ID

VAR-201410-1418

CVE

CVE-2014-3566

TITLE

OpenSSL Used in and other products SSL Vulnerability in obtaining plaintext data in the protocol

DESCRIPTION

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. This vulnerability "POODLE" It is called.Man-in-the-middle attacks (man-in-the-middle attack) May get plain text data through padding oracle attacks. SSL protocol is the abbreviation of Secure Socket Layer protocol (Secure Socket Layer) developed by Netscape, which provides security and data integrity guarantee for Internet communication. There is a security vulnerability in the SSL protocol 3.0 version used in OpenSSL 1.0.1i and earlier versions. HP Storage Data Protector Cell Manager v8 before v8.13_206 and v9 before v9.03MMR running on HP-UX 11i, Windows Server 2008/2008R2/2012/2012R2, Redhat, CentOS, Oracle Linux, and SUSE Linux_x64. Relevant releases/architectures: RHOSE Node 2.0 - noarch 3. Description: OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw allows a man-in-the-middle (MITM) attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections. Bugs fixed (https://bugzilla.redhat.com/): 1152789 - CVE-2014-3566 SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack 6. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: java-1.7.1-ibm security update Advisory ID: RHSA-2014:1880-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1880.html Issue date: 2014-11-20 CVE Names: CVE-2014-3065 CVE-2014-3566 CVE-2014-4288 CVE-2014-6456 CVE-2014-6457 CVE-2014-6458 CVE-2014-6476 CVE-2014-6492 CVE-2014-6493 CVE-2014-6502 CVE-2014-6503 CVE-2014-6506 CVE-2014-6511 CVE-2014-6512 CVE-2014-6515 CVE-2014-6527 CVE-2014-6531 CVE-2014-6532 CVE-2014-6558 ===================================================================== 1. Summary: Updated java-1.7.1-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 6 and 7 Supplementary. Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client Supplementary (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) - x86_64 Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64 Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Supplementary (v. 7) - ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 7) - x86_64 3. Description: IBM Java SE version 7 Release 1 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-3065, CVE-2014-3566, CVE-2014-4288, CVE-2014-6456, CVE-2014-6457, CVE-2014-6458, CVE-2014-6476, CVE-2014-6492, CVE-2014-6493, CVE-2014-6502, CVE-2014-6503, CVE-2014-6506, CVE-2014-6511, CVE-2014-6512, CVE-2014-6515, CVE-2014-6527, CVE-2014-6531, CVE-2014-6532, CVE-2014-6558) The CVE-2014-6512 issue was discovered by Florian Weimer of Red Hat Product Security. Note: With this update, the IBM SDK now disables the SSL 3.0 protocol to address the CVE-2014-3566 issue (also known as POODLE). Refer to the IBM article linked to in the References section for additional details about this change and instructions on how to re-enable SSL 3.0 support if needed. All users of java-1.7.1-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7R1 SR2 release. All running instances of IBM Java must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1071210 - CVE-2014-6512 OpenJDK: DatagramSocket connected socket missing source check (Libraries, 8039509) 1150155 - CVE-2014-6506 OpenJDK: insufficient permission checks when setting resource bundle on system logger (Libraries, 8041564) 1150651 - CVE-2014-6531 OpenJDK: insufficient ResourceBundle name check (Libraries, 8044274) 1150669 - CVE-2014-6502 OpenJDK: LogRecord use of incorrect CL when loading ResourceBundle (Libraries, 8042797) 1151046 - CVE-2014-6457 OpenJDK: Triple Handshake attack against TLS/SSL connections (JSSE, 8037066) 1151063 - CVE-2014-6558 OpenJDK: CipherInputStream incorrect exception handling (Security, 8037846) 1151517 - CVE-2014-6511 ICU: Layout Engine ContextualSubstitution missing boundary checks (JDK 2D, 8041540) 1152756 - CVE-2014-6532 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152757 - CVE-2014-6503 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152758 - CVE-2014-6456 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment) 1152759 - CVE-2014-6492 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152760 - CVE-2014-6493 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152761 - CVE-2014-4288 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152763 - CVE-2014-6458 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152765 - CVE-2014-6476 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment) 1152766 - CVE-2014-6515 Oracle JDK: unspecified vulnerability fixed in 6u85, 7u71 and 8u25 (Deployment) 1152767 - CVE-2014-6527 Oracle JDK: unspecified vulnerability fixed in 7u71 and 8u25 (Deployment) 1152789 - CVE-2014-3566 SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack 1162554 - CVE-2014-3065 IBM JDK: privilege escalation via shared class cache 6. Package List: Red Hat Enterprise Linux Desktop Supplementary (v. 6): i386: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el6_6.i686.rpm x86_64: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm Red Hat Enterprise Linux HPC Node Supplementary (v. 6): x86_64: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 6): i386: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el6_6.i686.rpm ppc64: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.ppc.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.ppc64.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el6_6.ppc64.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.ppc.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.ppc64.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el6_6.ppc64.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el6_6.ppc.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el6_6.ppc64.rpm s390x: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.s390.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.s390x.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el6_6.s390x.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.s390.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.s390x.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el6_6.s390x.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el6_6.s390x.rpm x86_64: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 6): i386: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el6_6.i686.rpm x86_64: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el6_6.x86_64.rpm Red Hat Enterprise Linux Client Supplementary (v. 7): x86_64: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.i686.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm Red Hat Enterprise Linux ComputeNode Supplementary (v. 7): x86_64: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.i686.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 7): ppc64: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.ppc.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.ppc64.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el7_0.ppc64.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.ppc.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.ppc64.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el7_0.ppc64.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el7_0.ppc.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el7_0.ppc64.rpm s390x: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.s390.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.s390x.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el7_0.s390x.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.s390.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.s390x.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el7_0.s390x.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el7_0.s390x.rpm x86_64: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.i686.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 7): x86_64: java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.i686.rpm java-1.7.1-ibm-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-demo-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.i686.rpm java-1.7.1-ibm-devel-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-jdbc-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-plugin-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm java-1.7.1-ibm-src-1.7.1.2.0-1jpp.3.el7_0.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2014-3065 https://access.redhat.com/security/cve/CVE-2014-3566 https://access.redhat.com/security/cve/CVE-2014-4288 https://access.redhat.com/security/cve/CVE-2014-6456 https://access.redhat.com/security/cve/CVE-2014-6457 https://access.redhat.com/security/cve/CVE-2014-6458 https://access.redhat.com/security/cve/CVE-2014-6476 https://access.redhat.com/security/cve/CVE-2014-6492 https://access.redhat.com/security/cve/CVE-2014-6493 https://access.redhat.com/security/cve/CVE-2014-6502 https://access.redhat.com/security/cve/CVE-2014-6503 https://access.redhat.com/security/cve/CVE-2014-6506 https://access.redhat.com/security/cve/CVE-2014-6511 https://access.redhat.com/security/cve/CVE-2014-6512 https://access.redhat.com/security/cve/CVE-2014-6515 https://access.redhat.com/security/cve/CVE-2014-6527 https://access.redhat.com/security/cve/CVE-2014-6531 https://access.redhat.com/security/cve/CVE-2014-6532 https://access.redhat.com/security/cve/CVE-2014-6558 https://access.redhat.com/security/updates/classification/#critical https://www.ibm.com/developerworks/java/jdk/alerts/ https://www-01.ibm.com/support/docview.wss?uid=swg21688165 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUbh0WXlSAg2UNWIIRAi2fAKDExQmcZYqy6INJOtUbpQK5QrXWUgCgmnhC K/vkNngAOzoTqWX0yFnSTr0= =nHUV -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04583581 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04583581 Version: 1 HPSBUX03281 SSRT101968 rev.1 - HP-UX running Java7, Remote Unauthorized Access, Disclosure of Information, and Other Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2015-03-10 Last Updated: 2015-03-10 Potential Security Impact: Remote unauthorized access, disclosure of information, and other vulnerabilities Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY Potential security vulnerabilities have been identified in the Java Runtime Environment (JRE) and the Java Developer Kit (JDK) running on HP-UX. These vulnerabilities could allow remote unauthorized access, disclosure of information, and other vulnerabilities. References: CVE-2014-3566 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0400 CVE-2015-0403 CVE-2015-0406 CVE-2015-0407 CVE-2015-0408 CVE-2015-4010 CVE-2015-0412 CVE-2015-0413 SSRT101968 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.23 and B.11.31 running HP JDK and JRE v7.0.11 and earlier. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-3566 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2014-6585 (AV:N/AC:H/Au:N/C:P/I:N/A:N) 2.6 CVE-2014-6587 (AV:L/AC:L/Au:S/C:P/I:P/A:P) 4.3 CVE-2014-6591 (AV:N/AC:H/Au:N/C:P/I:N/A:N) 2.6 CVE-2014-6593 (AV:N/AC:H/Au:N/C:P/I:P/A:N) 4.0 CVE-2014-6601 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2015-0383 (AV:L/AC:M/Au:N/C:N/I:P/A:C) 5.4 CVE-2015-0395 (AV:N/AC:M/Au:N/C:C/I:C/A:C) 9.3 CVE-2015-0400 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 CVE-2015-0403 (AV:L/AC:M/Au:N/C:C/I:C/A:C) 6.9 CVE-2015-0406 (AV:N/AC:M/Au:N/C:P/I:N/A:P) 5.8 CVE-2015-0407 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 CVE-2015-0408 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2015-0410 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2015-0412 (AV:L/AC:L/Au:N/C:C/I:C/A:C) 7.2 CVE-2015-0413 (AV:L/AC:M/Au:N/C:N/I:P/A:N) 1.9 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following Java version upgrade to resolve these vulnerabilities. The upgrade is available from the following location: http://www.hp.com/java OS Version Release Version HP-UX B.11.23, B.11.31 JDK and JRE v7.0.12 or subsequent MANUAL ACTIONS: Yes - Update For HP-UX 11i v2 and v3 update to Java v7.0.12 or subsequent PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.23 HP-UX B.11.31 =========== Jdk70.JDK70 Jdk70.JDK70-COM Jdk70.JDK70-IPF32 Jdk70.JDK70-IPF64 Jdk70.JDK70-DEMO Jre70.JRE70 Jre70.JRE70-COM Jre70.JRE70-COM-DOC Jre70.JRE70-IPF32 Jre70.JRE70-IPF32-HS Jre70.JRE70-IPF64 Jre70.JRE70-IPF64-HS action: install revision 1.7.0.12.00 or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 10 March 2015 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2015 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. A second vulnerability could be exploited to cause a Denial of Service (Dos). The update is available from HPE Software Depot: https://h20392.www2.hpe.com/ portal/swdepot/displayProductInfo.do?productNumber=HPVPRhttps://www.hpe.com Note: HPE recommends customers using OV4VC 7.8.1 and earlier should upgrade to OV4VC 7.8.2. This addresses all SSL security vulnerabilities reported through March 28, 2016. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-10-16-3 OS X Server v4.0 OS X Server v4.0 is now available and addresses the following: BIND Available for: OS X Yosemite v10.10 or later Impact: Multiple vulnerabilities in BIND, the most serious of which may lead to a denial of service Description: Multiple vulnerabilities existed in BIND. These issues were addressed by updating BIND to version 9.9.2-P2 CVE-ID CVE-2013-3919 CVE-2013-4854 CVE-2014-0591 CoreCollaboration Available for: OS X Yosemite v10.10 or later Impact: A remote attacker may be able to execute arbitrary SQL queries Description: A SQL injection issue existed in Wiki Server. This issue was addressed through additional validation of SQL queries. CVE-ID CVE-2014-4424 : Sajjad Pourali (sajjad@securation.com) of CERT of Ferdowsi University of Mashhad CoreCollaboration Available for: OS X Yosemite v10.10 or later Impact: Visiting a maliciously crafted website may lead to a cross- site scripting attack Description: A cross-site scripting issue existed in Xcode Server. This issue was addressed through improved encoding of HTML output. CVE-ID CVE-2014-4406 : David Hoyt of Hoyt LLC CoreCollaboration Available for: OS X Yosemite v10.10 or later Impact: Multiple vulnerabilities in PostgreSQL, the most serious of which may lead to arbitrary code execution Description: Multiple vulnerabilities existed in PostgreSQL. These issues were addressed by updating PostgreSQL to version 9.2.7. CVE-ID CVE-2014-0060 CVE-2014-0061 CVE-2014-0062 CVE-2014-0063 CVE-2014-0064 CVE-2014-0065 CVE-2014-0066 Mail Service Available for: OS X Yosemite v10.10 or later Impact: Group SACL changes for Mail may not be respected until after a restart of the Mail service Description: SACL settings for Mail were cached and changes to the SACLs were not respected until after a restart of the Mail service. This issue was addressed by resetting the cache upon changes to the SACLs. CVE-ID CVE-2014-4446 : Craig Courtney Profile Manager Available for: OS X Yosemite v10.10 or later Impact: Multiple vulnerabilities in LibYAML, the most serious of which may lead to arbitrary code execution Description: Multiple vulnerabilities existed in LibYAML. These issues were addressed by switching from YAML to JSON as Profile Manager's internal serialization format. CVE-ID CVE-2013-4164 CVE-2013-6393 Profile Manager Available for: OS X Yosemite v10.10 or later Impact: A local user may obtain passwords after setting up or editing profiles in Profile Manager Description: In certain circumstances, setting up or editing profiles in Profile Manager may have logged passwords to a file. This issue was addressed through improved handling of credentials. CVE-ID CVE-2014-4447 : Mayo Jordanov Server Available for: OS X Yosemite v10.10 or later Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of SSL 3.0 when a cipher suite uses a block cipher in CBC mode. An attacker could force the use of SSL 3.0, even when the server would support a better TLS version, by blocking TLS 1.0 and higher connection attempts. This issue was addressed by disabling SSL 3.0 support in Web Server, Calendar & Contacts Server, and Remote Administration. CVE-ID CVE-2014-3566 : Bodo Moeller, Thai Duong, and Krzysztof Kotowicz of Google Security Team ServerRuby Available for: OS X Yosemite v10.10 or later Impact: Running a Ruby script that handles untrusted YAML tags may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow issue existed in LibYAML's handling of YAML tags. This issue was addressed through additional validation of YAML tags. This issue does not affect systems prior to OS X Mavericks. CVE-ID CVE-2013-6393 OS X Server v4.0 may be obtained from the Mac App Store. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201606-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: claws-mail: Multiple Vulnerabilities Date: June 26, 2016 Bugs: #525588, #569010, #570692 ID: 201606-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in claws-mail, particularly in the default SSL implementation. Background ========== Claws Mail is a GTK based e-mail client. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 mail-client/claws-mail < 3.13.2 >= 3.13.2 Description =========== Multiple vulnerabilities have been discovered in claws-mail. Please review the CVE identifiers referenced below for details. Impact ====== An attacker could possibly intercept communications due to the default implementation of SSL 3.0. Workaround ========== There is no known workaround at this time. Resolution ========== All claws-mail users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/claws-mail-3.13.2" References ========== [ 1 ] CVE-2014-3566 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3566 [ 2 ] CVE-2015-8614 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8614 [ 3 ] CVE-2015-8614 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8614 [ 4 ] CVE-2015-8708 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8708 [ 5 ] CVE-2015-8708 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8708 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201606-11 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . HP has released the following updates to resolve this vulnerability for HP Vertica products. Update to the latest VM image available at: https://my.vertica.com For customers using the AMI version of the HP Vertica Analytics platform, please install the latest image available at Amazon

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

encryption problem

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES