Oracle Linux 8：GNOME (ELSA-2019-3553)

high Nessus 插件 ID 180839

语言：

简介

远程 Oracle Linux 主机缺少一个或多个安全更新。

描述

远程 Oracle Linux 8 主机上安装的程序包受到 ELSA-2019-3553 公告中提及的多个漏洞的影响。

- 在 GNOME Evince 3.32.0 及之前的版本中，TIFF 文档后端的 tiff_document_render() 和 tiff_document_get_thumbnail() 函数未处理来自 TIFFReadRGBAImageOriented() 的错误，导致在处理某些 TIFF 图像文件时使用未初始化的内存。(CVE-2019-11459)

- 在 1.38.3 之前的 GNOME gvfs 版本、1.40.2 之前的 1.40.x 版本和 1.41.3 之前的 1.41.x 版本中，gvfsd 中的 daemon/gvfsdaemon.c 在未配置授权规则的情况下打开了私有 D-Bus 服务器套接字。本地攻击者可能会连接至此服务器套接字并发出 D-Bus 方法调用。（请注意，服务器套接字仅接受单个联系，因此攻击者需要在所有者之前发现服务器并连接到套接字）。(CVE-2019-12795)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

解决方案

更新受影响的程序包。

另见

https://linux.oracle.com/errata/ELSA-2019-3553.html

插件详情

严重性: High

ID: 180839

文件名: oraclelinux_ELSA-2019-3553.nasl

版本: 1.0

类型: local

代理: unix

系列: Oracle Linux Local Security Checks

发布时间: 2023/9/7

最近更新时间: 2023/9/7

支持的传感器: Frictionless Assessment Agent, Nessus Agent, Nessus

风险信息

VPR

风险因素: Medium

分数: 5.9

CVSS v2

风险因素: Medium

基本分数: 4.6

时间分数: 3.4

矢量: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS 分数来源: CVE-2019-12795

CVSS v3

风险因素: High

基本分数: 7.8

时间分数: 6.8

矢量: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

时间矢量: CVSS:3.0/E:U/RL:O/RC:C

漏洞信息

CPE: cpe:/o:oracle:linux:8, p-cpe:/a:oracle:linux:sdl, p-cpe:/a:oracle:linux:sdl-devel, p-cpe:/a:oracle:linux:accountsservice, p-cpe:/a:oracle:linux:accountsservice-devel, p-cpe:/a:oracle:linux:accountsservice-libs, p-cpe:/a:oracle:linux:appstream-data, p-cpe:/a:oracle:linux:baobab, p-cpe:/a:oracle:linux:chrome-gnome-shell, p-cpe:/a:oracle:linux:evince, p-cpe:/a:oracle:linux:evince-browser-plugin, p-cpe:/a:oracle:linux:evince-libs, p-cpe:/a:oracle:linux:evince-nautilus, p-cpe:/a:oracle:linux:file-roller, p-cpe:/a:oracle:linux:gdk-pixbuf2, p-cpe:/a:oracle:linux:gdk-pixbuf2-devel, p-cpe:/a:oracle:linux:gdk-pixbuf2-modules, p-cpe:/a:oracle:linux:gdk-pixbuf2-xlib, p-cpe:/a:oracle:linux:gdk-pixbuf2-xlib-devel, p-cpe:/a:oracle:linux:gdm, p-cpe:/a:oracle:linux:gjs, p-cpe:/a:oracle:linux:gjs-devel, p-cpe:/a:oracle:linux:gnome-classic-session, p-cpe:/a:oracle:linux:gnome-control-center, p-cpe:/a:oracle:linux:gnome-control-center-filesystem, p-cpe:/a:oracle:linux:gnome-desktop3, p-cpe:/a:oracle:linux:gnome-desktop3-devel, p-cpe:/a:oracle:linux:gnome-remote-desktop, p-cpe:/a:oracle:linux:gnome-settings-daemon, p-cpe:/a:oracle:linux:gnome-shell, p-cpe:/a:oracle:linux:gnome-shell-extension-apps-menu, p-cpe:/a:oracle:linux:gnome-shell-extension-auto-move-windows, p-cpe:/a:oracle:linux:gnome-shell-extension-common, p-cpe:/a:oracle:linux:gnome-shell-extension-dash-to-dock, p-cpe:/a:oracle:linux:gnome-shell-extension-desktop-icons, p-cpe:/a:oracle:linux:gnome-shell-extension-disable-screenshield, p-cpe:/a:oracle:linux:gnome-shell-extension-drive-menu, p-cpe:/a:oracle:linux:gnome-shell-extension-horizontal-workspaces, p-cpe:/a:oracle:linux:gnome-shell-extension-launch-new-instance, p-cpe:/a:oracle:linux:gnome-shell-extension-native-window-placement, p-cpe:/a:oracle:linux:gnome-shell-extension-no-hot-corner, p-cpe:/a:oracle:linux:gnome-shell-extension-panel-favorites, p-cpe:/a:oracle:linux:gnome-shell-extension-places-menu, p-cpe:/a:oracle:linux:gnome-shell-extension-screenshot-window-sizer, p-cpe:/a:oracle:linux:gnome-shell-extension-systemmonitor, p-cpe:/a:oracle:linux:gnome-shell-extension-top-icons, p-cpe:/a:oracle:linux:gnome-shell-extension-updates-dialog, p-cpe:/a:oracle:linux:gnome-shell-extension-user-theme, p-cpe:/a:oracle:linux:gnome-shell-extension-window-grouper, p-cpe:/a:oracle:linux:gnome-shell-extension-window-list, p-cpe:/a:oracle:linux:gnome-shell-extension-windowsnavigator, p-cpe:/a:oracle:linux:gnome-shell-extension-workspace-indicator, p-cpe:/a:oracle:linux:gnome-software, p-cpe:/a:oracle:linux:gnome-software-editor, p-cpe:/a:oracle:linux:gnome-tweaks, p-cpe:/a:oracle:linux:gsettings-desktop-schemas, p-cpe:/a:oracle:linux:gsettings-desktop-schemas-devel, p-cpe:/a:oracle:linux:gtk-update-icon-cache, p-cpe:/a:oracle:linux:gtk3, p-cpe:/a:oracle:linux:gtk3-devel, p-cpe:/a:oracle:linux:gtk3-immodule-xim, p-cpe:/a:oracle:linux:gvfs, p-cpe:/a:oracle:linux:gvfs-afc, p-cpe:/a:oracle:linux:gvfs-afp, p-cpe:/a:oracle:linux:gvfs-archive, p-cpe:/a:oracle:linux:gvfs-client, p-cpe:/a:oracle:linux:gvfs-devel, p-cpe:/a:oracle:linux:gvfs-fuse, p-cpe:/a:oracle:linux:gvfs-goa, p-cpe:/a:oracle:linux:gvfs-gphoto2, p-cpe:/a:oracle:linux:gvfs-mtp, p-cpe:/a:oracle:linux:gvfs-smb, p-cpe:/a:oracle:linux:libpurple, p-cpe:/a:oracle:linux:libpurple-devel, p-cpe:/a:oracle:linux:mozjs60, p-cpe:/a:oracle:linux:mozjs60-devel, p-cpe:/a:oracle:linux:mutter, p-cpe:/a:oracle:linux:mutter-devel, p-cpe:/a:oracle:linux:nautilus, p-cpe:/a:oracle:linux:nautilus-devel, p-cpe:/a:oracle:linux:nautilus-extensions, p-cpe:/a:oracle:linux:pango, p-cpe:/a:oracle:linux:pango-devel, p-cpe:/a:oracle:linux:pidgin, p-cpe:/a:oracle:linux:pidgin-devel, p-cpe:/a:oracle:linux:plymouth, p-cpe:/a:oracle:linux:plymouth-core-libs, p-cpe:/a:oracle:linux:plymouth-graphics-libs, p-cpe:/a:oracle:linux:plymouth-plugin-fade-throbber, p-cpe:/a:oracle:linux:plymouth-plugin-label, p-cpe:/a:oracle:linux:plymouth-plugin-script, p-cpe:/a:oracle:linux:plymouth-plugin-space-flares, p-cpe:/a:oracle:linux:plymouth-plugin-throbgress, p-cpe:/a:oracle:linux:plymouth-plugin-two-step, p-cpe:/a:oracle:linux:plymouth-scripts, p-cpe:/a:oracle:linux:plymouth-system-theme, p-cpe:/a:oracle:linux:plymouth-theme-charge, p-cpe:/a:oracle:linux:plymouth-theme-fade-in, p-cpe:/a:oracle:linux:plymouth-theme-script, p-cpe:/a:oracle:linux:plymouth-theme-solar, p-cpe:/a:oracle:linux:plymouth-theme-spinfinity, p-cpe:/a:oracle:linux:plymouth-theme-spinner, p-cpe:/a:oracle:linux:wayland-protocols-devel, p-cpe:/a:oracle:linux:webkit2gtk3, p-cpe:/a:oracle:linux:webkit2gtk3-devel, p-cpe:/a:oracle:linux:webkit2gtk3-jsc, p-cpe:/a:oracle:linux:webkit2gtk3-jsc-devel, p-cpe:/a:oracle:linux:webkit2gtk3-plugin-process-gtk2

必需的 KB 项: Host/OracleLinux, Host/RedHat/release, Host/RedHat/rpm-list, Host/local_checks_enabled

易利用性: No known exploits are available

补丁发布日期: 2019/11/14

漏洞发布日期: 2019/4/22

参考资料信息

CVE: CVE-2019-11459, CVE-2019-12795