安全公告详情

NS-SA-2025-0224

2025-09-30 16:49:52

简介

low: bzip2/sudo security update

严重级别

low

主题

An update for bzip2/sudo is now available for NewStart CGSL MAIN 6.06.
NewStart Security has rated this update as having a security impact of low. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

bzip2:
sudo:


Security Fix(es):
bzip2: A use-after-free flaw was found in bzip2recover, leading to a null pointer dereference, or a write to a closed file descriptor. An attacker could use this flaw by sending a specially crafted bzip2 file to recover and force the program to crash.(CVE-2016-3189)
bzip2: bugfix
sudo: A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command. NOTE: this vulnerability exists because of a CVE-2009-0034 regression.(CVE-2011-0008)
sudo: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 6.06.01B6.

影响组件

  • bzip2
  • sudo

影响产品

  • CGSL MAIN 6.06

更新包

{"fix":[{"product":"CGSL MAIN 6.06","pkgs":[{"binary":["bzip2-1.0.6-26.zncgsl6.t1.0.x86_64.rpm","bzip2-devel-1.0.6-26.zncgsl6.t1.0.x86_64.rpm","bzip2-libs-1.0.6-26.zncgsl6.t1.0.x86_64.rpm"],"source":"bzip2-1.0.6-26.zncgsl6.t1.0.src.rpm"},{"binary":["sudo-1.8.29-8.zncgsl6.cgslv6_6.x86_64.rpm"],"source":"sudo-1.8.29-8.zncgsl6.cgslv6_6.src.rpm"}]}]}

CVE

参考