MGASA-2022-0365

Dashboard / Vulnerabilities / MGASA-2022-0365

MGASA-2022-0365

Summary: Updated dbus packages fix security vulnerability

Details: A syntactically invalid type signature with incorrectly nested parentheses and curly brackets would cause an assertion failure in debug builds. Similar messages could potentially result in a crash or incorrect message processing in a production build, although we are not aware of a practical example. (CVE-2022-42010) An invalid array of fixed-length elements where the length of the array is not a multiple of the length of the element would cause an assertion failure in debug builds or an out-of-bounds read in production builds. (CVE-2022-42011) A message in non-native endianness with out-of-band Unix file descriptors would cause a use-after-free and possible memory corruption in production builds, or an assertion failure in debug builds. (CVE-2022-42012)

References: https://advisories.mageia.org/MGASA-2022-0365.html, https://bugs.mageia.org/show_bug.cgi?id=30941, https://www.openwall.com/lists/oss-security/2022/10/06/1