Closed
Milestone
expired on Jul 11, 2017
3.6.3
Bugfix release 3.6.3
(from redmine: created on 2017-06-16)
Unstarted Issues (open and unassigned)
0
Ongoing Issues (open and assigned)
0
Completed Issues (closed)
243
- [3.6] py-paramiko: Authentication bypass in auth_handler.py (CVE-2018-1000805)
- [3.6] py-django: memory exhaustion in django.utils.numberformat.format() (CVE-2019-6975)
- [3.6] openssh: Multiple vulnerabilities (CVE-2018-20685, CVE-2019-6109, CVE-2019-6111)
- [3.6] curl: Multiple vulnerabilities (CVE-2018-16890, CVE-2019-3822, CVE-2019-3823)
- [3.6] spice: Off-by-one error in array access in spice/server/memslot.c (CVE-2019-3813)
- [3.6] wavpack: Multiple vulnerabilities (CVE-2018-19840, CVE-2018-19841)
- [3.6] apache2: Multiple vulnerabilities (CVE-2018-17189, CVE-2018-17199)
- [3.6] gitolite: security issue in optional bundle helper ("rsync" command) (CVE-2018-20683)
- [3.6] zeromq: Integer overflow in zmq::v2_decoder_t::size_ready (CVE-2019-6250)
- [3.6] tar: Infinite read loop in sparse_dump_region function in sparse.c (CVE-2018-20482)
- [3.6] xen: Multiple vulnerabilities (CVE-2018-19961, CVE-2018-19962, CVE-2018-19965, CVE-2018-19966, CVE-2018-19967)
- [3.6] tinc: Multiple issues (CVE-2018-16737, CVE-2018-16738, CVE-2018-16758)
- [3.6] openjpeg: Multiple vulnerabilities (CVE-2018-14423, CVE-2018-6616)
- [3.6] sqlite: integer overflow (resulting in buffer overflow) for FTS3 queries (CVE-2018-20346)
- [3.6] mariadb: Multiple vulnerabilities (CVE-2016-9843, CVE-2018-2755, CVE-2018-2761, CVE-2018-2766, CVE…, CVE-2018-3251, CVE-2018-3282)
- [3.6] cups: Predictable session cookie breaks CSRF protection (CVE-2018-4700)
- [3.6] polkit: Improper handling of user with uid > INT_MAX leading to authentication bypass (CVE-2018-19788)
- [3.6] perl: Multiple vulnerabilities (CVE-2018-18311, CVE-2018-18312, CVE-2018-18313, CVE-2018-18314)
- [3.6] tiff: Multiple vulnerabilities (CVE-2018-12900, CVE-2018-18557, CVE-2018-18661)
- [3.6] git: Improper handling of PATH allows for commands to executed from current directory (CVE-2018-19486)
- [3.6] ghostscript: Multiple vulnerabilities (CVE-2018-19409, CVE-2018-19475, CVE-2018-19476, CVE-2018-19477)
- [3.6] clamav: Multiple vulnerabilities (CVE-2018-15378, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682)
- [3.6] openjpeg: Multiple vulnerabilities (CVE-2017-17480, CVE-2018-18088)
- [3.6] cabextract: Buffer overflow (CVE-2018-18584)
- [3.6] libmspack: Multiple vulnerabilities (CVE-2018-18584, CVE-2018-18585, CVE-2018-18586)
- [3.6] nginx: Multiple vulnerabilities (CVE-2018-16843, CVE-2018-16844, CVE-2018-16845)
- [3.6] curl: Multiple vulnerabilities (CVE-2018-16839, CVE-2018-16840, CVE-2018-16842)
- [3.6] xorg-server: Incorrect permission check in Xorg X server allows for privilege escalation (CVE-2018-14665)
- [3.6] tiff: Multiple vulnerabilities (CVE-2018-10779, CVE-2018-17100, CVE-2018-17101)
- [3.6] libssh: Authentication Bypass due to improper message callbacks implementation (CVE-2018-10933)
- [3.6] libxml2: Multiple vulnerabilities (CVE-2018-9251, CVE-2018-14404, CVE-2018-14567)
- [3.6] Git RCE vulnerability regarding submodules (CVE-2018-17456)
- [3.6] libx11: Multiple vulnerabilities (CVE-2018-14598, CVE-2018-14599, CVE-2018-14600)
- [3.6] libexif: Out-of-bounds heap read in exif_data_save_data_entry function (CVE-2017-7544)
- [3.6] strongswan: heap buffer overflow using crafted certificates (CVE-2018-17540)
- [3.6] gd: Double free in src/gd_bump.c:gdImageBmpPtr() via crafted JPEG (CVE-2018-1000222)
- [3.6] bind: Update policies krb5-subdomain and ms-subdomain (CVE-2018-5741)
- [3.6] libjpeg-turbo: Multiple vulnerabilities (CVE-2017-15232, CVE-2018-1152, CVE-2018-11813)
- [3.6] bind: A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named (CVE-2018-5740)
- [3.6] unzip: Heap-based buffer overflow in password protected ZIP archives (CVE-2018-1000035)
- [3.6] ncurses: NULL Pointer Dereference in _nc_parse_entry function in tinfo/parse_entry.c. (CVE-2018-10754)
- [3.6] python2: Multiple vulnerabilities (CVE-2018-1060, CVE-2018-1061)
- [3.6] apache2: Multiple vulnerabilities (CVE-2018-1333, CVE-2018-8011)
- [3.6] samba: Multiple vulnerabilities (CVE-2018-10858, CVE-2018-10919)
- [3.6] libmspack: Multiple vulnerabilities (CVE-2018-14679, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682)
- [3.6] wpa_supplicant: Unauthenticated EAPOL-Key decryption in wpa_supplicant (CVE-2018-14526)
- [3.6] myrepos: missing URL sanitization (CVE-2018-7032)
- [3.6] py-django: Open redirect possibility in CommonMiddleware (CVE-2018-14574)
- [3.6] clamav: Multiple vulnerabilities (CVE-2018-0360, CVE-2018-0361)
- [3.6] tiff: Multiple vulnerabilities (CVE-2017-9935, CVE-2017-11613, CVE-2018-10963)
- [3.6] fuse: bypass of the "user_allow_other" restriction when SELinux is active (CVE-2018-10906)
- [3.6] libvorbis: heap buffer overflow in mapping0_forward function (CVE-2018-10392)
- [3.6] mutt: Multiple vulnerabilities (CVE-2018-14349, CVE-2018-14350, CVE-2018-14351, CVE-2018-14352, CVE-2018-14353, CVE-2018-14354, CVE-2018-14355, CVE-2018-14356, CVE-2018-14357, CVE-2018-14358, CVE-2018-14359, CVE-2018-14362)
- [3.6] znc: Multiple vulnerabilities (CVE-2018-14055, CVE-2018-14056)
- [3.6] redis: Multiples vulnerabilities (CVE-2018-11218, CVE-2018-11219)
- [3.6] openssl: Client DoS due to large DH parameter (CVE-2018-0732)
- [3.6] libgcrypt: Key Extraction Side Channel (CVE-2018-0495)
- [3.6] gnupg: filename sanitization problem (CVE-2018-12020)
- [3.6] freetype: NULL pointer dereference in the Ins_GETVARIATION() function (CVE-2018-6942)
- [3.6] perl: Directory traversal in Archive::Tar (CVE-2018-12015)
- [3.6] xfsprogs: Security: wrong owner / group on XFS binaries
- [3.6] git: Multiple vulnerabilities (CVE-2018-11233, CVE-2018-11235)
- [3.6] sdl2_image: Multiple vulnerabilities (CVE-2017-2887, CVE-2017-12122, CVE-2017-14440, CVE-2017-14441, CVE-2017-14442, CVE-2017-14448, CVE-2017-14450, CVE-2018-3837, CVE-2018-3838, CVE-2018-3839)
- [3.6] wavpack: Multiple vulnerabilities (CVE-2018-10536, CVE-2018-10537, CVE-2018-10538, CVE-2018-10539, CVE-2018-10540)
- [3.6] curl: Multiple vulnerabilities (CVE-2018-1000300, CVE-2018-1000301)
- [3.6] xen: Multiple vulnerabilities (CVE-2018-10471, CVE-2018-10472, CVE-2018-8897, CVE-2018-10981, CVE-2018-10982)
- [3.6] wget: Cookie injection vulnerability (CVE-2018-0494)
- [3.6] memcached: UDP server support allows spoofed traffic amplification DoS (CVE-2018-1000115)
- [3.6] mercurial: HTTP server permissions bypass (CVE-2018-1000132)
- [3.6] openssl: Cache timing vulnerability in RSA Key Generation (CVE-2018-0737)
- [3.6] jq: stack exhaustion via jv_dump_term() function (CVE-2016-4074)
- [3.6] perl: Multiple vulnerabilities (CVE-2018-6797, CVE-2018-6798, CVE-2018-6913)
- [3.6] Ruby 2.2.9, 2.3.6, 2.4.3, 2.5.0 Multiple Vulnerabilities
- [3.6] uwsgi: Multiple vulnerabilities (CVE-2018-6758, CVE-2018-7490)
- [3.6] apache2: Multiple vulnerabilities (CVE-2017-15710, CVE-2017-15715, CVE-2018-1301, CVE-2018-1302, CVE-2018-1303, CVE-2018-1283, CVE-2018-1312)
- [3.6] kamailio: A Buffer Overflow (CVE-2018-8828)
- [3.6] tiff: uncontrolled resource consumption in TIFFSetDirectory function in tif_dir.c (CVE-2018-5784)
- [3.6] clamav: Multiple vulnerabilities (CVE-2018-0202, CVE-2018-1000085)
- [3.6] mariadb: Multiple vulnerabilities (CVE-2017-10268, CVE-2017-10378, CVE-2017-15365, CVE-2018-2562, CVE-2018-2612, CVE-2018-2622, CVE-2018-2640, CVE-2018-2665, CVE-2018-2668)
- [3.6] sqlite: NULL Pointer Dereference (CVE-2018-8740)
- [3.6] rsync: sanitization bypass in parse_argument in options.c (CVE-2018-5764)
- [3.6] libvorbis: out-of-bounds write (CVE-2018-5146)
- [3.6] samba: Multiple vulnerabilities (CVE-2018-1050, CVE-2018-1057)
- [3.6] curl: Multiple vulnerabilities (CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122)
- [3.6] py-django: Multiple vulnerabilitie (CVE-2018-7536, CVE-2018-7537)
- [3.6] xen: Multiple vulnerabilitie (CVE-2018-7540, CVE-2018-7541, CVE-2018-7542)
- [3.6] wavpack: Multiple vulnerabilities (CVE-2018-6767, CVE-2018-7253, CVE-2018-7254)
- [3.6] libvncserver: Improper input sanitization in rfbProcessClientNormalMessage in rfbserver.c ((CVE-2018-7225)
- [3.6] squid: Multiple vulnerabilities (CVE-2018-1000024, CVE-2018-1000027)
- [3.6] sqlite: NULL pointer dereference in tableColumnList (CVE-2017-15286)
- [3.6] python: PyString_DecodeEscape integer overflow (CVE-2017-1000158)
- [3.6] p7zip: Multiple vulnerabilities (CVE-2017-17969, CVE-2018-5996)
- [3.6] libtasn1: Stack exhaustion due to indefinite recursion during BER decoding (CVE-2018-6003)
- [3.6] xen: Multiple vulnerabilities (CVE-2017-17563, CVE-2017-17564, CVE-2017-17565, CVE-2017-17566, CVE-2017-5753, CVE-2017-5715, CVE-2017-5754)
- [3.6] libvorbis: Multiple vulnerabilities (CVE-2017-14632, CVE-2017-14633)
- [3.6] irssi: Multiple vulnerabilities (CVE-2018-5205, CVE-2018-5206, CVE-2018-5207, CVE-2018-5208, CVE-2018-7050, CVE-2018-7051, CVE-2018-7052, CVE-2018-7053, CVE-2018-7054)
- [3.6] Tiff: NULL pointer dereference in tif_print.c:TIFFPrintDirectory() (CVE-2017-18013)
- [3.6] curl: Multiple vulnerabilities (CVE-2018-1000005, CVE-2018-1000007)
- [3.6] bind: Improper fetch cleanup sequencing in the resolver can cause named to crash (CVE-2017-3145)
- [3.6] libxml2: Mishandling parameter-entity references (CVE-2017-16931)
- [3.6] ncurses:Stack based buffer overflow (CVE-2017-16879)
- [3.6] awstats: Path traversal flaws (CVE-2017-1000501)
- [3.6] asterisk: Multiple vulnerabilities (CVE-2017-16671, CVE-2017-16672, CVE-2017-17090, CVE-2017-17664, CVE-2017-17850)
- [3.6] libraw: Invalid read memory access in the LibRaw::xtrans_interpolate() function (CVE-2017-16910)
- [3.6] gd: Multiple vulnerabilities (CVE-2017-6362, CVE-2017-7890)
- [3.6] rsync: Several vulnerabilities (CVE-2017-16548, CVE-2017-17433, CVE-2017-17434)
- [3.6] heimdal: NULL pointer dereference via crafted UDP packets (CVE-2017-17439)
- [3.6] openssh: Improper write operations in readonly mode allow for zero-length file creation (CVE-2017-15906)
- [3.6] openssl: Multiple vulnerabilities (CVE-2017-3737, CVE-2017-3738)
- [3.6] tiff: Heap-based buffer overflow bug in pal2rgb (CVE-2017-17095)
- [3.6] libxcursor: heap overflows when parsing malicious files (CVE-2017-16612)
- [3.6] libxfont: Open files with O_NOFOLLOW (CVE-2017-16611)
- [3.6] xen: Multiple vulnerabilities (CVE-2017-17044, CVE-2017-17045)
- [3.6] curl: Multiple vulnerabilities (CVE-2017-8816, CVE-2017-8817, CVE-2017-8818)
- [3.6] ffmpeg: Multiple vulnerabilities (CVE-2017-9991, CVE-2017-9992, CVE-2017-9993, CVE…CVE-2017-14767, CVE-2017-15186)
- [3.6] busybox: Multiple vulnerabilities (CVE-2017-15873, CVE-2017-16544)
- [3.6] samba: Multiple vulnerabilities (CVE-2017-14746, CVE-2017-15275)
- [3.6] firefox-esr: Multiple vulnerabilities (CVE-2017-7826, CVE-2017-7828, CVE-2017-7830)
- [3.6] collectd: Multiple vulnerabilities (CVE-2017-7401, CVE-2017-16820)
- [3.6] varnish: Data leak - ‘-sfile’ Stevedore transient objects (CVE-2017-8807)
- [3.6] libvirt: TLS certificate verification disabled for clients (CVE-2017-1000256)
- [3.6] postgresql: Multiple vulnerabilities (CVE-2017-12172, CVE-2017-15098, CVE-2017-15099)
- [3.6] tiff: memory-based DoS in tiff2bw (CVE-2017-16232)
- [3.6] pcre: match() stack overflow (CVE-2017-16231)
- [3.6] openvpn: remote buffer overflow (CVE-2017-12166)
- [3.6] openssl: Multiple vulnerabilities (CVE-2017-3735, CVE-2017-3736)
- [3.6] graphicsmagick: Multiple vulnerabilities (CVE-2017-14314, CVE-2017-14504, CVE-2017-14733, CVE-2017-14994 CVE-2017-14997, CVE-2017-15930)
- [3.6] quagga: remote denial of service via BGP UPDATE messages (CVE-2017-16227)
- [3.6] wget: Multiple vulnerabilities (CVE-2017-13089, CVE-2017-13090)
- [3.6] xen: Multiple vulnerabilities (CVE-2017-15588, CVE-2017-15589, CVE-2017-15590, CVE-2017-15593, CVE-2017-15592, CVE-2017-15594, CVE-2017-15595, CVE-2017-15596, CVE-2017-15597, CVE-2017-17046)
- bash version 4.3.48-r1 & CVE-2016-0634
- [3.6] firefox-esr: Multiple vulnerabilities (CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7805, CVE-2017-7814, CVE-2017-7825, CVE-2017-7823, CVE-2017-7810)
- [3.6] irssi: Multiple vulnerabilities (CVE-2017-15721, CVE-2017-15722, CVE-2017-15723, CVE-2017-15227, CVE-2017-15228)
- [3.6] go: Multiple vulnerabilities (CVE-2017-15041, CVE-2017-15042)
- [3.6] curl: IMAP FETCH response out of bounds read (CVE-2017-1000257)
- [3.6] CVE-2017-15650 musl
- [3.6] openjdk8 Multiple CVE
- [3.6] wireshark: Multiple vulnerabilities (CVE-2017-15191, CVE-2017-15192, CVE-2017-15193)
- [3.6] ghostscript: Multiple vulnerabilities (CVE-2017-9611, CVE-2017-9612, CVE-2017-9726, CVE-2017-9727, CVE-2017-9739, CVE-2017-9835, CVE-2017-11714)
- [3.6] miniupnpc: Integer signedness error (CVE-2017-8798)
- [3.6] tor: Stack disclosure in hidden services logs when SafeLogging disabled (CVE-2017-0380)
- [3.6] ncurses: Multiple vulnerabilities (CVE-2017-11112, CVE-2017-11113, CVE-2017-13728, CVE-2017-13729, CVE-2017-13730, CVE-2017-13731, CVE-2017-13732, CVE-2017-13733, CVE-2017-13734)
- [3.6] curl: FTP PWD response parser out of bounds read (CVE-2017-1000254)
- [3.6] sqlite: Heap-buffer overflow in the getNodeSize function (CVE-2017-10989)
- [3.6] graphicsmagick: Multiple vulnerabilities (CVE-2017-13065, CVE-2017-13648, CVE-2017-14042, CVE-2017-14103, CVE-2017-14165, CVE-2017-14649)
- [3.6] libvorbis: out-of-bounds access and application crash (CVE-2017-14160)
- [3.6] weechat: crash in logger plugin when converting date/time specifiers in file mask (CVE-2017-14727)
- [3.6] wireshark: Multiple vulnerabilities (CVE-2017-13765, CVE-2017-13766, CVE-2017-13767)
- [3.6] strongswan: Insufficient Input Validation in gmp Plugin (CVE-2017-11185)
- [3.6] perl: Multiple vulnerabilities (CVE-2017-12837, CVE-2017-12883)
- [3.6] samba: Multiple vulnerabilities (CVE-2017-12150, CVE-2017-12151, CVE-2017-12163)
- [3.6] newsbeuter: remote code execution (CVE-2017-14500)
- [3.6] gdk-pixbuf: Heap overflow in the gdk_pixbuf__jpeg_image_load_increment function (CVE-2017-2862)
- [3.6] emacs: Unsafe enriched mode translations (CVE-2017-14482)
- [3.6] bluez: Out-of-bounds heap read in service_search_attr_req function (CVE-2017-1000250)
- [3.6] tcpdump: Multiple vulnerabilities (Various CVEs)
- [3.6] libgcrypt: Missing input validation for X25519 curve (CVE-2017-0379)
- [3.6] xen: Multiple vulnerabilities (CVE-2017-14316, CVE-2017-14317, CVE-2017-14318, CVE-2017-14319)
- [3.6] py-django: Possible XSS in traceback section of technical 500 debug page (CVE-2017-12794)
- [3.6] libzip: Multiple vulnerabilities (CVE-2017-14107, CVE-2017-12858)
- [3.6] oniguruma: Multiple vulnerabilities (CVE-2017-9224, CVE-2017-9225, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228)
- [3.6] php7: Multiple vulnerabilities (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
- [3.6] file: stack based buffer overflow (CVE-2017-1000249)
- [3.6] libarchive: heap-based buffer overflow in xml_data (CVE-2017-14166)
- [3.6] asterisk: Multiple vulnerabilities (CVE-2017-14098, CVE-2017-14099, CVE-2017-14100)
- [3.6] graphicsmagick: Multiple vulnerabilities (CVE-2017-13775, CVE-2017-13776, CVE-2017-13777)
- [3.6] libmspack: Multiple vulnerabilities (CVE-2017-6419, CVE-2017-11423)
- [3.6] salt: Directory traversal vulnerability on salt-master via crafted minion IDs (CVE-2017-12791)
- [3.6] graphicsmagick: Multiple vulnerabilities (CVE-2017-11642, CVE-2017-11722, CVE-2017-12935, CVE-2017-12936, CVE-2017-12937, CVE-2017-13063, CVE-2017-13064)
- [3.6] libraw: Multiple vulnerabilities (CVE-2017-6886, CVE-2017-6887)
- [3.6] xen: Multiple vulnerabilities (CVE-2017-12135, CVE-2017-12137, CVE-2017-12136, CVE-2017-12134, CVE-2017-12855)
- [3.6] newsbeuter: Remote code execution (CVE-2017-12904)
- [3.6] augeas: Improper handling of escaped strings leading to memory corruption (CVE-2017-7555)
- [3.6] openjpeg: memory allocation failure in opj_aligned_alloc_n (opj_malloc.c) (CVE-2017-12982)
- [3.6] mariadb: Multiple vulnerabilities (CVE-2017-3308, CVE-2017-3309, CVE-2017-3453, CVE-2017-3456, CVE-2017-3464, CVE-2017-3636, CVE-2017-3641, CVE-2017-3653)
- [3.6] pcre: OP_KETRMAX feature in the match function in pcre_exec.c (CVE-2017-11164)
- [3.6] mercurial: Multiples vulnerabilities (CVE-2017-1000115, CVE-2017-1000116)
- [3.6] cacti: Multiple vulnerabilities (CVE-2017-10970, CVE-2017-11163, CVE-2017-11691, CVE-2017-12065, CVE-2017-12066)
- [3.6] supervisor: Command injection via malicious XML-RPC request (CVE-2017-11610)
- [3.6] libsoup: Stack based buffer overflow with HTTP Chunked Encoding (CVE-2017-2885)
- [3.6] firefox-esr: Multiple vulnerabilities (CVE-2017-7753, CVE-2017-7779, CVE-2017-7784, CVE-2017-7785, CVE-2017-7786, CVE-2017-7787, CVE-2017-7791, CVE-2017-7792, CVE…, CVE-2017-7802, CVE-2017-7803, CVE-2017-7807, CVE-2017-7809)
- [3.6] subversion: Arbitrary code execution on clients through malicious svn+ssh URLs (CVE-2017-9800)
- [3.6] postgresql: Multiple vulnerabilities (CVE-2017-7546, CVE-2017-7547, CVE-2017-7548)
- [3.6] curl: Multiple vulnerabilities (CVE-2017-1000100, CVE-2017-1000101)
- [3.6] libsndfile: Heap-based Buffer Overflow (CVE-2017-12562)
- [3.6] memcached: Heap-based buffer over-read in try_read_command function (CVE-2017-9951)
- [3.6] tcpdump: heap-based buffer over-read and application crash (CVE-2017-11108)
- [3.6] lame: Multiple vulnerabilities (CVE-2015-9099, CVE-2015-9100, CVE-2017-9410, CVE-2017-9411, CVE-2017-9412, CVE-2017-11720)
- [3.6] libtasn1: NULL pointer dereference in the _asn1_check_identifier function (CVE-2017-10790)
- [3.6] mpg123: global buffer overflow in III_i_stereo (layer3.c) (CVE-2017-11126)
- [3.6] jasper: NULL pointer exception in the function jp2_encode (CVE-2017-1000050)
- [3.6] gsoap: Stack-based buffer overflow when receieving XML message with size larger than 2GB (CVE-2017-9765)
- [3.6] ncurses: buffer overflow in the fmt_entry function(CVE-2017-10684, CVE-2017-10685)
- [3.6] wireshark: Multiple vulnerabilities (CVE-2017-11406, CVE-2017-11407, CVE-2017-11408)
- [3.6] libmtp: various flaws (CVE-2017-9831, CVE-2017-9832)
- [3.6] graphicsmagick: Use-after-free in CloseBlob (CVE-2017-11403)
- [3.6] knot: TSIG authentication bypass due to improper TSIG validity period check (CVE-2017-11104)
- [3.6] evince: command injection via filename in tar-compressed comics archive (CVE-2017-1000083)
- [3.6] webkit2gtk: Memory corruption issues (CVE-2017-2538)
- [3.6] heimdal: Orpheus' Lyre KDC-REP service name validation (CVE-2017-11103)
- [3.6] samba: Orpheus' Lyre mutual authentication validation bypass (CVE-2017-11103)
- [3.6] c-ares: NAPTR parser out of bounds access (CVE-2017-1000381)
- [3.6] nginx: Integer overflow in nginx range filter module leading to memory disclosure (CVE-2017-7529)
- [3.6] irssi: Multiple issues (CVE-2017-10965, CVE-2017-10966)
- [3.6] phpldapadmin: XSS in htdocs/entry_chooser.php (CVE-2017-11107)
- [3.6] xen: Multiple vulnerabilities (CVE-2017-10911, CVE-2017-10912, CVE-2017-10913, CVE-2017-10914, CVE-2017-10915, CVE-2017-10916, CVE-2017-10917, CVE-2017-10918, CVE-2017-10919, CVE-2017-10920, CVE-2017-10921, CVE-2017-10922, CVE-2017-10923)
- [3.6] bind: Multiple vulnerabilities (CVE-2017-3142, CVE-2017-3143)
- [3.6] tiff: Multiple vulnerabilities (CVE-2017-9147, CVE-2017-9403, CVE-2017-9404, CVE-2017-9936, CVE-2017-10688)
- [3.6] Libgcrypt 1.7.8 released to fix CVE-2017-7526
- [3.6] drupal7: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users (CVE-2017-6922)
- [3.6] apache2: Several vulnerabilities (CVE-2017-3167, CVE-2017-3169, CVE-2017-7659, CVE-2017-7668, CVE-2017-7679)
- [3.6] exim: Privilege escalation via multiple memory leaks (CVE-2017-1000369)
- [3.6] libsndfile: Multiple vulnerabilities (CVE-2017-8361, CVE-2017-8362, CVE-2017-8363, CVE-2017-8365)
- [3.6] samba: Multiple vulnerabilities (CVE-2018-14629, CVE-2018-16841, CVE-2018-16851)
- [3.6] lcms2: heap-based buffer overflow in SetData function in cmsIT8LoadFromFile (CVE-2018-16435)
- python3 strftime does not work properly in Alpine linux
- [3.6] ldb: Denial of Service Attack on DNS and LDAP server (CVE-2018-1140)
- [3.6] strongswan: integer underflow leads to buffer overflow and denial of service in stroke_socket.c (CVE-2018-5388)
- libcurl-7.60.0-r0 introduced symbol name conflict with libssl.so
- [3.6] curl doesn't support SSH based protocols
- noarch in apk repo file
- [3.6] webkit2gtk: Multiple vulnerabilities (CVE-2017-13783, CVE-2017-13784, CVE-2017-13785, CVE-2017-13788, CVE-2017-13791, CVE-2017-13792, CVE-2017-13793, CVE-2017-13794, CVE-2017-13795, CVE-2017-13796, CVE-2017-13798, CVE-2017-13802, CVE-2017-13803)
- py-psycopg2 package is empty
- Nextcloud 12 on Alpine Linux shows "integrity check"-error after installing
- postgresql-pglogical: vanilla extension is not working
- fish: missing dependency
- Critical security update OpenJDK
- [3.6] webkit2gtk: Multiple vulnerabilities (Various CVEs)
- boot parameter "blacklist" not working properly
- [3.6] chromium: Multiple vulnerabilities (CVE-2017-5121, CVE-2017-5122)
- [3.6] libraw: multiple issues (CVE-2017-13735, CVE-2017-14265)
- Terminator (alpine 3.6.2) not running after installation
- Critical pcre-8.41-r0 regex bug with php-7.*
- atop create many logs and processes
- mkinitfs: features.d/ext4 needs to depend on crc32
- py-scipy: Not have support for Python3
- [ncurses] Relocation error in tic
- GoAccess no longer support GeoIP
- Update openjdk8 to 8u141 to fix critical CVEs
- ttf-dejavu broken?
- user/group add/mod utilities in the shadow package cannot cope with groups containing large numbers of members
- openjdk8-jre: Breaking change in 3.6
- [3.6] binutils: Multiple vulnerabilities (CVE-2017-9038, CVE-2017-9039, CVE-2017-9040, CVE-2017-9041, CVE-2017-9042, CVE-2017-9043, CVE-2017-9044)
