Sabuntawa don Java SE, MySQL, VirtualBox da sauran samfuran Oracle tare da ƙayyadaddun lahani

Kamfanin Oracle aka buga shirin sakin sabuntawa ga samfuran sa (Critical Patch Update), da nufin kawar da matsaloli masu mahimmanci da lahani. A cikin Janairu update, jimlar 397 rauni.

A cikin batutuwa Java SE 14.0.1, 11.0.7 da 8u251 shafe 15 matsalolin tsaro. Ana iya amfani da duk lahani daga nesa ba tare da tantancewa ba. Matsayi mafi girma shine 8.3, wanda aka sanya shi ga matsaloli a cikin ɗakunan karatu (CVE-2020-2803, CVE-2020-2805). Lalacewar biyu (a cikin libxslt da JSSE) suna da matakan tsanani na 8.1 da 7.5.

Baya ga batutuwan da ke cikin Java SE, an bayyana lahani a cikin wasu samfuran Oracle, gami da:

• 35 rauni a cikin uwar garken MySQL kuma
  2 rauni a cikin aiwatar da abokin ciniki na MySQL (C API). Mafi girman matakin 9.8 an sanya shi zuwa ga raunin CVE-2019-5482, wanda ke bayyana lokacin da aka haɗa shi tare da tallafin cURL. Matsalolin da aka gyara a cikin fitarwa MySQL Community Server 8.0.20, 5.7.30 da 5.6.49.

• 19 rauni, wanda matsalolin 7 suna da matsayi mai mahimmanci na haɗari (CVSS mafi girma fiye da 8). Wannan ya haɗa da gyara lahanin da aka yi amfani da su a harin da aka nuna a gasar Pwn2Own 2020 da kuma ba da izini, ta hanyar magudi a gefen tsarin baƙo, don samun damar shiga tsarin mai watsa shiri da aiwatar da lambar tare da haƙƙin hypervisor. An gyara lahani a cikin sabuntawa VirtualBox 6.1.6, 6.0.20 da 5.2.40.
• 6 rauni in Solaris. Matsakaicin matakin haɗari 8.8 - ana sarrafa shi cikin gida matsala a cikin Muhallin Desktop na gama gari, ƙyale mai amfani mara gata don aiwatar da lamba tare da tushen gata. An kuma daidaita batutuwa a cikin tsarin kernel da ke aiwatar da ka'idar SMB, a cikin Whodo, da kuma a cikin umarnin SMF na svcbundle. Abubuwan da aka gyara a cikin sabuntawar jiya Farashin 11.4 SRU 20.

source: budenet.ru