安全公告详情

NS-SA-2025-0164

2025-07-25 16:49:52

简介

moderate: dnsmasq/cpio security update

严重级别

moderate

主题

An update for dnsmasq/cpio is now available for NewStart CGSL MAIN 7.02.
NewStart Security has rated this update as having a security impact of moderate. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

dnsmasq:
cpio:


Security Fix(es):
dnsmasq: A flaw was found in Dnsmasq. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.(CVE-2023-28450)
dnsmasq: bugfix
cpio: 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.(CVE-2015-1197)
cpio: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 7.02.03B8.

影响组件

  • dnsmasq
  • cpio

影响产品

  • CGSL MAIN 7.02

更新包

{"fix":[{"product":"CGSL MAIN 7.02","pkgs":[{"binary":["dnsmasq-utils-2.90-4.zncgsl7.1.x86_64.rpm","dnsmasq-2.90-4.zncgsl7.1.x86_64.rpm"],"source":"dnsmasq-2.90-4.zncgsl7.1.src.rpm"},{"binary":["cpio-2.14-1.zncgsl7.2.x86_64.rpm"],"source":"cpio-2.14-1.zncgsl7.2.src.rpm"}]}]}

CVE

参考