VARIoT IoT vulnerabilities database

VAR-201805-1190 | CVE-2018-1258 | Spring Framework Authorization vulnerability |
CVSS V2: 6.5 CVSS V3: 8.8 Severity: HIGH |
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
An attacker can exploit this issue to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. Pivotal Software Spring Framework is a set of open source Java and JavaEE application frameworks from Pivotal Software in the United States. The framework helps developers build high-quality applications. Pivotal Software Spring Security is a set of security framework provided by American Pivotal Software Company to provide descriptive security protection for Spring-based applications. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat Fuse 7.4.0 security update
Advisory ID: RHSA-2019:2413-01
Product: Red Hat JBoss Fuse
Advisory URL: https://access.redhat.com/errata/RHSA-2019:2413
Issue date: 2019-08-08
CVE Names: CVE-2016-10750 CVE-2018-1258 CVE-2018-1320
CVE-2018-8088 CVE-2018-10899 CVE-2018-15758
CVE-2019-0192 CVE-2019-3805
====================================================================
1. Summary:
A minor version update (from 7.3 to 7.4) is now available for Red Hat Fuse.
The purpose of this text-only errata is to inform you about the security
issues fixed in this release.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
This release of Red Hat Fuse 7.4.0 serves as a replacement for Red Hat Fuse
7.3, and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* hazelcast: java deserialization in join cluster procedure leading to
remote code execution (CVE-2016-10750)
* slf4j: Deserialisation vulnerability in EventData constructor can allow
for arbitrary code execution (CVE-2018-8088)
* jolokia: system-wide CSRF that could lead to Remote Code Execution
(CVE-2018-10899)
* spring-security-oauth: Privilege escalation by manipulating saved
authorization request (CVE-2018-15758)
* solr: remote code execution due to unsafe deserialization (CVE-2019-0192)
* thrift: SASL negotiation isComplete validation bypass in the
org.apache.thrift.transport.TSaslTransport class (CVE-2018-1320)
* spring-security-core: Unauthorized Access with Spring Security Method
Security (CVE-2018-1258)
* wildfly: Race condition on PID file allows for termination of arbitrary
processes by local users (CVE-2019-3805)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
3. Solution:
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
Installation instructions are available from the Fuse 7.4.0 product
documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.4/
4. Bugs fixed (https://bugzilla.redhat.com/):
1548909 - CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution
1578582 - CVE-2018-1258 spring-security-core: Unauthorized Access with Spring Security Method Security
1601037 - CVE-2018-10899 jolokia: system-wide CSRF that could lead to Remote Code Execution
1643048 - CVE-2018-15758 spring-security-oauth: Privilege escalation by manipulating saved authorization request
1660263 - CVE-2019-3805 wildfly: Race condition on PID file allows for termination of arbitrary processes by local users
1667204 - CVE-2018-1320 thrift: SASL negotiation isComplete validation bypass in the org.apache.thrift.transport.TSaslTransport class
1692345 - CVE-2019-0192 solr: remote code execution due to unsafe deserialization
1713215 - CVE-2016-10750 hazelcast: java deserialization in join cluster procedure leading to remote code execution
5. References:
https://access.redhat.com/security/cve/CVE-2016-10750
https://access.redhat.com/security/cve/CVE-2018-1258
https://access.redhat.com/security/cve/CVE-2018-1320
https://access.redhat.com/security/cve/CVE-2018-8088
https://access.redhat.com/security/cve/CVE-2018-10899
https://access.redhat.com/security/cve/CVE-2018-15758
https://access.redhat.com/security/cve/CVE-2019-0192
https://access.redhat.com/security/cve/CVE-2019-3805
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.4.0
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.4/
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXUv0xNzjgjWX9erEAQhCzRAAjdpuIeE+WhWxaZpzsfh333p6RXGKoB8g
4BGVD7yZjSNoPmRzkSuaNUTT0wYZdRLSNeYK1FvxqZlTBesHbe3IV80gDNiV2vad
VzwNYukUoa6s8hdzKY/zCKwhuZ5cWkk+FLjFAPEfZt2Typ3kyYPnK/RxNnzfeSgc
90xh60LImUIJK/hGyOL40z8pGFbG404TJbdezYnQt0/l0NBGxPqBGOHnIgpZhAgw
gNMEglpIrxap4UzwSEzA5tmjRUDHeUBpsUpKsez5XL2ECssqrRyK8Hj/KeacnARF
Mnvf4U/lIOamD6Tles8IAFo/kexW+OxKiHbivOFutraLdEXysgkK8Uf5EQqYKW9+
7OgEuyMxUi5Pbj4kL666iBp5oV95gEHm2zcQEbn65BFJ3nomb5nReHh5t7G0AqHy
GYj9dlx84+UG0Fr717Vi586KwtCu6rgdZJS25+0kSCeZk/cowYLW09G+j/+Jk3yg
N/uUfoxqmC/A+SyupFh1A9XZg7oZhkB+Qwo6D2+BejiwXsD8Jv4uzrI7U7+Lg/YK
UFa2oqArMKNrF0zf9152lqCEpOL8dCO3X8RcB8LmQcapmr1MYGB+18oNT4o3JcY3
Aa1hoi5+2gGgR7HHuqTsxnDXYPtgqR9CMylc5gmYsMFK5W3sNX8Z/qazoH3fIVtu
NNAto03aZgE=rpUB
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201805-0313 | CVE-2018-0582 | ASUS RT-AC68U Cross-Site Scripting Vulnerability |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
Cross-site scripting vulnerability in ASUS RT-AC68U Firmware version prior to 3.0.0.4.380.1031 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. RT-AC68U provided by ASUS Japan Inc. is a wireless LAN router. RT-AC68U contains a cross-site scripting vulnerability (CWE-79). Yuto MAEDA of University of Tsukuba reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An arbitrary script may be executed on the user's web browser
VAR-201805-1045 | CVE-2018-6021 | Silex SD-320AN and GE MobileLink In OS Command injection vulnerability |
CVSS V2: 6.5 CVSS V3: 7.4 Severity: HIGH |
Silex SD-320AN version 2.01 and prior and GE MobileLink(GEH-SD-320AN) version GEH-1.1 and prior have a system call parameter that is not properly sanitized, which may allow remote code execution. Silex SD-320AN and GE MobileLink (GEH-SD-320AN) Is OS A command injection vulnerability exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Silex SD-320AN is a serial device server from Japan's Silex Technology Corporation. GE MobileLink (GEH-SD-320AN) is a set of electrocardiogram analysis system of General Electric (GE). A remote attacker could use this vulnerability to execute code. The vulnerability stems from the fact that the program does not have correct filtering system call parameters
VAR-201805-0651 | CVE-2018-10770 | ShenZhen Anni 5 in 1 XVR Information disclosure vulnerabilities in devices |
CVSS V2: 5.0 CVSS V3: 9.8 Severity: CRITICAL |
download.rsp on ShenZhen Anni "5 in 1 XVR" devices allows remote attackers to download the configuration (without a login) to discover the password. ShenZhen Anni 5 in 1 XVR The device contains an information disclosure vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Anni5in1XVR is a multi-functional DVR device from China's Anni Digital Technology. A security vulnerability exists in the download.rsp file on the Anni5in1XVR device
VAR-201805-1044 | CVE-2018-6020 | Silex SX-500 and GE MobileLink Authentication vulnerability |
CVSS V2: 6.4 CVSS V3: 6.5 Severity: MEDIUM |
In Silex SX-500 all versions and GE MobileLink(GEH-500) version 1.54 and prior, authentication is not verified when making certain POST requests, which may allow attackers to modify system settings. Silex SX-500 and GE MobileLink(GEH-500) Contains an authentication vulnerability.Tampering with information and disrupting service operations (DoS) There is a possibility of being put into a state. Silex SD-320AN is a serial port device server produced by Silex Technology Company of Japan. GE MobileLink (GEH-500) is an electrocardiogram analysis system developed by General Electric (GE). There is a security vulnerability in Silex SX-500 and GE MobileLink (GEH-500) 1.54 and earlier versions. The vulnerability is caused by the program not performing authentication on POST requests. An attacker could exploit this vulnerability to change system settings
VAR-201805-0903 | CVE-2018-6492 | HPE Network Operations Management Ultimate and Network Automation Vulnerable to cross-site scripting |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
Persistent Cross-Site Scripting, and non-persistent HTML Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow persistent cross-site scripting, and non-persistent HTML Injection. HP Network Automation has a cross-site scripting vulnerability that allows remote attackers to exploit vulnerabilities to inject malicious scripts or HTML code to capture sensitive information or hijack user sessions when malicious data is viewed. Multiple HP Products are prone to the following security vulnerabilities:
1. An SQL-injection vulnerability
2. An HTML-injection vulnerability
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application or to control how the site is rendered to the user, access or modify data or exploit latent vulnerabilities in the underlying database. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Note: the current version of the following document is available here:
https://softwaresupport.hpe.com/document/-/facetsearch/document/KM03158014
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: KM03158014
Version: 1
MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations
Management (NOM) Suite, Multiple Vulnerabilities
NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.
Release Date: 2018-05-09
Last Updated: 2018-05-09
Potential Security Impact: Remote: Cross-Site Scripting (XSS), SQL Injection
Source: Micro Focus, Product Security Response Team
VULNERABILITY SUMMARY
A potential security vulnerability has been identified in Micro Focus Network
Automation and Network Operations Management (NOM) Suite.
References:
- CVE-2018-6492 - Remote Cross-Site Scripting (XSS)
- CVE-2018-6493 - Remote SQL Injection
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
- HP Network Automation Software - v10.0x, v10.1x, v10.2x, v10.3x, v10.4x,
v10.5x
- Network Operations Management (NOM) Suite - v2017.06 - Classic Suite,
v2017.11 - Classic Suite, v2017.11 - Containerized Suite, v2018.02 - Classic
Suite, v2018.02 - Containerized Suite
BACKGROUND
CVSS Base Metrics
=================
Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector
Micro Focus would like to thank Tilman Bender, Dennis Herrmann and Bastian
Kanbach of Context Information Security GmbH for reporting this issue to
cyber-psrt@microfocus.com.
RESOLUTION
MicroFocus has made the following software updates and mitigation information
to resolve the vulnerability in Micro Focus Network Automation (NA) and
Network Operations Management (NOM) Suite:
For the KM please go to the link:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/KM03155960>
Patch number 10.00.023, for NA Version 10.0x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00058>
Patch number 10.11.06, for NA version 10.1x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00053>
Patch number 10.21.05, for NA version 10.2x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00054>
Patch number 10.30.03, for NA version 10.3x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00055>
Patch number 10.40.01, for NA version 10.4x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00056>
Patch number 10.50.01 - for NA version 10.5x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00057>
Patch number 10.30.P3 - for NOM version 2017.06 - Classic Suite:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00055>
Patch number 10.40.P1, for NOM version 2017.11 - Classic Suite:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00056>
Patch number 2017.11.P1, for NOM version 2017.11 - Containerized Suite:
<https://softwaresupport.softwaregrp.com/km/KM03150865>
Patch number 10.50.01, for NOM version 2018.02 - Classic Suite:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00057>
Patch number 2018.02.P1, for NOM version 2018.02 - Containerized Suite:
<https://softwaresupport.softwaregrp.com/km/KM03147136>
HISTORY
Version:1 (rev.1) - 10 May 2018 Initial release
Third Party Security Patches: Third party security patches that are to be installed on
systems running Micro Focus products should be applied in accordance with the customer's
patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal Micro Focus services support channel.
For other issues about the content of this Security Bulletin, send e-mail to cyber-psrt@microfocus.com.
Report: To report a potential security vulnerability for any supported product:
Web form: https://www.microfocus.com/support-and-services/report-security
Email: security@microfocus.com
Subscribe:
To initiate receiving subscriptions for future Micro Focus Security Bulletin alerts via Email, please subscribe here - https://softwaresupport.hpe.com/group/softwaresupport/email-notification/-/subscriptions/registerdocumentnotification
Once you are logged in to the portal, please choose security bulletins under product and document types.
Please note that you will need to sign in using a Passport account. If you do not have a Passport account yet, you can create one- its free and easy https://cf.passport.softwaregrp.com/hppcf/createuser.do
Security Bulletin Archive:
A list of recently released Security Bulletins is available here: https://softwaresupport.hpe.com/security-vulnerability
Software Product Category: The Software Product Category is represented in
the title by the two characters following Micro Focus Security Bulletin.
3P = 3rd Party Software
GN = Micro Focus General Software
MU = Multi-Platform Software
System management and security procedures must be reviewed frequently to maintain system integrity.
Micro Focus is continually reviewing and enhancing the security features of software products to provide
customers with current secure solutions.
"Micro Focus is broadly distributing this Security Bulletin in order to bring to the attention of users of the
affected Micro Focus products the important security information contained in this Bulletin. Micro Focus recommends
that all users determine the applicability of this information to their individual situations and take appropriate action.
Micro Focus does not warrant that this information is necessarily accurate or complete for all user situations and, consequently,
Micro Focus will not be responsible for any damages resulting from user's use or disregard of the information provided in
this Security Bulletin. To the extent permitted by law, Micro Focus disclaims all warranties, either express or
implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
Copyright 2017 EntIT Software LLC
Micro Focus shall not be liable for technical or editorial errors or omissions contained herein.
The information provided is provided "as is" without warranty of any kind. To the extent permitted by law,
neither Micro Focus nor its affiliates, subcontractors or suppliers will be liable for incidental, special
or consequential damages including downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or software restoration.
The information in this document is subject to change without notice. Micro Focus and the names of
Micro Focus products referenced herein are trademarks of Micro Focus in the United States and other countries.
Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJa8znlAAoJEHfErXedNUNKYJkH/25W6ElVKb5nCp3LN9US139t
pc/093JtZ2qIy/Alpmic7UxlkBeBajMuqoCyr1uVuruBOTv9AqqOckjPSrPO5ovv
o2S80OJF7AerH+u0I2ogKfJ+caleG+lxRSz9u2ppoLvepA06hbvAmiQi+/ridzq5
n7V0W5wZP/M4klpyY+lOG2CIRkZpnpa5TXIvcK0ESitC9H5kDp9274GFpDlVlXIq
nhsnWjuNszLXQ430IjeQbxotDu4QaVkd82FayACAFrnpFhuiLnHr6cFCCe+FWraG
TcoWcFFpErbPMsMR7QRmzWf8w0zyFCMVKPonRSqnGMR/gS+ihwTZMcviqkpnXLE=
=RgJ1
-----END PGP SIGNATURE-----
VAR-201805-0904 | CVE-2018-6493 | HP Network Operations Management Ultimate and Network Automation In SQL Injection vulnerability |
CVSS V2: 6.5 CVSS V3: 8.8 Severity: HIGH |
SQL Injection in HP Network Operations Management Ultimate, version 2017.07, 2017.11, 2018.02 and in Network Automation, version 10.00, 10.10, 10.11, 10.20, 10.30, 10.40, 10.50. This vulnerability could be remotely exploited to allow Remote SQL Injection. Multiple HP Products are prone to the following security vulnerabilities:
1. An SQL-injection vulnerability
2. A cross-site scripting vulnerability
3. An HTML-injection vulnerability
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application or to control how the site is rendered to the user, access or modify data or exploit latent vulnerabilities in the underlying database. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Note: the current version of the following document is available here:
https://softwaresupport.hpe.com/document/-/facetsearch/document/KM03158014
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: KM03158014
Version: 1
MFSBGN03806 rev.1 - HP Network Automation Software, Network Operations
Management (NOM) Suite, Multiple Vulnerabilities
NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.
References:
- CVE-2018-6492 - Remote Cross-Site Scripting (XSS)
- CVE-2018-6493 - Remote SQL Injection
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
- HP Network Automation Software - v10.0x, v10.1x, v10.2x, v10.3x, v10.4x,
v10.5x
- Network Operations Management (NOM) Suite - v2017.06 - Classic Suite,
v2017.11 - Classic Suite, v2017.11 - Containerized Suite, v2018.02 - Classic
Suite, v2018.02 - Containerized Suite
BACKGROUND
CVSS Base Metrics
=================
Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector
Micro Focus would like to thank Tilman Bender, Dennis Herrmann and Bastian
Kanbach of Context Information Security GmbH for reporting this issue to
cyber-psrt@microfocus.com.
RESOLUTION
MicroFocus has made the following software updates and mitigation information
to resolve the vulnerability in Micro Focus Network Automation (NA) and
Network Operations Management (NOM) Suite:
For the KM please go to the link:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/KM03155960>
Patch number 10.00.023, for NA Version 10.0x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00058>
Patch number 10.11.06, for NA version 10.1x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00053>
Patch number 10.21.05, for NA version 10.2x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00054>
Patch number 10.30.03, for NA version 10.3x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00055>
Patch number 10.40.01, for NA version 10.4x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00056>
Patch number 10.50.01 - for NA version 10.5x:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00057>
Patch number 10.30.P3 - for NOM version 2017.06 - Classic Suite:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00055>
Patch number 10.40.P1, for NOM version 2017.11 - Classic Suite:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00056>
Patch number 2017.11.P1, for NOM version 2017.11 - Containerized Suite:
<https://softwaresupport.softwaregrp.com/km/KM03150865>
Patch number 10.50.01, for NOM version 2018.02 - Classic Suite:
<https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/
/facetsearch/document/LID/NA_00057>
Patch number 2018.02.P1, for NOM version 2018.02 - Containerized Suite:
<https://softwaresupport.softwaregrp.com/km/KM03147136>
HISTORY
Version:1 (rev.1) - 10 May 2018 Initial release
Third Party Security Patches: Third party security patches that are to be installed on
systems running Micro Focus products should be applied in accordance with the customer's
patch management policy.
Support: For issues about implementing the recommendations of this Security Bulletin, contact normal Micro Focus services support channel.
For other issues about the content of this Security Bulletin, send e-mail to cyber-psrt@microfocus.com.
Report: To report a potential security vulnerability for any supported product:
Web form: https://www.microfocus.com/support-and-services/report-security
Email: security@microfocus.com
Subscribe:
To initiate receiving subscriptions for future Micro Focus Security Bulletin alerts via Email, please subscribe here - https://softwaresupport.hpe.com/group/softwaresupport/email-notification/-/subscriptions/registerdocumentnotification
Once you are logged in to the portal, please choose security bulletins under product and document types.
Please note that you will need to sign in using a Passport account. If you do not have a Passport account yet, you can create one- its free and easy https://cf.passport.softwaregrp.com/hppcf/createuser.do
Security Bulletin Archive:
A list of recently released Security Bulletins is available here: https://softwaresupport.hpe.com/security-vulnerability
Software Product Category: The Software Product Category is represented in
the title by the two characters following Micro Focus Security Bulletin.
3P = 3rd Party Software
GN = Micro Focus General Software
MU = Multi-Platform Software
System management and security procedures must be reviewed frequently to maintain system integrity.
Micro Focus is continually reviewing and enhancing the security features of software products to provide
customers with current secure solutions.
"Micro Focus is broadly distributing this Security Bulletin in order to bring to the attention of users of the
affected Micro Focus products the important security information contained in this Bulletin. Micro Focus recommends
that all users determine the applicability of this information to their individual situations and take appropriate action.
Micro Focus does not warrant that this information is necessarily accurate or complete for all user situations and, consequently,
Micro Focus will not be responsible for any damages resulting from user's use or disregard of the information provided in
this Security Bulletin. To the extent permitted by law, Micro Focus disclaims all warranties, either express or
implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."
Copyright 2017 EntIT Software LLC
Micro Focus shall not be liable for technical or editorial errors or omissions contained herein.
The information provided is provided "as is" without warranty of any kind. To the extent permitted by law,
neither Micro Focus nor its affiliates, subcontractors or suppliers will be liable for incidental, special
or consequential damages including downtime cost; lost profits; damages relating to the procurement of
substitute products or services; or damages for loss of data, or software restoration.
The information in this document is subject to change without notice. Micro Focus and the names of
Micro Focus products referenced herein are trademarks of Micro Focus in the United States and other countries.
Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQEcBAEBCAAGBQJa8znlAAoJEHfErXedNUNKYJkH/25W6ElVKb5nCp3LN9US139t
pc/093JtZ2qIy/Alpmic7UxlkBeBajMuqoCyr1uVuruBOTv9AqqOckjPSrPO5ovv
o2S80OJF7AerH+u0I2ogKfJ+caleG+lxRSz9u2ppoLvepA06hbvAmiQi+/ridzq5
n7V0W5wZP/M4klpyY+lOG2CIRkZpnpa5TXIvcK0ESitC9H5kDp9274GFpDlVlXIq
nhsnWjuNszLXQ430IjeQbxotDu4QaVkd82FayACAFrnpFhuiLnHr6cFCCe+FWraG
TcoWcFFpErbPMsMR7QRmzWf8w0zyFCMVKPonRSqnGMR/gS+ihwTZMcviqkpnXLE=
=RgJ1
-----END PGP SIGNATURE-----
VAR-201805-0241 | CVE-2018-10652 | Citrix XenMobile Server Information Disclosure Vulnerability |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
There is a Sensitive Data Leakage issue in Citrix XenMobile Server 10.7 before RP3. DasanGPON is a home router product from Dasan, Korea. A command injection vulnerability exists in the DasanGPON home router. The vulnerability is caused by the router saving the result of the Internet packet explorer in /tmp and transmitting it to the user when the user accesses the /diag.html page again. An attacker could use the vulnerability to execute a command and retrieve the output by sending a diag_action=ping request with the \342\200\230dest_host\342\200\231 parameter to GponForm/diag_FormURI
VAR-201805-0314 | CVE-2018-0583 | ASUS RT-AC1200HP Cross-Site Scripting Vulnerability |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
Cross-site scripting vulnerability in ASUS RT-AC1200HP Firmware version prior to 3.0.0.4.380.4180 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. RT-AC1200HP provided by ASUS Japan Inc. is a wireless LAN router. RT-AC1200HP contains a cross-site scripting vulnerability (CWE-79). Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An arbitrary script may be executed on the logged in user's web browser
VAR-201805-0312 | CVE-2018-0581 | RT-AC87U vulnerable to cross-site scripting |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
Cross-site scripting vulnerability in ASUS RT-AC87U Firmware version prior to 3.0.0.4.378.9383 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. RT-AC87U provided by ASUS Japan Inc. is a wireless LAN router. RT-AC87U contains a cross-site scripting vulnerability (CWE-79). Keigo Yamazaki of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.An arbitrary script may be executed on the user's web browser
VAR-201805-1189 | CVE-2018-1257 | Spring Framework Input validation vulnerability |
CVSS V2: 4.0 CVSS V3: 6.5 Severity: MEDIUM |
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack. Spring Framework Contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Spring Framework is prone to a denial-of-service vulnerability.
Attackers can exploit this issue to cause a denial-of-service condition; denying service to legitimate users.
Spring Framework 5.0 through 5.0.5 and 4.3 through 4.3.16 are vulnerable; other versions are also affected. Pivotal Spring Framework is an open source Java and Java EE application framework developed by Pivotal Software in the United States. The framework helps developers build high-quality applications. Description:
Red Hat Openshift Application Runtimes provides an application platform
that reduces the complexity of developing and operating applications
(monoliths and microservices) for OpenShift as a containerized platform. For further
information, refer to the Release Notes linked to in the References
section.
Security Fix(es):
* spring-messaging: ReDoS Attack with spring-messaging (CVE-2018-1257)
* spring-data: XXE with Spring Dataas XMLBeam integration (CVE-2018-1259)
* spring-security-oauth2: Remote Code Execution with spring-security-oauth2
(CVE-2018-1260)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section. Bugs fixed (https://bugzilla.redhat.com/):
1578578 - CVE-2018-1257 spring-framework: ReDoS Attack with spring-messaging
1578902 - CVE-2018-1259 spring-data-commons: XXE with Spring Dataas XMLBeam integration
1584376 - CVE-2018-1260 spring-security-oauth: remote code execution in the authorization process
5. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat Fuse 7.2 security update
Advisory ID: RHSA-2018:3768-01
Product: Red Hat JBoss Fuse
Advisory URL: https://access.redhat.com/errata/RHSA-2018:3768
Issue date: 2018-12-04
CVE Names: CVE-2016-5002 CVE-2016-5003 CVE-2017-12196
CVE-2018-1257 CVE-2018-1259 CVE-2018-1288
CVE-2018-1336 CVE-2018-8014 CVE-2018-8018
CVE-2018-8039 CVE-2018-8041 CVE-2018-12537
=====================================================================
1. Summary:
An update is now available for Red Hat Fuse.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
Red Hat Fuse enables integration experts, application developers, and
business users to collaborate and independently develop connected
solutions.
Fuse is part of an agile integration solution. Its distributed approach
allows teams to deploy integrated services where required. The API-centric,
container-based architecture decouples services so they can be created,
extended, and deployed independently.
This release of Red Hat Fuse 7.2 serves as a replacement for Red Hat Fuse
7.1, and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* xmlrpc: Deserialization of untrusted Java object through
<ex:serializable> tag (CVE-2016-5003)
* tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336)
* ignite: Improper deserialization allows for code execution via
GridClientJdkMarshaller endpoint (CVE-2018-8018)
* apache-cxf: TLS hostname verification does not work correctly with
com.sun.net.ssl.* (CVE-2018-8039)
* xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
(CVE-2016-5002)
* undertow: Client can use bogus uri in Digest authentication
(CVE-2017-12196)
* spring-data-commons: XXE with Spring Dataas XMLBeam integration
(CVE-2018-1259)
* kafka: Users can perform Broker actions via crafted fetch requests,
interfering with data replication and causing data lass (CVE-2018-1288)
* tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for
all origins (CVE-2018-8014)
* camel-mail: path traversal vulnerability (CVE-2018-8041)
* vertx: Improper neutralization of CRLF sequences allows remote attackers
to inject arbitrary HTTP response headers (CVE-2018-12537)
* spring-framework: ReDoS Attack with spring-messaging (CVE-2018-1257)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Red Hat would like to thank Eedo Shapira (GE Digital) for reporting
CVE-2018-8041. The CVE-2017-12196 issue was discovered by Jan Stourac (Red
Hat).
3. Solution:
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
Installation instructions are located in the download section of the
customer portal.
The References section of this erratum contains a download link (you must
log in to download the update).
4. Bugs fixed (https://bugzilla.redhat.com/):
1503055 - CVE-2017-12196 undertow: Client can use bogus uri in Digest authentication
1508110 - CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
1508123 - CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
1578578 - CVE-2018-1257 spring-framework: ReDoS Attack with spring-messaging
1578902 - CVE-2018-1259 spring-data-commons: XXE with Spring Dataas XMLBeam integration
1579611 - CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
1591072 - CVE-2018-12537 vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers
1595332 - CVE-2018-8039 apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*
1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS
1607731 - CVE-2018-8018 ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint
1611059 - CVE-2018-1288 kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass
1612644 - CVE-2018-8041 camel-mail: path traversal vulnerability
5. References:
https://access.redhat.com/security/cve/CVE-2016-5002
https://access.redhat.com/security/cve/CVE-2016-5003
https://access.redhat.com/security/cve/CVE-2017-12196
https://access.redhat.com/security/cve/CVE-2018-1257
https://access.redhat.com/security/cve/CVE-2018-1259
https://access.redhat.com/security/cve/CVE-2018-1288
https://access.redhat.com/security/cve/CVE-2018-1336
https://access.redhat.com/security/cve/CVE-2018-8014
https://access.redhat.com/security/cve/CVE-2018-8018
https://access.redhat.com/security/cve/CVE-2018-8039
https://access.redhat.com/security/cve/CVE-2018-8041
https://access.redhat.com/security/cve/CVE-2018-12537
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=distributions&version=7.2.0
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.2/
https://access.redhat.com/articles/2939351
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXAakytzjgjWX9erEAQgDkw//Wb1MeuX1VOUq4u9qkgtp3ECPTAR3GE8B
RWHYBguzM+WJrDPTtgH1sy1BstIEPgVooQLTKWhZYtJpR64S5T6YAv+aFh1vA7qI
87GDERqiATIm3l8qKBBOF02FukP9ywkaH5hR+pT7tM2OuN8iZ4dvKl0Rdzs6vnhF
Ea+qVCKeQlyn88HUUqYw51nBX7tbK0H1RuG7DxlU93LBYqymMIZ90KhcGeuvNPu/
BVk7xMDtbdPSagSBy5WFpTvZ/ozeYBmO7u8p9l67SiD3obR6Rtn83B3DKvL/AFP4
ahKlIrK62hk2qgXrpLQ9aVUwBMZ1Lqu99LelF20hRt38L7qy/EXtD+Xdt0H9Xl/H
bcLyRvjq8pOjdrdqAvnfI5HBDdSZrxujYX9t6egoQg3wFuS9h0DbKFMXSKMSaW2S
WlP4L5zbCTvhPy3mIPOECKDxP8Xa2g2HnqCal2PpHIXGVBvD0CTuxI0b7a6WKKYf
dbhm5uIEhdoS/vSuHntq+o+3IzlhRNHKx2Uh+03arWYyj4N26bbKFB+v+7gjL2e9
1ITf4HXEUphym5PY0R1GGc2Xr5Xc8BjV8xX3pgvI8FcRov4XGsS37TYpvNxPmTCA
e4VB2C4WS+AFhk1QJR7cNuACwUxjarIoKUp1CX5gvqu35pVgxR97KxoblGdMtR9g
UOgTm4iHIhQ=
=RCpd
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
VAR-201805-0955 | CVE-2018-8912 | Synology Note Station Vulnerable to cross-site scripting |
CVSS V2: 3.5 CVSS V3: 5.4 Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in SYNO.NoteStation.Note in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary web script or HTML via the commit_msg parameter. Synology Note Station Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Synology Note Station is a cloud-based note management platform from Synology
VAR-201805-0954 | CVE-2018-8911 | Synology Note Station Vulnerable to cross-site scripting |
CVSS V2: 3.5 CVSS V3: 5.4 Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in Attachment Preview in Synology Note Station before 2.5.1-0844 allows remote authenticated users to inject arbitrary web script or HTML via malicious attachments. Synology Note Station Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Synology Note Station is a cloud-based note management platform from Synology. Attachment Preview is one of the attachment preview function components
VAR-201805-0882 | CVE-2018-2418 | SAP MaxDB ODBC Code injection vulnerability in driver |
CVSS V2: 7.5 CVSS V3: 9.8 Severity: CRITICAL |
SAP MaxDB ODBC driver (all versions before 7.9.09.07) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application. SAP MaxDB ODBC The driver contains a code injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of UDL files by the Data Link Properties dialog. When parsing the Servername element, the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of the process.
MaxDB ODBC Driver 7.9.09.07 is vulnerable; other versions may also be affected
VAR-201805-0649 | CVE-2018-0765 | Microsoft .NET Framework and .NET Core Service disruption in (DoS) Vulnerabilities |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, .NET Core 2.0, Microsoft .NET Framework 4.7.2.
Successful exploits will attackers to cause a denial of service condition
VAR-201805-0696 | CVE-2018-10734 | KONGTOP DVR Information disclosure vulnerability in devices |
CVSS V2: 5.0 CVSS V3: 9.8 Severity: CRITICAL |
KONGTOP DVR devices A303, A403, D303, D305, and D403 contain a backdoor that prints the login password via a Print_Password function call in certain circumstances. KONGTOP DVR The device contains an information disclosure vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. KONGTOP DVR A303 and so on are all different types of network DVR equipment from China's KONGTOP Industrial Company.
A security vulnerability exists in several KONGTOP DVR products due to a backdoor in the Telnetd file. An attacker could exploit the vulnerability with a call to the 'Print_Password' function to obtain information. The following products are affected: KONGTOP DVR A303; KONGTOP DVR A403; KONGTOP DVR D303; KONGTOP DVR D305; KONGTOP DVR D403
VAR-201805-1058 | CVE-2018-8119 | plural Azure IoT SDK Impersonation vulnerability in products |
CVSS V2: 6.8 CVSS V3: 5.6 Severity: MEDIUM |
A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C# SDK, C SDK, Java SDK. Microsoft C #, C, and Java SDK for Azure IoT are software development kits for Microsoft Azure (Microsoft) based on C #, C, and Java languages for developing Azure IoT (Internet of Things Platform) applications, respectively. An attacker could use this vulnerability to impersonate a server. Multiple Microsoft Azure IoT SDKs are prone to a security vulnerability that may allow attackers to conduct spoofing attacks.
A man-in-the-middle attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible
VAR-201805-0950 | CVE-2018-8897 | Hardware debug exception documentation may result in unexpected behavior |
CVSS V2: 7.2 CVSS V3: 7.8 Severity: HIGH |
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs. In some circumstances, some operating systems or hypervisors may not expect or properly handle an Intel architecture hardware debug exception. Microsoft Windows is prone to a local privilege-escalation vulnerability.
An attacker can exploit this issue to execute arbitrary code with elevated privileges. 7.2) - noarch, x86_64
3. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: kernel security and bug fix update
Advisory ID: RHSA-2018:1319-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1319
Issue date: 2018-05-08
CVE Names: CVE-2017-7645 CVE-2017-8824 CVE-2017-13166
CVE-2017-18017 CVE-2017-1000410 CVE-2018-8897
=====================================================================
1. Summary:
An update for kernel is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - noarch, x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
3. Description:
The kernel packages contain the Linux kernel, the core of any Linux
operating system.
Security Fix(es):
* hw: cpu: speculative execution permission faults handling (CVE-2017-5754)
* Kernel: error in exception handling leads to DoS (CVE-2018-8897)
* kernel: nfsd: Incorrect handling of long RPC replies (CVE-2017-7645)
* kernel: Use-after-free vulnerability in DCCP socket (CVE-2017-8824)
* kernel: v4l2: disabled memory access protection mechanism allowing
privilege escalation (CVE-2017-13166)
* kernel: netfilter: use-after-free in tcpmss_mangle_packet function in
net/netfilter/xt_TCPMSS.c (CVE-2017-18017)
* kernel: Stack information leak in the EFS element (CVE-2017-1000410)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Red Hat would like to thank Google Project Zero for reporting
CVE-2017-5754; Nick Peterson (Everdox Tech LLC) and Andy Lutomirski for
reporting CVE-2018-8897; Mohamed Ghannam for reporting CVE-2017-8824; and
Armis Labs for reporting CVE-2017-1000410.
Bug Fix(es):
These updated kernel packages include also numerous bug fixes. Space
precludes documenting all of these bug fixes in this advisory. See the bug
fix descriptions in the related Knowledge Article:
https://access.redhat.com/articles/3431591
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1443615 - CVE-2017-7645 kernel: nfsd: Incorrect handling of long RPC replies
1519160 - CVE-2017-1000410 kernel: Stack information leak in the EFS element
1519591 - CVE-2017-8824 kernel: Use-after-free vulnerability in DCCP socket
1519781 - CVE-2017-5754 hw: cpu: speculative execution permission faults handling
1531135 - CVE-2017-18017 kernel: netfilter: use-after-free in tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c
1548412 - CVE-2017-13166 kernel: v4l2: disabled memory access protection mechanism allowing privilege escalation
1567074 - CVE-2018-8897 Kernel: error in exception handling leads to DoS
6. Package List:
Red Hat Enterprise Linux Desktop (v. 6):
Source:
kernel-2.6.32-696.28.1.el6.src.rpm
i386:
kernel-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.28.1.el6.i686.rpm
kernel-devel-2.6.32-696.28.1.el6.i686.rpm
kernel-headers-2.6.32-696.28.1.el6.i686.rpm
perf-2.6.32-696.28.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
noarch:
kernel-abi-whitelists-2.6.32-696.28.1.el6.noarch.rpm
kernel-doc-2.6.32-696.28.1.el6.noarch.rpm
kernel-firmware-2.6.32-696.28.1.el6.noarch.rpm
x86_64:
kernel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-common-i686-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.28.1.el6.x86_64.rpm
kernel-devel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-headers-2.6.32-696.28.1.el6.x86_64.rpm
perf-2.6.32-696.28.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
i386:
kernel-debug-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.28.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
python-perf-2.6.32-696.28.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
x86_64:
kernel-debug-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.28.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
Red Hat Enterprise Linux HPC Node (v. 6):
Source:
kernel-2.6.32-696.28.1.el6.src.rpm
noarch:
kernel-abi-whitelists-2.6.32-696.28.1.el6.noarch.rpm
kernel-doc-2.6.32-696.28.1.el6.noarch.rpm
kernel-firmware-2.6.32-696.28.1.el6.noarch.rpm
x86_64:
kernel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-common-i686-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.28.1.el6.x86_64.rpm
kernel-devel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-headers-2.6.32-696.28.1.el6.x86_64.rpm
perf-2.6.32-696.28.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
x86_64:
kernel-debug-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.28.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
kernel-2.6.32-696.28.1.el6.src.rpm
i386:
kernel-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.28.1.el6.i686.rpm
kernel-devel-2.6.32-696.28.1.el6.i686.rpm
kernel-headers-2.6.32-696.28.1.el6.i686.rpm
perf-2.6.32-696.28.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
noarch:
kernel-abi-whitelists-2.6.32-696.28.1.el6.noarch.rpm
kernel-doc-2.6.32-696.28.1.el6.noarch.rpm
kernel-firmware-2.6.32-696.28.1.el6.noarch.rpm
ppc64:
kernel-2.6.32-696.28.1.el6.ppc64.rpm
kernel-bootwrapper-2.6.32-696.28.1.el6.ppc64.rpm
kernel-debug-2.6.32-696.28.1.el6.ppc64.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.ppc64.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.ppc64.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.ppc64.rpm
kernel-debuginfo-common-ppc64-2.6.32-696.28.1.el6.ppc64.rpm
kernel-devel-2.6.32-696.28.1.el6.ppc64.rpm
kernel-headers-2.6.32-696.28.1.el6.ppc64.rpm
perf-2.6.32-696.28.1.el6.ppc64.rpm
perf-debuginfo-2.6.32-696.28.1.el6.ppc64.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.ppc64.rpm
s390x:
kernel-2.6.32-696.28.1.el6.s390x.rpm
kernel-debug-2.6.32-696.28.1.el6.s390x.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.s390x.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.s390x.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.s390x.rpm
kernel-debuginfo-common-s390x-2.6.32-696.28.1.el6.s390x.rpm
kernel-devel-2.6.32-696.28.1.el6.s390x.rpm
kernel-headers-2.6.32-696.28.1.el6.s390x.rpm
kernel-kdump-2.6.32-696.28.1.el6.s390x.rpm
kernel-kdump-debuginfo-2.6.32-696.28.1.el6.s390x.rpm
kernel-kdump-devel-2.6.32-696.28.1.el6.s390x.rpm
perf-2.6.32-696.28.1.el6.s390x.rpm
perf-debuginfo-2.6.32-696.28.1.el6.s390x.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.s390x.rpm
x86_64:
kernel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-common-i686-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.28.1.el6.x86_64.rpm
kernel-devel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-headers-2.6.32-696.28.1.el6.x86_64.rpm
perf-2.6.32-696.28.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
i386:
kernel-debug-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.28.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
python-perf-2.6.32-696.28.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
ppc64:
kernel-debug-debuginfo-2.6.32-696.28.1.el6.ppc64.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.ppc64.rpm
kernel-debuginfo-common-ppc64-2.6.32-696.28.1.el6.ppc64.rpm
perf-debuginfo-2.6.32-696.28.1.el6.ppc64.rpm
python-perf-2.6.32-696.28.1.el6.ppc64.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.ppc64.rpm
s390x:
kernel-debug-debuginfo-2.6.32-696.28.1.el6.s390x.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.s390x.rpm
kernel-debuginfo-common-s390x-2.6.32-696.28.1.el6.s390x.rpm
kernel-kdump-debuginfo-2.6.32-696.28.1.el6.s390x.rpm
perf-debuginfo-2.6.32-696.28.1.el6.s390x.rpm
python-perf-2.6.32-696.28.1.el6.s390x.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.s390x.rpm
x86_64:
kernel-debug-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.28.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
kernel-2.6.32-696.28.1.el6.src.rpm
i386:
kernel-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.28.1.el6.i686.rpm
kernel-devel-2.6.32-696.28.1.el6.i686.rpm
kernel-headers-2.6.32-696.28.1.el6.i686.rpm
perf-2.6.32-696.28.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
noarch:
kernel-abi-whitelists-2.6.32-696.28.1.el6.noarch.rpm
kernel-doc-2.6.32-696.28.1.el6.noarch.rpm
kernel-firmware-2.6.32-696.28.1.el6.noarch.rpm
x86_64:
kernel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.i686.rpm
kernel-debug-devel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-common-i686-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.28.1.el6.x86_64.rpm
kernel-devel-2.6.32-696.28.1.el6.x86_64.rpm
kernel-headers-2.6.32-696.28.1.el6.x86_64.rpm
perf-2.6.32-696.28.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
i386:
kernel-debug-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.i686.rpm
kernel-debuginfo-common-i686-2.6.32-696.28.1.el6.i686.rpm
perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
python-perf-2.6.32-696.28.1.el6.i686.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.i686.rpm
x86_64:
kernel-debug-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
kernel-debuginfo-common-x86_64-2.6.32-696.28.1.el6.x86_64.rpm
perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-2.6.32-696.28.1.el6.x86_64.rpm
python-perf-debuginfo-2.6.32-696.28.1.el6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2017-7645
https://access.redhat.com/security/cve/CVE-2017-8824
https://access.redhat.com/security/cve/CVE-2017-13166
https://access.redhat.com/security/cve/CVE-2017-18017
https://access.redhat.com/security/cve/CVE-2017-1000410
https://access.redhat.com/security/cve/CVE-2018-8897
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/articles/3431591
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFa8fO8XlSAg2UNWIIRAnN0AKCBdjdw1bC12xju0GwoOedA1L8osACaA1Ze
4IKrbiFeHd+C9bqCjUFX4pw=
=3psi
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
. 6.4) - x86_64
3.
Bug Fix(es):
* The kernel build requirements have been updated to the GNU Compiler
Collection (GCC) compiler version that has the support for Retpolines. The
Retpolines mechanism is a software construct that leverages specific
knowledge of the underlying hardware to mitigate the branch target
injection, also known as Spectre variant 2 vulnerability described in
CVE-2017-5715. (BZ#1554251)
4. Intel Architecture (processor architecture) is a CPU specification developed by Intel Corporation for its processor. There are security vulnerabilities in the operating systems of multiple vendors. Systems from the following vendors are affected: Apple; DragonFly BSD Project; FreeBSD Project; Linux Kernel; Microsoft; Red Hat; SUSE Linux; Ubuntu; Vmware; Xen. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2018-05-08-1 Additional information for
APPLE-SA-2018-04-24-2 Security Update 2018-001
Security Update 2018-001 addresses the following:
Crash Reporter
Available for: macOS High Sierra 10.13.4
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
error handling. The issue appears to be from an
undocumented side effect of the instructions.
CVE-2018-8897: Andy Lutomirski, Nick Peterson
(linkedin.com/in/everdox) of Everdox Tech LLC
Entry added May 8, 2018
LinkPresentation
Available for: macOS High Sierra 10.13.4
Impact: Processing a maliciously crafted text message may lead to UI
spoofing
Description: A spoofing issue existed in the handling of URLs. This
issue was addressed with improved input validation. ==========================================================================
Ubuntu Security Notice USN-3641-2
May 08, 2018
linux, linux-lts-trusty vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 ESM
Summary:
Several security issues were fixed in the Linux kernel. This update provides the
corresponding updates for Ubuntu 12.04 ESM. A local attacker
could use this to cause a denial of service (system crash). This issue only
affected the amd64 architecture. A local attacker in a KVM virtual machine could use this to
cause a denial of service (guest VM crash) or possibly escalate privileges
inside of the virtual machine. This issue only affected the i386 and amd64
architectures. (CVE-2018-1087)
Andy Lutomirski discovered that the Linux kernel did not properly perform
error handling on virtualized debug registers. (CVE-2018-1000199)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 ESM:
linux-image-3.13.0-147-generic 3.13.0-147.196~precise1
linux-image-3.13.0-147-generic-lpae 3.13.0-147.196~precise1
linux-image-3.2.0-134-generic 3.2.0-134.180
linux-image-3.2.0-134-generic-pae 3.2.0-134.180
linux-image-3.2.0-134-highbank 3.2.0-134.180
linux-image-3.2.0-134-omap 3.2.0-134.180
linux-image-3.2.0-134-powerpc-smp 3.2.0-134.180
linux-image-3.2.0-134-powerpc64-smp 3.2.0-134.180
linux-image-3.2.0-134-virtual 3.2.0-134.180
linux-image-generic 3.2.0.134.149
linux-image-generic-lpae-lts-trusty 3.13.0.147.138
linux-image-generic-lts-trusty 3.13.0.147.138
linux-image-generic-pae 3.2.0.134.149
linux-image-highbank 3.2.0.134.149
linux-image-omap 3.2.0.134.149
linux-image-powerpc 3.2.0.134.149
linux-image-powerpc-smp 3.2.0.134.149
linux-image-powerpc64-smp 3.2.0.134.149
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerpc), a standard system upgrade will automatically perform
this as well. These packages include redhat-release-virtualization-host,
ovirt-node, and rhev-hypervisor. RHVH features a Cockpit user
interface for monitoring the host's resources and performing administrative
tasks.
Includes GlusterFS fixes for CVE-2018-1088, dhcp fixes for CVE-2018-1111,
kernel fixes for CVE-2018-1087, and kernel fixes for CVE-2018-8897.
A list of bugs fixed in this update is available in the Technical Notes
book:
https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.2/ht
ml/technical_notes/
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/):
1357247 - rhvh 4: reboot after install shows "4m[terminated]" and takes long to reboot
1374007 - [RFE] RHV-H does not default to LVM Thin Provisioning
1420068 - [RFE] RHV-H should meet NIST 800-53 partitioning requirements by default
1422676 - [Test Only] Test Ansible playbook for registration
1429485 - [RFE] Imgbased layers should be named with '%{name}-%{version}-%{release}' instead of %{name}-%{version}
1433394 - kdump could fill up /var filesystem while writing to /var/crash
1443965 - Libvirt is disabled on RHVH host
1454536 - HostedEngine setup fails if RHV-H timezone < UTC set during installation
1474268 - RHVH host displays "upgrade available" information on the engine after registering until an update is released
1489567 - Host Software tab does not show exact RHVH version anymore
1501161 - The version displays as "4.1" for subscribed product with RHVH 4.2
1502920 - File missing after upgrade of RHVH node from version RHVH-4.1-20170925.0 to latest.
1503148 - [RFE] translate between basic ntp configurations and chrony configurations
1516123 - tuned-adm timeout while adding the host in manager and the deployment will fail/take time to complete
1534855 - RHVH brand is missing on cockpit login screen. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-18:06.debugreg Security Advisory
The FreeBSD Project
Topic: Mishandling of x86 debug exceptions
Category: core
Module: kernel
Announced: 2018-05-08
Credits: Nick Peterson, Everdox Tech LLC
https://www.linkedin.com/in/everdox
Andy Lutomirski
Affects: All supported versions of FreeBSD.
Corrected: 2018-05-08 17:03:33 UTC (stable/11, 11.2-PRERELEASE)
2018-05-08 17:12:10 UTC (releng/11.1, 11.1-RELEASE-p10)
2018-05-08 17:05:39 UTC (stable/10, 10.4-STABLE)
2018-05-08 17:12:10 UTC (releng/10.4, 10.4-RELEASE-p9)
CVE Name: CVE-2018-8897
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>. Background
On x86 architecture systems, the stack is represented by the combination of
a stack segment and a stack pointer, which must remain in sync for proper
operation. Instructions related to manipulating the stack segment have
special handling to facilitate consistency with changes to the stack pointer.
II. If that instruction is
a system call or similar instruction that transfers control to the operating
system, the debug exception will be handled in the kernel context instead of
the user context.
III. Impact
An authenticated local attacker may be able to read sensitive data in kernel
memory, control low-level operating system functions, or may panic the
system.
IV. Workaround
No workaround is available.
V. Solution
Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date,
using either a binary or source code patch, and then reboot.
1) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
And reboot.
2) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 11.1]
# fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.11.1.patch
# fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.11.1.patch.asc
# gpg --verify debugreg.11.1.patch.asc
[FreeBSD 10.4]
# fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.10.4.patch
# fetch https://security.FreeBSD.org/patches/SA-18:06/debugreg.10.4.patch.asc
# gpg --verify debugreg.10.4.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile and install your kernel as described in
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/10/ r333370
releng/10.4/ r333371
stable/11/ r333369
releng/11.1/ r333371
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. Description:
The kernel-rt packages provide the Real Time Linux Kernel, which enables
fine-tuning for systems with extremely high determinism requirements.
CVE-2018-1087
Andy Lutomirski discovered that the KVM implementation did not
properly handle #DB exceptions while deferred by MOV SS/POP SS,
allowing an unprivileged KVM guest user to crash the guest or
potentially escalate their privileges.
For the oldstable distribution (jessie), these problems have been fixed
in version 3.16.56-1+deb8u1. This update includes various fixes for
regressions from 3.16.56-1 as released in DSA-4187-1 (Cf.
For the stable distribution (stretch), these problems have been fixed in
version 4.9.88-1+deb9u1. The fix for CVE-2018-1108 applied in DSA-4188-1
is temporarily reverted due to various regression, cf.
For the detailed security status of linux please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/linux
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAlryHFFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0SMQA/9HoJDt2OdyqqtfNUuWfP3sgGV1QVjIJnF39unKRdIaGw9m0RHQUu1G3rC
cgxcYcpQ0h10Yy5KVh4APqt55K7aVWVQT6xB0yx2VddMEwwl3rp2r/eL7EtoOkQT
zZW5JponzlEAjC9uGk7CouA7z/qFtd5awufFhAjMF5eL4ZQ6pG8wWEbae6DbU9nz
c7F+okC4hL6yPuWVEWzTRUFK1W0hs2N+VQgHV/afZaMAAooeZJDJeq1Hn/PVYvwJ
IHSOs01+kn0OUFHkVRA7kVdFAYUJlfhsDcXd9nB/lkxhc/HNI1g/dK76mRxjsiMo
pJlkPbEmZlOtmNG7vogxEp72ab24j2CITIHiID7ftZH5R/I2CSxp2dIzRVKdmP6P
tsfh/KcpUMNwwiPiGed1DMCjtsHOodBOkLtVsoHHJVMZg2xqfCrlqNRUn9o+0DcR
gO7HBsWG9K1qvSBWuRtQLT8QP00P3dSdhHmfWyfN8eJxTot+WJuMF/o+jbF6GGrZ
lPmzWqg4oL7jvQO8nlEkatjIFejEg0jmt+rCXyEbK8Uc9xjJk35GKIZne5X09BFe
36zY7HbMlPvLP/VHSb6fcPBpQo/HuG0/htAB1HpWS1fPrth1J76g2EmwFSG5Lo51
IRxTXP4UZuOL1sJHQ80220tThKs2dk1Yy77dKk8qQiQ2nC2JgNs=
=CskH
-----END PGP SIGNATURE-----
.
CVE-2018-10471
An error was discovered in the mitigations against Meltdown which
could result in denial of service.
CVE-2018-10472
Anthony Perard discovered that incorrect parsing of CDROM images
can result in information disclosure.
CVE-2018-10981
Jan Beulich discovered that malformed device models could result
in denial of service.
CVE-2018-10982
Roger Pau Monne discovered that incorrect handling of high precision
event timers could result in denial of service and potentially
privilege escalation
VAR-201805-0272 | CVE-2018-10351 | Trend Micro Email Encryption Gateway In SQL Injection vulnerability |
CVSS V2: 9.0 CVSS V3: 8.8 Severity: HIGH |
A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRegistration2 class. Authentication is required to exploit this vulnerability. A crafted Client field in ppreg files can trigger execution of SQL queries composed from a user-supplied string. An attacker can leverage this vulnerability to execute code under the context of root. Multiple SQL-injection vulnerabilities
2. A command-injection vulnerability
3. An insecure authentication weakness
Exploiting these issues could allow an attacker to access or modify data, or exploit latent vulnerabilities in the underlying database, execute arbitrary command, bypass authentication mechanism, execute arbitrary code and obtain sensitive information. This may aid in further attacks.
Email Encryption Gateway 5.5 Build 1111 and prior are vulnerable. There is an SQL injection vulnerability in the formRegistration2 class in Trend Micro TMEEG version 5.5
VAR-201805-0273 | CVE-2018-10352 | Trend Micro Email Encryption Gateway In SQL Injection vulnerability |
CVSS V2: 6.5 CVSS V3: 8.8 Severity: HIGH |
A vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formConfiguration class. Authentication is required to exploit this vulnerability. The issue results from the lack of proper validation of user-supplied strings before using them to construct SQL queries. An attacker can leverage this vulnerability to execute code under the context of root. Multiple SQL-injection vulnerabilities
2. A command-injection vulnerability
3. An insecure authentication weakness
Exploiting these issues could allow an attacker to access or modify data, or exploit latent vulnerabilities in the underlying database, execute arbitrary command, bypass authentication mechanism, execute arbitrary code and obtain sensitive information. This may aid in further attacks. There is an SQL injection vulnerability in the formConfiguration class in Trend Micro TMEEG version 5.5