NS-SA-2025-0090

简介

important: freeglut/openvswitch security update

严重级别

important

主题

An update for freeglut/openvswitch is now available for NewStart CGSL MAIN 7.02.
NewStart Security has rated this update as having a security impact of important. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

freeglut:
openvswitch:


Security Fix(es):
freeglut: A memory leak flaw was found in the glutAddMenuEntry function of freeglut, an open-source alternative to the OpenGL Utility Toolkit. This issue may allow an attacker to launch a denial of service attack by crashing or hanging the program or take advantage of other unexpected program behavior resulting from a low memory condition.(CVE-2024-24259)
freeglut: bugfix
openvswitch: A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.(CVE-2023-3966)
openvswitch: A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass OpenFlow rules. This issue may allow a local attacker to create specially crafted packets with a modified or spoofed target IP address field that can redirect ICMPv6 traffic to arbitrary IP addresses.(CVE-2023-5366)
openvswitch: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 7.02.02B7.

影响组件

• freeglut
• openvswitch

影响产品

• CGSL MAIN 7.02

更新包

CVE

• CVE-2024-24259
• CVE-2023-3966
• CVE-2023-5366

参考

• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-24259
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3966
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-5366