Alerts This Week
Warning Icon 1 631
Alerts This Week
Warning Icon 1 631

Mageia 8: MGASA-2022-0365 Urgent: Dbus Problems Causing Memory Corruption

mageia
Calendar Grey October 8, 2022
Dist Mageia Esm H88
This alert outlines a crucial software patch for Mageia involving systemd components addressing severe vulnerabilities.
A syntactically invalid type signature with incorrectly nested parentheses and curly brackets would cause an assertion failure in debug builds

Summary

A syntactically invalid type signature with incorrectly nested parentheses and curly brackets would cause an assertion failure in debug builds. Similar messages could potentially result in a crash or incorrect message processing in a production build, although we are not aware of a practical example. (CVE-2022-42010)
An invalid array of fixed-length elements where the length of the array is not a multiple of the length of the element would cause an assertion failure in debug builds or an out-of-bounds read in production builds. (CVE-2022-42011)
A message in non-native endianness with out-of-band Unix file descriptorswould cause a use-after-free and possible memory corruption in production builds, or an assertion failure in debug builds. (CVE-2022-42012)

References

- https://bugs.mageia.org/show_bug.cgi?id=30941

- https://www.openwall.com/lists/oss-security/2022/10/06/1

- https://www.cve.org/CVERecord?id=CVE-2022-42010

- https://www.cve.org/CVERecord?id=CVE-2022-42011

- https://www.cve.org/CVERecord?id=CVE-2022-42012

Resolution

SRPMS

- 8/core/dbus-1.13.18-3.1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 08 Oct 2022
URL: https://advisories.mageia.org/MGASA-2022-0365.html
Type: security
CVE: CVE-2022-42010, CVE-2022-42011, CVE-2022-42012

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here