VARIoT IoT vulnerabilities database

VAR-201902-0312	CVE-2019-7736	D-Link DIR-600M Authentication vulnerabilities in devices	CVSS V2: 7.5 CVSS V3: 9.8 Severity: CRITICAL

D-Link DIR-600M C1 3.04 devices allow authentication bypass via a direct request to the wan.htm page. NOTE: this may overlap CVE-2019-13101. D-Link DIR-600M The device contains an authentication vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-LinkDIR-600MC1 is a wireless router from (D-Link). A security vulnerability exists in the D-LinkDIR-600MC version 13.04. This vulnerability stems from the lack of authentication measures or insufficient authentication strength in network systems or products

VAR-201905-0417	CVE-2019-7564	Shenzhen Coship WM3300 WiFi Vulnerabilities related to certificate and password management in router devices	CVSS V2: 7.5 CVSS V3: 9.8 Severity: CRITICAL

An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. The password reset functionality of the Wireless SSID doesn't require any type of authentication. By making a POST request to the regx/wireless/wl_security_2G.asp URI, the attacker can change the password of the Wi-FI network. Shenzhen Coship WM3300 WiFi Router devices contain vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Coship Wireless Router is a wireless router produced by China Coship Electronics (Coship). There are security vulnerabilities in Coship Wireless Router versions 4.0.0.x and 5.0.0.x. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements

VAR-201903-1284	CVE-2018-19524	plural Skyworth Vulnerability related to input validation in device products	CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL

An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOTBGN1, and DT741-cb SDOTBGN1 devices. A long password to the Web_passwd function allows remote attackers to cause a denial of service (segmentation fault) or achieve unauthenticated remote code execution because of control of registers S0 through S4 and T4 through T7. Skyworth DT741 , DT721-cb , DT741-cb The device contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. There is an input validation error vulnerability in Skyworth GPON HomeGateways and Optical Network terminals. The vulnerability originates from incorrect verification of data boundaries when network systems or products perform operations on memory, resulting in incorrect read and write operations to other associated memory locations. Attackers can exploit this vulnerability to cause buffer overflow or heap overflow, etc. The following products and versions are affected: DT741 Converged Intelligent Terminal (G/EPON+IPTV); DT741 Converged Intelligent Terminal (G/EPON+IPTV); DT721-cb GPON uplink home gateway (GPON+2FE+1POTS); DT721-cb GPON Uplink Home Gateway (GPON+2FE+1POTS); DT741-cb GPON uplink home gateway (GPON+4FE+1POTS+WIFI+USB); DT741-cb GPON Uplink Home Gateway (GPON+4FE+1POTS+WIFI+USB); DT741 -cbGPON uplink home gateway DT741-cb

VAR-201903-0122	CVE-2019-3821	civetWeb Resource management vulnerability	CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH

A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. An unauthenticated attacker could create multiple connections to ceph RADOS gateway to exhaust file descriptors for ceph-radosgw service resulting in a remote denial of service. civetWeb Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. RedHat Ceph is prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to cause denial-of-service conditions. ========================================================================== Ubuntu Security Notice USN-4035-1 June 25, 2019 ceph vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 19.04 - Ubuntu 18.10 - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Ceph. Software Description: - ceph: distributed storage and file system Details: It was discovered that Ceph incorrectly handled read only permissions. An authenticated attacker could use this issue to obtain dm-crypt encryption keys. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-14662) It was discovered that Ceph incorrectly handled certain OMAPs holding bucket indices. This issue only affected Ubuntu 16.04 LTS. (CVE-2018-16846) It was discovered that Ceph incorrectly sanitized certain debug logs. A local attacker could possibly use this issue to obtain encryption key information. This issue was only addressed in Ubuntu 18.10 and Ubuntu 19.04. (CVE-2018-16889) It was discovered that Ceph incorrectly handled certain civetweb requests. This issue only affected Ubuntu 18.10 and Ubuntu 19.04. (CVE-2019-3821) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 19.04: ceph 13.2.4+dfsg1-0ubuntu2.1 ceph-common 13.2.4+dfsg1-0ubuntu2.1 Ubuntu 18.10: ceph 13.2.4+dfsg1-0ubuntu0.18.10.2 ceph-common 13.2.4+dfsg1-0ubuntu0.18.10.2 Ubuntu 16.04 LTS: ceph 10.2.11-0ubuntu0.16.04.2 ceph-common 10.2.11-0ubuntu0.16.04.2 In general, a standard system update will make all the necessary changes. References: https://usn.ubuntu.com/4035-1 CVE-2018-14662, CVE-2018-16846, CVE-2018-16889, CVE-2019-3821 Package Information: https://launchpad.net/ubuntu/+source/ceph/13.2.4+dfsg1-0ubuntu2.1 https://launchpad.net/ubuntu/+source/ceph/13.2.4+dfsg1-0ubuntu0.18.10.2 https://launchpad.net/ubuntu/+source/ceph/10.2.11-0ubuntu0.16.04.2

VAR-201902-0279	CVE-2019-7674	MOBOTIX S14 Vulnerability in certificate / password management on devices	CVSS V2: 5.0 CVSS V3: 9.8 Severity: CRITICAL

An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. /admin/access accepts a request to set the "aaaaa" password, considered insecure for some use cases, from a user. MOBOTIX S14 The device contains a certificate / password management vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. MOBOTIX S14 is a network camera produced by German MOBOTIX company. There is a security vulnerability in MOBOTIX S14 MX-V4.2.1.61 version. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements

VAR-201902-0280	CVE-2019-7675	MOBOTIX S14 Authentication vulnerabilities in devices	CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH

An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. The default management application is delivered over cleartext HTTP with Basic Authentication, as demonstrated by the /admin/index.html URI. MOBOTIX S14 The device contains an authentication vulnerability.Information may be obtained. MOBOTIX S14 is a network camera produced by German MOBOTIX company. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements

VAR-201902-0278	CVE-2019-7673	MOBOTIX S14 Information disclosure vulnerability in devices	CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH

An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. Administrator Credentials are stored in the 13-character DES hash format. MOBOTIX S14 The device contains an information disclosure vulnerability.Information may be obtained. MOBOTIX S14 is a network camera produced by German MOBOTIX company. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements

VAR-201902-0281	CVE-2019-7676	Enphase Envoy Vulnerabilities related to certificate and password management	CVSS V2: 6.5 CVSS V3: 7.2 Severity: HIGH

A weak password vulnerability was discovered in Enphase Envoy R3.*.*. One can login via TCP port 8888 with the admin password for the admin account. Enphase Envoy Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Enphase Envoy is the core home energy control gateway in Enphase Energy's home energy solution. Allows remote attackers to use vulnerabilities to submit special requests and unauthorized access to applications

VAR-201902-0001	CVE-2009-5154	MOBOTIX S14 Vulnerabilities related to the use of hard-coded credentials on devices	CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL

An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. There is a default password of meinsm for the admin account. MOBOTIX S14 The device contains a vulnerability related to the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. MOBOTIX S14 is a network camera produced by German MOBOTIX company. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements

VAR-201903-0464	CVE-2019-7421	SAMSUNG X7400GX SyncThru Web Service Vulnerable to cross-site scripting	CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM

SAMSUNG X7400GX SyncThru Web Service Contains a cross-site scripting vulnerability.The information may be obtained and the information may be falsified. The vulnerability stems from the lack of correct verification of client data in WEB applications. An attacker could exploit this vulnerability to execute client code.

VAR-201903-0463	CVE-2019-7420	SAMSUNG X7400GX SyncThru Web Service Vulnerable to cross-site scripting	CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM

XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in "/sws.application/information/networkinformationView.sws" in the tabName parameter. The vulnerability stems from the lack of correct verification of client data in WEB applications. An attacker could exploit this vulnerability to execute client code.

VAR-201903-0462	CVE-2019-7419	SAMSUNG X7400GX SyncThru Web Service Vulnerable to cross-site scripting	CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM

SAMSUNG X7400GX SyncThru Web Service Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. The vulnerability stems from the lack of correct verification of client data in WEB applications. An attacker could exploit this vulnerability to execute client code.

VAR-201902-0255	CVE-2019-7632	plural LifeSize Product In OS Command injection vulnerability	CVSS V2: 9.0 CVSS V3: 8.8 Severity: HIGH

LifeSize Team, Room, Passport, and Networker 220 devices allow Authenticated Remote OS Command Injection, as demonstrated by shell metacharacters in the support/mtusize.php mtu_size parameter. The lifesize default password for the cli account may sometimes be used for authentication. plural LifeSize Product Is OS A command injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. LifeSize Team and others are a set of video conferencing solutions of American LifeSize Company. An operating system command injection vulnerability exists in several LifeSize products. An attacker could exploit this vulnerability to inject and run code on the system

VAR-201904-1069	CVE-2019-0199	Apache Tomcat Vulnerable to resource exhaustion	CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. Apache Tomcat Contains a resource exhaustion vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Apache Tomcat is a lightweight web application server from the Apache Software Foundation. This program implements support for Servlet and JavaServerPage (JSP). There is a security vulnerability in Apache Tomcat. An attacker could exploit the vulnerability to cause a denial of service. Attackers may leverage this issue to cause denial-of-service conditions. A vulnerability in Apache Tomcat could allow an unauthenticated, remote malicious user to cause a denial of service (DoS) condition on a targeted system. The vulnerability is due to a resource exhaustion condition in the HTTP/2 implementation of the affected software. A successful exploit could result in a DoS condition on the targeted system. Apache has confirmed the vulnerability and released software updates. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4596-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff December 27, 2019 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : tomcat8 CVE ID : CVE-2018-8014 CVE-2018-11784 CVE-2019-0199 CVE-2019-0221 CVE-2019-12418 CVE-2019-17563 Several issues were discovered in the Tomcat servlet and JSP engine, which could result in session fixation attacks, information disclosure, cross- site scripting, denial of service via resource exhaustion and insecure redirects. For the oldstable distribution (stretch), these problems have been fixed in version 8.5.50-0+deb9u1. This update also requires an updated version of tomcat-native which has been updated to 1.2.21-1~deb9u1. We recommend that you upgrade your tomcat8 packages. For the detailed security status of tomcat8 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/tomcat8 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl4GgDcACgkQEMKTtsN8 TjaVxA//dmUGPdFZSI6VW/avTJ8YKIgVaKTLJz47hl9GKWJoGI4lG5TE4INs193y xKf2gtuPb/YCdqZj2VphPTiPiIbycXrRXTq9uGnioteeAZfgKnqSokcQ+EvUItsp Q7nBeuFNdSHaK1TAQ74Ty4qcwM/WXQ5c0UfZvAbMzYp3PRrkHkMXhUHMj7MJNz7W 6I/ehY+h+VkvTj7P6U3icEoLsTqOwKiHFiAVKD9DiUZqRI62nmbMW2il1zgF3pOZ QNrDGhNsaVfhJbIES3/vuF/qSQIm6GryQ1dwxbFBszemdHTGEQmANsxLLXWnPDH1 2KigZh5bkSlQZvJRHgbJp+LdM+DSY7VI1KtwTIkpwFZ2/kbz+kMGGT+TQplSORyL IY9SK1aQduWBx2yi3X7/wPXVdV7KA1cMCPhSt8fVieYxZWtONALBuCdnSSEweIEq myd2GD75QIHjZy7JZoVc421kCjH4IrXxuwEQDkHjKTladjdklOREEocAc8R+NjSS kUKdS2cOel6M2yjH/ieOv3DVaUPplgl+0KJGXqAhdkCQUwTMsw1tmR/ObWkCHQov k79Isubwc5kuQD/iBCuIQM8TgfNcyWXNAyHbpKR7kGkrn/ihN7dsCdvRjrMPrvRJ x/PLd3rjlgS5D1cEf7PTZZjym4mwDPrKgamSt9V3f3RwFwV75vY= =je4v -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat support for Spring Boot 2.1.12 security and bug fix update Advisory ID: RHSA-2020:2366-01 Product: Red Hat OpenShift Application Runtimes Advisory URL: https://access.redhat.com/errata/RHSA-2020:2366 Issue date: 2020-06-04 CVE Names: CVE-2019-0199 CVE-2019-3868 CVE-2019-3875 CVE-2019-10199 CVE-2019-10201 CVE-2019-14832 ===================================================================== 1. Summary: An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. [NOTE: This security advisory was unintentionally omitted at the time of the initial software release on 2020-02-18. The advisory is informational only; no files in the release have changed.] 2. Description: Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications (monoliths and microservices) for OpenShift as a containerized platform. This release of Red Hat support for Spring Boot 2.1.12 serves as a replacement for Red Hat support for Spring Boot 2.1.6, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section. Security Fix(es): * tomcat: Apache Tomcat HTTP/2 DoS (CVE-2019-0199) * keycloak: SAML broker does not check existence of signature on document allowing any user impersonation (CVE-2019-10201) * keycloak: session hijack using the user access token (CVE-2019-3868) * keycloak: missing signatures validation on CRL used to verify client certificates (CVE-2019-3875) * keycloak: CSRF check missing in My Resources functionality in the Account Console (CVE-2019-10199) * keycloak: cross-realm user access auth bypass (CVE-2019-14832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1679144 - CVE-2019-3868 keycloak: session hijack using the user access token 1690628 - CVE-2019-3875 keycloak: missing signatures validation on CRL used to verify client certificates 1693325 - CVE-2019-0199 tomcat: Apache Tomcat HTTP/2 DoS 1728609 - CVE-2019-10201 keycloak: SAML broker does not check existence of signature on document allowing any user impersonation 1729261 - CVE-2019-10199 keycloak: CSRF check missing in My Resources functionality in the Account Console 1749487 - CVE-2019-14832 keycloak: cross-realm user access auth bypass 5. References: https://access.redhat.com/security/cve/CVE-2019-0199 https://access.redhat.com/security/cve/CVE-2019-3868 https://access.redhat.com/security/cve/CVE-2019-3875 https://access.redhat.com/security/cve/CVE-2019-10199 https://access.redhat.com/security/cve/CVE-2019-10201 https://access.redhat.com/security/cve/CVE-2019-14832 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=catRhoar.spring.boot&downloadType=distributions&version=2.1.12 https://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/ 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXtjx9tzjgjWX9erEAQhFOA//Tkk46vAF4/aJiKVApEHvF5R96081W2Hq G96k3lUPuatTrcD/2yek9whs1Bf9MQgWcaFWCgx63nsNs6Mm81frsR/dt4YV8mWc 97y4u6kz6nvQQ6Wz6Xuic9km17/yXuNl5JqgmcLtltgNhtWgZhpQUKfbP3ot0T2X FStJvnZlPrgDnpnVZ8y6x++otaDfbXGiy2FyGepXei8WWxXtQ/XYPoQC/mYbuXgM eUNsFLEyY9hWLCE4vfavLCM4fHs+djrL2E6N431JhpLyCrbTx0nYkaMkoOoJlLe2 agJjBzd5iYnBbD6p9K5okIWR1U2gNsdV6Q7UROTLiEFoxBOr1hO1mzqYkJ80t1Pm d48N7OuQ4MhYgiKftVDmsVgXuQzySUrjZWnZZnDbVZo02gwD8T1NXgq9zCX64/sl ucKvbDnnmLDYQYsKRCjf1aH1ZDrrPOPIOkTbMlb4+Wqc/O8jrRfzvya0ym9wnN8v CG3VmxPBPeNgp6/pmTBrJU9c+dER9qmavAB77Vl09dH88V9Ne4GLiVfqSVOEhY1w vwZo31fNXNYFYT/NV2v9CiZwrRcsqn60VH0E4Qc+zTOb5esR7bIidcBMGtPm+BI0 80uR7D6DwjVmZsfzwakCIiGMaChysonql+P72iOd2Xerj7osdvMSEQHSVSjuILh7 wiv1ksQVw/s= =pUHq -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

VAR-201903-0461	CVE-2019-7418	SAMSUNG X7400GX SyncThru Web Service Vulnerable to cross-site scripting	CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM

SAMSUNG X7400GX SyncThru Web Service Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered.

VAR-201902-0692	CVE-2018-9190	Fortinet FortiClientWindows In NULL Pointer dereference vulnerability	CVSS V2: 4.9 CVSS V3: 5.5 Severity: MEDIUM

A null pointer dereference vulnerability in Fortinet FortiClientWindows 6.0.2 and earlier allows attacker to cause a denial of service via the NDIS miniport driver. Fortinet FortiClientWindows is a Windows-based mobile terminal security solution developed by Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to FortiGate firewall appliances

VAR-201903-0447	CVE-2019-6223	plural Apple Updates to product vulnerabilities	CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH

A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * group FaceTime Unintentional response to incoming calls * Privilege escalation * Arbitrary code execution * information leak * Sandbox avoidance. in the United States. Apple iOS is an operating system developed for mobile devices. FaceTime is one of those video calling software. The vulnerability stems from configuration errors in the network system or product during operation. An unauthorized attacker could exploit the vulnerability to obtain sensitive information of the affected components. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-2-07-1 iOS 12.1.4 iOS 12.1.4 is now available and addresses the following: FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: The initiator of a Group FaceTime call may be able to cause the recipient to answer Description: A logic issue existed in the handling of Group FaceTime calls. CVE-2019-6223: Grant Thompson of Catalina Foothills High School, Daven Morris of Arlington, TX Foundation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2019-7286: an anonymous researcher, Clement Lecigne of Google Threat Analysis Group, Ian Beer of Google Project Zero, and Samuel GroA of Google Project Zero IOKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2019-7287: an anonymous researcher, Clement Lecigne of Google Threat Analysis Group, Ian Beer of Google Project Zero, and Samuel GroA of Google Project Zero Live Photos in FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A thorough security audit of the FaceTime service uncovered an issue with Live Photos Description: The issue was addressed with improved validation on the FaceTime server. CVE-2019-7288: Apple Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.4". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlxcZmkpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F9HRAA sYhaZOf89H/kgxsBJbnJWa4g3Gi+OVgw2cfLkLT8GlAa2tZW+9pvra8cYZZ2TlvV 20UNupWr5sJPru+OWMiEYGRvVBQI5UaIRyIR4IsRbDcbvKe4ml0WM5t96PA1y5wt vhV9CKFwJY40k9PAWbb87eHf1kf8W6yCNAmddskSVFtgPBmGmZX4+u5OTY1YjIyc ilOKOJAsgnn/E+OGZ8RiDcQljY3CruzdCBecczt0QkzuXuvoSlL9RujOBtjZ/uLd cDorb7v0I9PokAdYAksEmgXFL8PDsm5h4ELkS3/Cp4RF8krdybB/4RN3SosWNBpA 99jMxgA5Mc+yLdIwPM9WUd/iq51KkYx+MLXYWzJwplnqQAQYW9p0+wTGTmEB+2x5 wStyUhMGbh3u5u3HBSLx31q2lkbTZU6+/kcqe6aQX0NckJBXV/+yGylQNcKN6XDk vWb9pCOjfpv5WyqvJ7XgNoX5CQcLt6WzJ0onZoVrhJoEnm2T0TKC/Tv2OCs9eJzb SgjAmKmavEaebSUa2StV4JfoNVPt7ijZdu+theAoObVrrktiWGX04srqyFaLZd/w 57NvpxizrLDNUWLmuuELQ9m1zL+xCLbJp46y1EaojjkaFw4H/7+U9nuKtg6+8ay/ o2nlJlEaOnQzrL+jp7mLvW05upIw0Ii/fyKTCQmbKSg= =p+hh -----END PGP SIGNATURE----- . This build contains the security content described in this article

VAR-201902-0242	CVE-2019-6974	Linux kernel Resource Management Error Vulnerability	CVSS V2: 6.8 CVSS V3: 8.1 Severity: HIGH

In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free. Linux kernel is prone to a security bypass vulnerability. Attackers can exploit this issue to bypass security restrictions to perform unauthorized actions; this may aid in launching further attacks. Versions prior to Linux kernel 4.20.8 are vulnerable. 7.5) - ppc64, ppc64le, x86_64 3. Bug Fix(es): * A cluster node has multiple hung "mv" processes that are accessing a gfs2 filesystem. (BZ#1716321) * Growing unreclaimable slab memory (BZ#1741918) * [LLNL 7.5 Bug] slab leak causing a crash when using kmem control group (BZ#1748236) * kernel build: parallelize redhat/mod-sign.sh (BZ#1755328) * kernel build: speed up module compression step (BZ#1755337) 4. ========================================================================== Ubuntu Security Notice USN-3930-2 April 02, 2019 linux-hwe, linux-azure vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS Summary: Several security issues were fixed in the Linux kernel. Software Description: - linux-azure: Linux kernel for Microsoft Azure Cloud systems - linux-hwe: Linux hardware enablement (HWE) kernel Details: USN-3930-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS. Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate attacker could use this to cause a denial of service (system crash). (CVE-2018-19824) Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information leak in the Bluetooth implementation of the Linux kernel. An attacker within Bluetooth range could use this to expose sensitive information (kernel memory). An attacker in a guest VM with access to /dev/kvm could use this to cause a denial of service (guest VM crash). (CVE-2019-6974) Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system. (CVE-2019-7221) Felix Wilhelm discovered that an information leak vulnerability existed in the KVM subsystem of the Linux kernel, when nested virtualization is used. A local attacker could use this to expose sensitive information (host system memory to a guest VM). (CVE-2019-7222) Jann Horn discovered that the eBPF implementation in the Linux kernel was insufficiently hardened against Spectre V1 attacks. A local attacker could use this to expose sensitive information. (CVE-2019-7308) It was discovered that a use-after-free vulnerability existed in the user- space API for crypto (af_alg) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-8956) It was discovered that the Linux kernel did not properly deallocate memory when handling certain errors while reading files. A local attacker could use this to cause a denial of service (excessive memory consumption). A local attacker with access to the IPMI character device files could use this to cause a denial of service (system crash). (CVE-2019-9003) Jann Horn discovered that the SNMP NAT implementation in the Linux kernel performed insufficient ASN.1 length checks. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-9162) Jann Horn discovered that the mmap implementation in the Linux kernel did not properly check for the mmap minimum address in some situations. A local attacker could use this to assist exploiting a kernel NULL pointer dereference vulnerability. (CVE-2019-9213) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: linux-image-4.18.0-1014-azure 4.18.0-1014.14~18.04.1 linux-image-4.18.0-17-generic 4.18.0-17.18~18.04.1 linux-image-4.18.0-17-generic-lpae 4.18.0-17.18~18.04.1 linux-image-4.18.0-17-lowlatency 4.18.0-17.18~18.04.1 linux-image-4.18.0-17-snapdragon 4.18.0-17.18~18.04.1 linux-image-azure 4.18.0.1014.13 linux-image-generic-hwe-18.04 4.18.0.17.67 linux-image-generic-lpae-hwe-18.04 4.18.0.17.67 linux-image-lowlatency-hwe-18.04 4.18.0.17.67 linux-image-snapdragon-hwe-18.04 4.18.0.17.67 linux-image-virtual-hwe-18.04 4.18.0.17.67 After a standard system update you need to reboot your computer to make all the necessary changes. ATTENTION: Due to an unavoidable ABI change the kernel updates have been given a new version number, which requires you to recompile and reinstall all third party kernel modules you might have installed. Unless you manually uninstalled the standard kernel metapackages (e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual, linux-powerpc), a standard system upgrade will automatically perform this as well. References: https://usn.ubuntu.com/usn/usn-3930-2 https://usn.ubuntu.com/usn/usn-3930-1 CVE-2018-19824, CVE-2019-3459, CVE-2019-3460, CVE-2019-6974, CVE-2019-7221, CVE-2019-7222, CVE-2019-7308, CVE-2019-8912, CVE-2019-8956, CVE-2019-8980, CVE-2019-9003, CVE-2019-9162, CVE-2019-9213 Package Information: https://launchpad.net/ubuntu/+source/linux-azure/4.18.0-1014.14~18.04.1 https://launchpad.net/ubuntu/+source/linux-hwe/4.18.0-17.18~18.04.1 . Description: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Bug Fix(es): * VM hangs on RHEL rt-kernel and OSP 13 [rhel-7.6.z] (BZ#1688673) * kernel-rt: update to the RHEL7.6.z batch#4 source tree (BZ#1689417) Users of kernel are advised to upgrade to these updated packages, which fix these bugs. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2020:0103-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:0103 Issue date: 2020-01-14 CVE Names: CVE-2018-10853 CVE-2018-18281 CVE-2018-20856 CVE-2019-6974 CVE-2019-11599 ==================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 7.4) - noarch, x86_64 Red Hat Enterprise Linux Server E4S (v. 7.4) - noarch, ppc64le, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 7.4) - x86_64 Red Hat Enterprise Linux Server Optional E4S (v. 7.4) - ppc64le, x86_64 Red Hat Enterprise Linux Server Optional TUS (v. 7.4) - x86_64 Red Hat Enterprise Linux Server TUS (v. 7.4) - noarch, x86_64 3. Security Fix(es): * kernel: Use-after-free in __blk_drain_queue() function in block/blk-core.c (CVE-2018-20856) * Kernel: KVM: potential use-after-free via kvm_ioctl_create_device() (CVE-2019-6974) * kernel: kvm: guest userspace to guest kernel write (CVE-2018-10853) * kernel: TLB flush happens too late on mremap (CVE-2018-18281) * kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping (CVE-2019-11599) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * guest softlockup in mem_cgroup_reparent_charges with 800GB guests (BZ#1770111) * [RHEL7.7] Refined TSC clocksource calibration occasionally fails on some SkyLake-X servers (BZ#1775682) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1589890 - CVE-2018-10853 kernel: kvm: guest userspace to guest kernel write 1645121 - CVE-2018-18281 kernel: TLB flush happens too late on mremap 1671913 - CVE-2019-6974 Kernel: KVM: potential use-after-free via kvm_ioctl_create_device() 1705937 - CVE-2019-11599 kernel: fix race condition between mmget_not_zero()/get_task_mm() and core dumping 1738705 - CVE-2018-20856 kernel: Use-after-free in __blk_drain_queue() function in block/blk-core.c 6. Package List: Red Hat Enterprise Linux Server AUS (v. 7.4): Source: kernel-3.10.0-693.62.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-693.62.1.el7.noarch.rpm kernel-doc-3.10.0-693.62.1.el7.noarch.rpm x86_64: kernel-3.10.0-693.62.1.el7.x86_64.rpm kernel-debug-3.10.0-693.62.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.62.1.el7.x86_64.rpm kernel-devel-3.10.0-693.62.1.el7.x86_64.rpm kernel-headers-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.62.1.el7.x86_64.rpm perf-3.10.0-693.62.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm python-perf-3.10.0-693.62.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm Red Hat Enterprise Linux Server E4S (v. 7.4): Source: kernel-3.10.0-693.62.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-693.62.1.el7.noarch.rpm kernel-doc-3.10.0-693.62.1.el7.noarch.rpm ppc64le: kernel-3.10.0-693.62.1.el7.ppc64le.rpm kernel-bootwrapper-3.10.0-693.62.1.el7.ppc64le.rpm kernel-debug-3.10.0-693.62.1.el7.ppc64le.rpm kernel-debug-debuginfo-3.10.0-693.62.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-693.62.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-693.62.1.el7.ppc64le.rpm kernel-devel-3.10.0-693.62.1.el7.ppc64le.rpm kernel-headers-3.10.0-693.62.1.el7.ppc64le.rpm kernel-tools-3.10.0-693.62.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-693.62.1.el7.ppc64le.rpm kernel-tools-libs-3.10.0-693.62.1.el7.ppc64le.rpm perf-3.10.0-693.62.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-693.62.1.el7.ppc64le.rpm python-perf-3.10.0-693.62.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-693.62.1.el7.ppc64le.rpm x86_64: kernel-3.10.0-693.62.1.el7.x86_64.rpm kernel-debug-3.10.0-693.62.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.62.1.el7.x86_64.rpm kernel-devel-3.10.0-693.62.1.el7.x86_64.rpm kernel-headers-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.62.1.el7.x86_64.rpm perf-3.10.0-693.62.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm python-perf-3.10.0-693.62.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm Red Hat Enterprise Linux Server TUS (v. 7.4): Source: kernel-3.10.0-693.62.1.el7.src.rpm noarch: kernel-abi-whitelists-3.10.0-693.62.1.el7.noarch.rpm kernel-doc-3.10.0-693.62.1.el7.noarch.rpm x86_64: kernel-3.10.0-693.62.1.el7.x86_64.rpm kernel-debug-3.10.0-693.62.1.el7.x86_64.rpm kernel-debug-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debug-devel-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.62.1.el7.x86_64.rpm kernel-devel-3.10.0-693.62.1.el7.x86_64.rpm kernel-headers-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-libs-3.10.0-693.62.1.el7.x86_64.rpm perf-3.10.0-693.62.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm python-perf-3.10.0-693.62.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 7.4): x86_64: kernel-debug-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.62.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional E4S (v. 7.4): ppc64le: kernel-debug-debuginfo-3.10.0-693.62.1.el7.ppc64le.rpm kernel-debug-devel-3.10.0-693.62.1.el7.ppc64le.rpm kernel-debuginfo-3.10.0-693.62.1.el7.ppc64le.rpm kernel-debuginfo-common-ppc64le-3.10.0-693.62.1.el7.ppc64le.rpm kernel-tools-debuginfo-3.10.0-693.62.1.el7.ppc64le.rpm kernel-tools-libs-devel-3.10.0-693.62.1.el7.ppc64le.rpm perf-debuginfo-3.10.0-693.62.1.el7.ppc64le.rpm python-perf-debuginfo-3.10.0-693.62.1.el7.ppc64le.rpm x86_64: kernel-debug-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.62.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Optional TUS (v. 7.4): x86_64: kernel-debug-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-debuginfo-common-x86_64-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm kernel-tools-libs-devel-3.10.0-693.62.1.el7.x86_64.rpm perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm python-perf-debuginfo-3.10.0-693.62.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXh3j4tzjgjWX9erEAQgrsA/7BKPcBbg2RX7I5HWuL2oC26IWdlrmbC+9 3wjegJPnhVuPkRXGWb7fCC4yVe4VjoeVRBN2HRCsyU4q9d9oPnVwldrRwzElGQdJ v93Ac7aOwy4fZMD8rwukWaPd9OmQnT/hM7cLAbozSqL+tBRo1G2fjuE1sBscIZDB qFHqRWA/nup6Qm8miiz/vnnEZCukXRMzgk8NO6jMjUR0TQ65hMZc0TTrElZZ99Z6 Bcm7C2nnw3CK0ewJewxPS21d/r4Rs7dpGF/6xjnsAzSPpO6HhzBmSTDoHe8uhsz7 lfjh79KcljPTe+mG1iO0E4l9aNnpNRWd7XZ4JVpQw6Ne47XGTMiybLivfPKo141q WlyfSdxxgyPZjI1xejmt/eqLiliTiuTj65Hlf8yn76DZOCGg22KZUNg1K8U/RWGz mlM34oeozfamjRNXYAibIW9zW65Y9DZ+sM6NLVulcYFGkqsX/t5yE3otkMUzDilK 6nLnXZ7Uu8jJz89mLWcNVY/mKBFP5WNsyZdThFt4q7koNwwNviHDSzQzyTTsgMwd P7sBoOYpqevd+WA/qS103ZyrEurjM/yFbNcbQDJcrT9SgV00YBzAkyGXz4IJ5Jy9 0DNYTkOwKhfbG+WLfQwvfL9FYv5TkkjHy6BIcOjzbQXM/pQAR5AybYOPROoi/Q7R R0SZU3D8SVo=IHlt -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . M. 7) - aarch64, noarch, ppc64le 3. Bug Fix(es): * [kernel-alt]: BUG: unable to handle kernel NULL pointer IP: crypto_remove_spawns+0x118/0x2e0 (BZ#1536967) * [HPE Apache] update ssif max_xmit_msg_size limit for multi-part messages (BZ#1610534) * RHEL-Alt-7.6 - powerpc/pseries: Fix unitialized timer reset on migration / powerpc/pseries/mobility: Extend start/stop topology update scope (LPM) (BZ#1673613) * RHEL-Alt-7.6 - s390: sha3_generic module fails and triggers panic when in FIPS mode (BZ#1673979) * RHEL-Alt-7.6 - System crashed after oom - During ICP deployment (BZ#1710304) * kernel-alt: Race condition in hashtables [rhel-alt-7.6.z] (BZ#1712127) * RHEL-Alt-7.6 - OP930:PM_Test:cpupower -r command set values for first 3 cores in quad and misses last core. (CORAL) (BZ#1717836) * RHEL-Alt-7.6 - disable runtime NUMA remapping for PRRN/LPM/VPHN (BZ#1717906) * fragmented packets timing out (BZ#1729066) * Backport TCP follow-up for small buffers (BZ#1733617) Enhancement(s): * RHEL-Alt-7.6 - perfevent PMDA cannot create file descriptors for reading nest events using the perf API (pcp/kernel) (CORAL) (BZ#1723036) 4

VAR-201902-0446	CVE-2019-1678	Cisco Meeting Server Input validation vulnerability	CVSS V2: 4.0 CVSS V3: 4.3 Severity: MEDIUM

A vulnerability in Cisco Meeting Server could allow an authenticated, remote attacker to cause a partial denial of service (DoS) to Cisco Meetings application users who are paired with a Session Initiation Protocol (SIP) endpoint. The vulnerability is due to improper validation of coSpaces configuration parameters. An attacker could exploit this vulnerability by inserting crafted strings in specific coSpace parameters. An exploit could allow the attacker to prevent clients from joining a conference call in the affected coSpace. Versions prior to 2.4.3 are affected. Cisco Meeting Server Contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Cisco Meeting Server is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service conditions. This issue is being tracked by Cisco Bug ID CSCvn16684

VAR-201912-0474	CVE-2019-7287	apple's iOS Out-of-bounds write vulnerability in	CVSS V2: 9.3 CVSS V3: 7.8 Severity: HIGH

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges. apple's iOS Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Apple iOS is prone to a memory-corruption vulnerability. Failed exploit attempts will result in a denial-of-service condition. The following versions fixes the issue: Versions prior to Apple iOS 12.1.4. IOKit is one of the components that read system information. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-2-07-1 iOS 12.1.4 iOS 12.1.4 is now available and addresses the following: FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: The initiator of a Group FaceTime call may be able to cause the recipient to answer Description: A logic issue existed in the handling of Group FaceTime calls. CVE-2019-6223: Grant Thompson of Catalina Foothills High School, Daven Morris of Arlington, TX Foundation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2019-7286: an anonymous researcher, Clement Lecigne of Google Threat Analysis Group, Ian Beer of Google Project Zero, and Samuel GroA of Google Project Zero IOKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2019-7287: an anonymous researcher, Clement Lecigne of Google Threat Analysis Group, Ian Beer of Google Project Zero, and Samuel GroA of Google Project Zero Live Photos in FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A thorough security audit of the FaceTime service uncovered an issue with Live Photos Description: The issue was addressed with improved validation on the FaceTime server. CVE-2019-7288: Apple Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.4". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlxcZmkpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F9HRAA sYhaZOf89H/kgxsBJbnJWa4g3Gi+OVgw2cfLkLT8GlAa2tZW+9pvra8cYZZ2TlvV 20UNupWr5sJPru+OWMiEYGRvVBQI5UaIRyIR4IsRbDcbvKe4ml0WM5t96PA1y5wt vhV9CKFwJY40k9PAWbb87eHf1kf8W6yCNAmddskSVFtgPBmGmZX4+u5OTY1YjIyc ilOKOJAsgnn/E+OGZ8RiDcQljY3CruzdCBecczt0QkzuXuvoSlL9RujOBtjZ/uLd cDorb7v0I9PokAdYAksEmgXFL8PDsm5h4ELkS3/Cp4RF8krdybB/4RN3SosWNBpA 99jMxgA5Mc+yLdIwPM9WUd/iq51KkYx+MLXYWzJwplnqQAQYW9p0+wTGTmEB+2x5 wStyUhMGbh3u5u3HBSLx31q2lkbTZU6+/kcqe6aQX0NckJBXV/+yGylQNcKN6XDk vWb9pCOjfpv5WyqvJ7XgNoX5CQcLt6WzJ0onZoVrhJoEnm2T0TKC/Tv2OCs9eJzb SgjAmKmavEaebSUa2StV4JfoNVPt7ijZdu+theAoObVrrktiWGX04srqyFaLZd/w 57NvpxizrLDNUWLmuuELQ9m1zL+xCLbJp46y1EaojjkaFw4H/7+U9nuKtg6+8ay/ o2nlJlEaOnQzrL+jp7mLvW05upIw0Ii/fyKTCQmbKSg= =p+hh -----END PGP SIGNATURE-----