openEuler update for avahi

Published: 2023-11-10

Risk	Low
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2023-38471 CVE-2023-38472 CVE-2023-38473
CWE-ID	CWE-617
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	openEuler Operating systems & Components / Operating system avahi-help Operating systems & Components / Operating system package or component avahi-ui-devel Operating systems & Components / Operating system package or component avahi-glib-devel Operating systems & Components / Operating system package or component avahi-gobject Operating systems & Components / Operating system package or component avahi-dnsconfd Operating systems & Components / Operating system package or component avahi-qt5 Operating systems & Components / Operating system package or component avahi-ui Operating systems & Components / Operating system package or component avahi-gobject-devel Operating systems & Components / Operating system package or component avahi-autoipd Operating systems & Components / Operating system package or component avahi-tools Operating systems & Components / Operating system package or component avahi-devel Operating systems & Components / Operating system package or component avahi-compat-howl Operating systems & Components / Operating system package or component avahi-libs Operating systems & Components / Operating system package or component avahi-debugsource Operating systems & Components / Operating system package or component avahi-debuginfo Operating systems & Components / Operating system package or component avahi-glib Operating systems & Components / Operating system package or component avahi-compat-howl-devel Operating systems & Components / Operating system package or component avahi-ui-gtk3 Operating systems & Components / Operating system package or component avahi-qt5-devel Operating systems & Components / Operating system package or component avahi-compat-libdns_sd Operating systems & Components / Operating system package or component avahi-compat-libdns_sd-devel Operating systems & Components / Operating system package or component avahi Operating systems & Components / Operating system package or component
Vendor	openEuler

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Reachable Assertion

EUVDB-ID: #VU79308

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-38471

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the dbus_set_host_name() function. A local user can perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 22.03 LTS SP2

avahi-help: before 0.8-11

avahi-ui-devel: before 0.8-11

avahi-glib-devel: before 0.8-11

avahi-gobject: before 0.8-11

avahi-dnsconfd: before 0.8-11

avahi-qt5: before 0.8-11

avahi-ui: before 0.8-11

avahi-gobject-devel: before 0.8-11

avahi-autoipd: before 0.8-11

avahi-tools: before 0.8-11

avahi-devel: before 0.8-11

avahi-compat-howl: before 0.8-11

avahi-libs: before 0.8-11

avahi-debugsource: before 0.8-11

avahi-debuginfo: before 0.8-11

avahi-glib: before 0.8-11

avahi-compat-howl-devel: before 0.8-11

avahi-ui-gtk3: before 0.8-11

avahi-qt5-devel: before 0.8-11

avahi-compat-libdns_sd: before 0.8-11

avahi-compat-libdns_sd-devel: before 0.8-11

avahi: before 0.8-11

CPE2.3

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1793

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Reachable Assertion

EUVDB-ID: #VU83303

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-38472

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the avahi_rdata_parse() function. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 22.03 LTS SP2

avahi-help: before 0.8-11

avahi-ui-devel: before 0.8-11

avahi-glib-devel: before 0.8-11

avahi-gobject: before 0.8-11

avahi-dnsconfd: before 0.8-11

avahi-qt5: before 0.8-11

avahi-ui: before 0.8-11

avahi-gobject-devel: before 0.8-11

avahi-autoipd: before 0.8-11

avahi-tools: before 0.8-11

avahi-devel: before 0.8-11

avahi-compat-howl: before 0.8-11

avahi-libs: before 0.8-11

avahi-debugsource: before 0.8-11

avahi-debuginfo: before 0.8-11

avahi-glib: before 0.8-11

avahi-compat-howl-devel: before 0.8-11

avahi-ui-gtk3: before 0.8-11

avahi-qt5-devel: before 0.8-11

avahi-compat-libdns_sd: before 0.8-11

avahi-compat-libdns_sd-devel: before 0.8-11

avahi: before 0.8-11

CPE2.3

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1793

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Reachable Assertion

EUVDB-ID: #VU83304

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-38473

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion within the avahi_alternative_host_name() function. A local user can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 22.03 LTS SP2

avahi-help: before 0.8-11

avahi-ui-devel: before 0.8-11

avahi-glib-devel: before 0.8-11

avahi-gobject: before 0.8-11

avahi-dnsconfd: before 0.8-11

avahi-qt5: before 0.8-11

avahi-ui: before 0.8-11

avahi-gobject-devel: before 0.8-11

avahi-autoipd: before 0.8-11

avahi-tools: before 0.8-11

avahi-devel: before 0.8-11

avahi-compat-howl: before 0.8-11

avahi-libs: before 0.8-11

avahi-debugsource: before 0.8-11

avahi-debuginfo: before 0.8-11

avahi-glib: before 0.8-11

avahi-compat-howl-devel: before 0.8-11

avahi-ui-gtk3: before 0.8-11

avahi-qt5-devel: before 0.8-11

avahi-compat-libdns_sd: before 0.8-11

avahi-compat-libdns_sd-devel: before 0.8-11

avahi: before 0.8-11

CPE2.3

External links

http://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1793

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.