SB20231017153 - Anolis OS update for avahi

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Infinite loop (CVE-ID: CVE-2021-3468)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work() function. A local user can consume all available system resources and cause denial of service conditions.

2) Input validation error (CVE-ID: CVE-2023-1981)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A local user can initiate a DBUS call to the daemon and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2023:0575