-uuidgen to correct this issue.
=
The user can’t run many programs because of this bug.
Not good.
*(from redmine: issue id 8761, created on 2018-04-03, closed on 2018-08-22)*3.8.1https://gitlab.alpinelinux.org/alpine/aports/-/issues/8580[3.8] mupdf: Multiple vulnerabilities (CVE-2018-6187, CVE-2018-6192, CVE-2018...2019-07-23T11:35:16ZAlicha CH[3.8] mupdf: Multiple vulnerabilities (CVE-2018-6187, CVE-2018-6192, CVE-2018-6544, CVE-2018-1000051)CVE-2018-6187: heap-based buffer overflow in pdf/pdf-write.c:do\_pdf\_save\_document()
--------------------------------------------------------------------------------------
In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow...CVE-2018-6187: heap-based buffer overflow in pdf/pdf-write.c:do\_pdf\_save\_document()
--------------------------------------------------------------------------------------
In Artifex MuPDF 1.12.0, there is a heap-based buffer overflow
vulnerability in the do\_pdf\_save\_document function in the
pdf/pdf-write.c file. Remote attackers could leverage the vulnerability
to cause a denial of service via a crafted pdf file.
### References:
https://nvd.nist.gov/vuln/detail/CVE-2018-6187
https://bugs.ghostscript.com/show\_bug.cgi?id=698908
CVE-2018-6192: Segment violation in pdf\_read\_new\_xref function in pdf/pdf-xref.c
-----------------------------------------------------------------------------------
In Artifex MuPDF 1.12.0, the pdf\_read\_new\_xref function in
pdf/pdf-xref.c allows remote attackers to cause
a denial of service (segmentation violation and application crash) via a
crafted pdf file.
### References:
https://nvd.nist.gov/vuln/detail/CVE-2018-6192
https://bugs.ghostscript.com/show\_bug.cgi?id=698916
CVE-2018-6544: denial of service (DoS) via a crafted PDF document
-----------------------------------------------------------------
pdf\_load\_obj\_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could
reference the object stream recursively and therefore
run out of error stack, which allows remote attackers to cause a denial
of service via a crafted PDF document.
### References:
https://nvd.nist.gov/vuln/detail/CVE-2018-6544
### Patches:
http://git.ghostscript.com/?p=mupdf.git;h=26527eef77b3e51c2258c8e40845bfbc015e405d
http://git.ghostscript.com/?p=mupdf.git;h=b03def134988da8c800adac1a38a41a1f09a1d89
CVE-2018-1000051: use-after-free in fz\_keep\_key\_storable function
--------------------------------------------------------------------
A flaw was found in Artifex Mupdf version 1.12.0 in
fz\_keep\_key\_storable function. There is Use After Free vulnerability
which
can be triggered by supplying a malformed PDF file. This can result in a
Denial of Service or a Possible code execution.
### References:
https://bugs.ghostscript.com/show\_bug.cgi?id=698825
https://bugs.ghostscript.com/show\_bug.cgi?id=698873
https://nvd.nist.gov/vuln/detail/CVE-2018-1000051
### Patch:
http://git.ghostscript.com/?p=mupdf.git;h=321ba1de287016b0036bf4a56ce774ad11763384
*(from redmine: issue id 8580, created on 2018-02-27, closed on 2019-05-04)*
* Relations:
* parent #8579
* Changesets:
* Revision 70bbeef9560773077c355e9816977d9ab61c15c6 by prs pkt on 2018-08-08T16:18:35Z:
```
main/mupdf: upgrade to 1.13.0
add secfixes comments
fixes #8580
(cherry picked from commit 831d2ee24986330048dfa488c8bb5017656e8efd)
```3.8.1Daniel SabogalDaniel Sabogalhttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8557[3.8] libvncserver: Improper input sanitization in rfbProcessClientNormalMess...2019-07-23T11:35:27ZAlicha CH[3.8] libvncserver: Improper input sanitization in rfbProcessClientNormalMessage in rfbserver.c ((CVE-2018-7225)An issue was discovered in LibVNCServer through 0.9.11.
rfbProcessClientNormalMessage() in rfbserver.c does not sanitize
msg.cct.length, leading to access
to uninitialized and potentially sensitive data or possibly unspecified
other im...An issue was discovered in LibVNCServer through 0.9.11.
rfbProcessClientNormalMessage() in rfbserver.c does not sanitize
msg.cct.length, leading to access
to uninitialized and potentially sensitive data or possibly unspecified
other impact (e.g., an integer overflow) via specially crafted VNC
packets.
### References:
https://github.com/LibVNC/libvncserver/issues/218
http://www.openwall.com/lists/oss-security/2018/02/18/1
*(from redmine: issue id 8557, created on 2018-02-23, closed on 2018-08-09)*
* Relations:
* parent #85563.8.1https://gitlab.alpinelinux.org/alpine/aports/-/issues/8532[3.8] p7zip: Multiple vulnerabilities (CVE-2018-5996)2019-07-23T11:35:49ZAlicha CH[3.8] p7zip: Multiple vulnerabilities (CVE-2018-5996)**CVE-2018-5996**: Multiple memory corruption vulnerabilities exist in
7-Zip’s RAR compression handler.
Versions before 18.00 are affected.
### References:
https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/...**CVE-2018-5996**: Multiple memory corruption vulnerabilities exist in
7-Zip’s RAR compression handler.
Versions before 18.00 are affected.
### References:
https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/
https://nvd.nist.gov/vuln/detail/CVE-2018-5996
*(from redmine: issue id 8532, created on 2018-02-21, closed on 2018-08-09)*
* Relations:
* parent #8531
* Changesets:
* Revision dd269d3c71438124e4041c3db6aa73a238dbd4ee by Natanael Copa on 2018-08-08T15:15:22Z:
```
main/p7zip: security fixes (CVE-2018-5996, CVE-2018-10115)
fixes #8532
```3.8.1Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/8240[3.8] tiff: Heap-based buffer overflow bug in pal2rgb (CVE-2017-17095)2019-07-23T11:39:17ZAlicha CH[3.8] tiff: Heap-based buffer overflow bug in pal2rgb (CVE-2017-17095)tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote
attackers to cause a denial of service (TIFFSetupStrips heap-based
buffer overflow and application crash) or possibly have unspecified
other impact via a crafted TIFF file.
...tools/pal2rgb.c in pal2rgb in LibTIFF 4.0.9 allows remote
attackers to cause a denial of service (TIFFSetupStrips heap-based
buffer overflow and application crash) or possibly have unspecified
other impact via a crafted TIFF file.
### References:
http://openwall.com/lists/oss-security/2017/12/02/1
http://bugzilla.maptools.org/show\_bug.cgi?id=2750
https://nvd.nist.gov/vuln/detail/CVE-2017-17095
*(from redmine: issue id 8240, created on 2017-12-05, closed on 2018-08-02)*
* Relations:
* parent #8239
* Changesets:
* Revision c1c8c5a78a149b9954517df485d61e66a73a93a4 by Natanael Copa on 2018-07-30T17:12:05Z:
```
main/tiff: various security fixes
- CVE-2017-9935
- CVE-2017-11613
- CVE-2017-17095
- CVE-2018-10963
fixes #8240
```
* Revision 6659caf6913d6dd6651a2f723184dbca1d72f499 by Natanael Copa on 2018-08-01T12:06:26Z:
```
main/tiff: various security fixes
- CVE-2017-9935
- CVE-2017-11613
- CVE-2017-17095
- CVE-2018-10963
fixes #8240
fixes #9163
```3.8.1https://gitlab.alpinelinux.org/alpine/aports/-/issues/8003zip -T calls into busybox which fails, should depend on unzip package2019-07-23T11:42:10ZSteffen Nurpmesozip -T calls into busybox which fails, should depend on unzip package*(from redmine: issue id 8003, created on 2017-10-14, closed on 2018-08-08)*
* Changesets:
* Revision 3489bb033ae0718035f0e5f6656baabbccd071cc by Natanael Copa on 2018-07-27T14:18:51Z:
```
main/zip: add unzip to depends
unzip is nee...*(from redmine: issue id 8003, created on 2017-10-14, closed on 2018-08-08)*
* Changesets:
* Revision 3489bb033ae0718035f0e5f6656baabbccd071cc by Natanael Copa on 2018-07-27T14:18:51Z:
```
main/zip: add unzip to depends
unzip is needed by `zip -T`
ref #8003
```
* Revision 622520e4c7ba344b36421d6a403380f60040104d by Natanael Copa on 2018-07-27T14:22:00Z:
```
main/zip: add unzip to depends
unzip is needed by `zip -T`
fixes #8003
```3.8.1https://gitlab.alpinelinux.org/alpine/aports/-/issues/7155Xen: Enable livepatch2019-07-23T11:55:43ZFlorian HeiglXen: Enable livepatchHi,
I’ve gone through the Xen live patch documentation.
It’s available https://wiki.xenproject.org/wiki/LivePatch
This stuff isn’t easy for sure but before you even can get started
trying, you need to have it enabled.
Could we in f...Hi,
I’ve gone through the Xen live patch documentation.
It’s available https://wiki.xenproject.org/wiki/LivePatch
This stuff isn’t easy for sure but before you even can get started
trying, you need to have it enabled.
Could we in future versions please build Xen with CONFIG\_LIVEPATCH=y
set?
People can then later decide if they’ll use it or not.
*(from redmine: issue id 7155, created on 2017-04-14, closed on 2018-07-27)*3.8.1Natanael CopaNatanael Copahttps://gitlab.alpinelinux.org/alpine/aports/-/issues/9358[3.8] bind: A flaw in the "deny-answer-aliases" feature can cause an assertio...2020-01-18T00:12:52ZAlicha CH[3.8] bind: A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named (CVE-2018-5740)“deny-answer-aliases” is a little-used feature intended to help
recursive server operators protect end users against DNS rebinding
attacks, a potential method of circumventing
the security model used by client browsers. However, a def...“deny-answer-aliases” is a little-used feature intended to help
recursive server operators protect end users against DNS rebinding
attacks, a potential method of circumventing
the security model used by client browsers. However, a defect in this
feature makes it easy, when the feature is in use, to experience an
assertion failure in name.c.
### Fixed In Version:
bind 9.9.13-P1, bind 9.10.8-P1, bind 9.11.4-P1, bind 9.12.2-P1, bind
9.11.3-S3
### Reference:
https://kb.isc.org/article/AA-01639/74/CVE-2018-5740
*(from redmine: issue id 9358, created on 2018-08-29, closed on 2018-09-10)*
* Relations:
* parent #9357
* Changesets:
* Revision 4ec71c5ae6c53d4cf8c9a8f89a4ea19656a56b71 by Natanael Copa on 2018-09-10T10:01:44Z:
```
main/bind: security upgrade to 9.12.2_p1 (CVE-2018-5740)
fixes #9358
```3.8.1Natanael CopaNatanael Copa