MGASA-2017-0403

See a problem?
Please try reporting it to the source first.

Source

https://advisories.mageia.org/MGASA-2017-0403.html

Import Source

https://advisories.mageia.org/MGASA-2017-0403.json

JSON Data

https://api.osv.dev/v1/vulns/MGASA-2017-0403

Related

CVE-2017-12629

Published

2017-11-06T08:22:52Z

Modified

2017-11-06T08:03:50Z

Summary

Updated lucene packages fix security vulnerability

Details

It was found that the CoreParser class in Lucene accepts doctype declaration and expands external entities. An attacker could use this flaw to bypass security restrictions and access sensitive data (CVE-2017-12629).

References

Credits

- Mageia - COORDINATOR
- - https://wiki.mageia.org/en/Packages_Security_Team

Affected packages

Mageia:6 / lucene

Package

Name: lucene
Purl: pkg:rpm/mageia/lucene?distro=mageia-6

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.5.0-4.1.mga6

Ecosystem specific

{
    "section": "core"
}