VARIoT IoT vulnerabilities database

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, and SD 810, possible null pointer dereference occurs due to failure of memory allocation when a large value is passed for buffer allocation in the Playready App. plural Qualcomm Run on product Android Is NULL A vulnerability related to pointer dereference exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Playready App is one of those digital rights protection programs. Qualcomm MSM8909W, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm). The vulnerability stems from a memory allocation failure in the program when a large value is used to allocate a buffer. A remote attacker could exploit this vulnerability to cause a system crash (null pointer backreference). The following products (for mobile devices and watches) are affected: Qualcomm MSM8909W; SD 210; SD 212; SD 205; SD 400; SD 410/12; SD 615/16; SD 415; SD 810

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 400, SD 800, SD 820, and SD 820A, lack of input validation in QSEE can cause potential buffer overflow. plural Qualcomm Run on product Android Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm MDM9625, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm) applied to different platforms. There is a buffer overflow vulnerability in Qualcomm closed-source components in versions before Android 2018-04-05. The vulnerability stems from the lack of input validation in the program in QSEE. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service. The following products (used in mobile devices and automotive) are affected: Qualcomm MDM9625; Qualcomm SD 400; Qualcomm SD 800; Qualcomm SD 820; Qualcomm SD 820A

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9645, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, improper ciphersuite validation leads SecSSL accept an unadvertised ciphersuite. plural Qualcomm Run on product Android Contains an input validation vulnerability.Information may be obtained and information may be altered. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm MDM9615 and others are central processing unit (CPU) products of Qualcomm (Qualcomm). An attacker could exploit this vulnerability to bypass security restrictions

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, SD 410/12, SD 615/16/SD 415, SD 800, SD 808, and SD 810, lack of input validation in qsee can lead to unauthorized memory access. plural Qualcomm Run on product Android Contains an input validation vulnerability.Information may be obtained. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm SD 400, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm). The vulnerability stems from the lack of input validation in qsee. A remote attacker could exploit this vulnerability to gain unauthorized access to memory

In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the probe requests originated from user's phone contains the information elements which specifies the supported wifi features. This shall impact the user's privacy if someone sniffs the probe requests originated by this DUT. Hence, control the presence of which information elements is supported. plural Qualcomm Run on product Android Contains an information disclosure vulnerability.Information may be obtained. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm MDM9206, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm) applied to different platforms. A remote attacker could exploit this vulnerability to obtain sensitive information by sniffing probe requests

In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, QCA6174A, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the original mac spoofing feature does not use the following in probe request frames: (a) randomized sequence numbers and (b) randomized source address for cfg80211 scan, vendor scan and pno scan which may affect user privacy. plural Qualcomm Run on product Android Contains vulnerabilities related to security features.Information may be obtained. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm MDM9206, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm) applied to different platforms. The vulnerability stems from the scanning of cfg8021, manufacturer, and pno. The program does not use random sequence numbers and random source addresses in probe request frames. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. The following products used in (phones, cars and watches) are affected: Qualcomm MDM9206; Qualcomm MDM9607; Qualcomm MDM9640; Qualcomm MDM9650; Qualcomm QCA6174A; Qualcomm QCA6574; Qualcomm QCA6574AU; Qualcomm SD 212; Qualcomm SD 205; Qualcomm SD 410/12; Qualcomm SD 425; Qualcomm SD 427; Qualcomm SD 430; Qualcomm SD 435; Qualcomm SD 808; Qualcomm SD 810; Qualcomm SD 820; Qualcomm SD 835; Qualcomm SD 845; Qualcomm SDM630; Qualcomm SDM636; Qualcomm SDM660;

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, DRM provisioning mechanisms used in QSEE applications have a feature to prevent further provisioning. This is done by creating an SFS file called 'finalize_prov_flag.data' at the end of provisioning. When this feature is enabled, provisioning calls check for the existence of the file in order to decide whether to do provisioning or not. Current implementation allows provisioning without sufficient checks. plural Qualcomm Run on product Android Contains a data processing vulnerability.Information may be tampered with. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm IPQ4019 and so on are the central processing unit (CPU) products of Qualcomm (Qualcomm) applied to different platforms. The vulnerability is caused by the program not performing sufficient detection. An attacker could exploit this vulnerability to gain access

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, in a PlayReady function, information exposure can occur. plural Qualcomm Run on product Android Contains an information disclosure vulnerability.Information may be obtained. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm MDM9206, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm) applied to different platforms. A remote attacker could exploit this vulnerability to obtain sensitive information

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 210/SD 212/SD 205, SD 400, SD 617, SD 800, and SD 820, in the time daemon, unauthorized users can potentially modify system time and cause an array index to be out-of-bound. plural Qualcomm Run on product Android Contains a vulnerability related to array index validation.Information may be tampered with. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm MDM9615 and others are central processing unit (CPU) products of Qualcomm (Qualcomm). A security vulnerability exists in Qualcomm closed-source components in Android versions prior to 2018-04-05. An attacker could exploit this vulnerability to cause an array index to go out of bounds. The following products (for mobile devices) are affected: Qualcomm MDM9615; Qualcomm MDM9625; Qualcomm MDM9635M; Qualcomm SD 210; Qualcomm SD 212; Qualcomm SD 205; Qualcomm SD 400; Qualcomm SD 617; Qualcomm SD 800;

In Android before 2018-04-05 or earlier security patch level on Qualcomm Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear FSM9055, IPQ4019, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SDX20, three image types are loaded in the same manner without distinguishing them. plural Qualcomm Run on product Android Contains a data processing vulnerability.Information may be tampered with. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm FSM9055, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm) applied to different platforms. The vulnerability stems from the fact that the program loads three types of images in the same way without any distinction. A remote attacker could exploit this vulnerability to gain access

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, and SDX20, secure UI crash due to uninitialized link list entry in dynamic font module. plural Qualcomm Run on product Android Contains a vulnerability in uninitialized pointer access.Service operation interruption (DoS) There is a possibility of being put into a state. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm MDM9206, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm) applied to different platforms. A security vulnerability exists in Qualcomm closed-source components in Android versions prior to 2018-04-05. A remote attacker could exploit this vulnerability to crash the secure user interface

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, packet replay may be possible. plural Qualcomm Run on product Android Contains vulnerabilities related to security features.Information may be obtained and information may be altered. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm MDM9206, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm) applied to different platforms. Qualcomm closed-source components in versions prior to Android 2018-04-05 have a security feature vulnerability. A remote attacker could exploit this vulnerability to gain access

A structured exception handler overflow vulnerability in Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME LAquis SCADA 4.1.0.3391 and earlier may allow code execution. Leao Consultoria e Desenvolvimento de Sistemas (LCDS) LTDA ME of LAquis SCADA Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. LCDS LAquis SCADA A set of SCADA software for monitoring and data acquisition from Brazil LCDS. A security vulnerability exists in LCDS LAquis SCADA version 4.1.0.3391 and earlier that caused the program to fail to properly detect or handle anomalies. An attacker could exploit the vulnerability to execute code. LAquis SCADA is prone to an arbitrary code-execution vulnerability. Failed attempts will likely cause a denial-of-service condition

An exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below. A specially crafted snmp-set request, when sent without associated firmware flashing snmp-set commands, can cause a device power cycle resulting in downtime for the device. An attacker can send one packet to trigger this vulnerability

An exploitable denial of service vulnerability exists in the program download functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a device fault resulting in halted operations. An attacker can send an unauthenticated packet to trigger this vulnerability

An exploitable insufficient resource pool vulnerability exists in the session communication functionality of Allen Bradley Micrologix 1400 Series B Firmware 21.2 and before. A specially crafted stream of packets can cause a flood of the session resource pool resulting in legitimate connections to the PLC being disconnected. An attacker can send unauthenticated packets to trigger this vulnerability. Allen Bradley Micrologix 1400 Series Contains a resource management vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. The AllenBradleyMicrologix1400SeriesB is a programmable logic controller from Rockwell Automation

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles. Spring Framework Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Pivotal Spring Framework is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Failed exploit attempts will likely result in denial-of-service conditions. Pivotal Software Spring Framework is a set of open source Java and JavaEE application frameworks from Pivotal Software in the United States. The framework helps developers build high-quality applications. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Fuse 7.1 security update Advisory ID: RHSA-2018:2669-01 Product: Red Hat JBoss Fuse Advisory URL: https://access.redhat.com/errata/RHSA-2018:2669 Issue date: 2018-09-11 Cross references: RHBA-2018:2665-04 CVE Names: CVE-2014-0114 CVE-2016-5397 CVE-2016-1000338 CVE-2016-1000339 CVE-2016-1000340 CVE-2016-1000341 CVE-2016-1000342 CVE-2016-1000343 CVE-2016-1000344 CVE-2016-1000345 CVE-2016-1000346 CVE-2016-1000352 CVE-2017-14063 CVE-2018-1114 CVE-2018-1271 CVE-2018-1272 CVE-2018-1338 CVE-2018-1339 CVE-2018-8036 CVE-2018-8088 CVE-2018-1000129 CVE-2018-1000130 CVE-2018-1000180 ==================================================================== 1. Summary: An update is now available for Red Hat Fuse. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. This release of Red Hat Fuse 7.1 serves as a replacement for Red Hat Fuse 7.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * Apache Struts 1: Class Loader manipulation via request parameters (CVE-2014-0114) * thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands (CVE-2016-5397) * slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088) * jolokia: JMX proxy mode vulnerable to remote code execution (CVE-2018-1000130) * bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data (CVE-2016-1000338) * bouncycastle: Information leak in AESFastEngine class (CVE-2016-1000339) * bouncycastle: Information exposure in DSA signature generation via timing attack (CVE-2016-1000341) * bouncycastle: ECDSA improper validation of ASN.1 encoding of signature (CVE-2016-1000342) * bouncycastle: DHIES implementation allowed the use of ECB mode (CVE-2016-1000344) * bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack (CVE-2016-1000345) * bouncycastle: Other party DH public keys are not fully validated (CVE-2016-1000346) * bouncycastle: ECIES implementation allowed the use of ECB mode (CVE-2016-1000352) * async-http-client: Invalid URL parsing with '?' (CVE-2017-14063) * undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service (CVE-2018-1114) * spring-framework: Directory traversal vulnerability with static resources on Windows filesystems (CVE-2018-1271) * tika: Infinite loop in BPGParser can allow remote attacker to cause a denial of service (CVE-2018-1338) * tika: Infinite loop in ChmParser can allow remote attacker to cause a denial of service (CVE-2018-1339) * pdfbox: Infinite loop in AFMParser.java allows for out of memory erros via crafted PDF (CVE-2018-8036) * jolokia: Cross site scripting in the HTTP servlet (CVE-2018-1000129) * bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180) * bouncycastle: Carry propagation bug in math.raw.Nat??? class (CVE-2016-1000340) * bouncycastle: DSA key pair generator generates a weak private key by default (CVE-2016-1000343) * spring-framework: Multipart content pollution (CVE-2018-1272) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Chris McCown for reporting CVE-2018-8088. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are located in the download section of the customer portal. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1091938 - CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters 1487563 - CVE-2017-14063 async-http-client: Invalid URL parsing with '?' 1544620 - CVE-2016-5397 thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands 1548909 - CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution 1559316 - CVE-2018-1000130 jolokia: JMX proxy mode vulnerable to remote code execution 1559317 - CVE-2018-1000129 jolokia: Cross site scripting in the HTTP servlet 1564408 - CVE-2018-1272 spring-framework: Multipart content pollution 1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems 1572421 - CVE-2018-1338 tika: Infinite loop in BPGParser can allow remote attacker to cause a denial of service 1572424 - CVE-2018-1339 tika: Infinite loop in ChmParser can allow remote attacker to cause a denial of service 1573045 - CVE-2018-1114 undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service 1588306 - CVE-2018-1000180 bouncycastle: flaw in the low-level interface to RSA key pair generator 1588313 - CVE-2016-1000338 bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data 1588314 - CVE-2016-1000344 bouncycastle: DHIES implementation allowed the use of ECB mode 1588323 - CVE-2016-1000345 bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack 1588327 - CVE-2016-1000346 bouncycastle: Other party DH public keys are not fully validated 1588330 - CVE-2016-1000352 bouncycastle: ECIES implementation allowed the use of ECB mode 1588688 - CVE-2016-1000340 bouncycastle: Carry propagation bug in math.raw.Nat??? class 1588695 - CVE-2016-1000339 bouncycastle: Information leak in AESFastEngine class 1588708 - CVE-2016-1000341 bouncycastle: Information exposure in DSA signature generation via timing attack 1588715 - CVE-2016-1000342 bouncycastle: ECDSA improper validation of ASN.1 encoding of signature 1588721 - CVE-2016-1000343 bouncycastle: DSA key pair generator generates a weak private key by default 1597490 - CVE-2018-8036 pdfbox: Infinite loop in AFMParser.java allows for out of memory erros via crafted PDF 5. References: https://access.redhat.com/security/cve/CVE-2014-0114 https://access.redhat.com/security/cve/CVE-2016-5397 https://access.redhat.com/security/cve/CVE-2016-1000338 https://access.redhat.com/security/cve/CVE-2016-1000339 https://access.redhat.com/security/cve/CVE-2016-1000340 https://access.redhat.com/security/cve/CVE-2016-1000341 https://access.redhat.com/security/cve/CVE-2016-1000342 https://access.redhat.com/security/cve/CVE-2016-1000343 https://access.redhat.com/security/cve/CVE-2016-1000344 https://access.redhat.com/security/cve/CVE-2016-1000345 https://access.redhat.com/security/cve/CVE-2016-1000346 https://access.redhat.com/security/cve/CVE-2016-1000352 https://access.redhat.com/security/cve/CVE-2017-14063 https://access.redhat.com/security/cve/CVE-2018-1114 https://access.redhat.com/security/cve/CVE-2018-1271 https://access.redhat.com/security/cve/CVE-2018-1272 https://access.redhat.com/security/cve/CVE-2018-1338 https://access.redhat.com/security/cve/CVE-2018-1339 https://access.redhat.com/security/cve/CVE-2018-8036 https://access.redhat.com/security/cve/CVE-2018-8088 https://access.redhat.com/security/cve/CVE-2018-1000129 https://access.redhat.com/security/cve/CVE-2018-1000130 https://access.redhat.com/security/cve/CVE-2018-1000180 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=distributions&version=7.1.0 https://access.redhat.com/documentation/en-us/red_hat_fuse/7.1/ https://access.redhat.com/articles/2939351 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW5d0pdzjgjWX9erEAQg6Yw//dFPzbxBQz8m4jwPwRjNmTDM/tTOnxZSt MTqjRp8zX80qhQVMlVj7d9TQLX25bR9Vx4//Kktu3EIsON+ddxy+LZQBlX7l4XMy SP8FGfSp+GV6jiS+aOoRw+NaE8omM8AwYi0Clv562FIcM8qiqGt+O/QK0peN5JYA COa/6uSPsNftk7Sq3aQ0jWV35L92r2S1FeIg6FGanyqLO1Y+sKePY5T5HRSNpp06 lh00QeAdYlcGrIBbsQnds4uHW5PPrS7HoafCEuIPdCDoCjZTms3i9K3f57ZQ6ojn mpKaQgiWVPGenzAIh+JzFaMWTdMwVt6nDPuSt9SC6uDC20c+ffBjjsC2w0Bh/bVr yxas3NTobxggV8lN0PF0MHx776QtRyc+XukUZ+7FPm6irhfqMVBkUrD95s/qjNNF KNm8Nsz+HFqwaP0XCkfiBTPZs5yWf83KA/Qw9MOoJGVLXF28wzrELxPl8eMizCtX MCfop2FzGCCMkanRHMzZ+RkFQ9+wN+WHw1UXiANEaM+55yGfIWhqYOH2zQZzByNY YdKlSrAw2jvODvawFclMYG+zD97pr1VMvLb8W8uUiqRwKnsu303EtTk+IyTCcoS9 KDczeRZr/X98Ww0gXOEnUcVsTby6fhbtIgUbPt/3obsV6joyaHf5/mHj49uPluva TLag+xVs1p4=vq4F -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . For further information, refer to the Release Notes linked to in the References section. Security Fix(es): * spring-framework: Address partial fix for CVE-2018-1270 (CVE-2018-1275) * spring-framework: Directory traversal vulnerability with static resources on Windows filesystems (CVE-2018-1271) * tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304) * tomcat: Late application of security constraints can lead to resource exposure for unauthorised users (CVE-2018-1305) * spring-framework: Multipart content pollution (CVE-2018-1272) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 4. Bugs fixed (https://bugzilla.redhat.com/): 1548282 - CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users 1548289 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources 1564408 - CVE-2018-1272 spring-framework: Multipart content pollution 1565307 - CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270 1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems 5

Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. The LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid configuration, then Avamar Installation Manager may not be able to connect to Dell EMC Online Support web site successfully. The remote unauthenticated attacker can also read and use the credentials to login to Dell EMC Online Support, impersonating the AVI service actions using those credentials. Dell EMC Avamar Server Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. An attacker can exploit this issue to bypass authentication mechanism and perform unauthorized actions. This may lead to further attacks. Dell EMC Avamar Server is a suite of fully virtualized backup and recovery software for servers. Avamar Installation Manager is one of the Avamar installation managers. Refer to KB Article 513978 for instructions on applying the hotfix. Please note that applying the hotfix does not require a reboot or shutdown. Read and use the information in this Dell EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. For an explanation of Severity Ratings, refer to Dell EMC Knowledgebase solution emc218831. Dell EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. Dell EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. Dell EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall Dell EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Dell EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJaxmHGAAoJEHbcu+fsE81ZRtoH/RYsP9wVgHlEUAzJ3ZNgJumu +rXt4amwIW0x8X3bv0DI1ftIrO8sb7TDJ3c234Ax4wR1IZUHQDuIfjf1qqKgpved Zjo/WKSK4goY7ieD4+9ORGZc9nmHsoAHO1U1o77jcf5jkSwrPIFGCXok1efLJBcE YNQgwbd6e7kGpmWkesGMqLpMGQi3TFzxwnbuVsG6iiEU1eFw07LvpV9PONdGMbLO OHVZ6c/Da/FU5dcDWFSFBC+XaI9DJq89mdkyvgLS8NpqfzW0RF0x3kzjEBWfev3k 0J5dSueulLUoDfBOPIrypBvjtzNVhxWvUHcv/j+ozSIhUia9JMWJ8W8rVnR8BHw= =MhV3 -----END PGP SIGNATURE-----

The MySQL server in Juniper Networks Junos Space before 13.3R1.8 has an unspecified account with a hardcoded password, which allows remote attackers to obtain sensitive information and consequently obtain administrative control by leveraging database access. Juniper Networks Junos Space Contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Juniper Junos Space is prone to an information-disclosure vulnerability. Attackers can leverage this issue to gain access to sensitive information. Information obtained will aid in further attacks. Versions prior to Juniper Junos Space 13.3R1.8 are vulnerable. The solution supports automated configuration, monitoring, and troubleshooting of devices and services throughout their lifecycle. MySQL server is one of the MySQL relational database servers

A vulnerability has been identified in OpenPCS 7 V7.1 and earlier (All versions), OpenPCS 7 V8.0 (All versions), OpenPCS 7 V8.1 (All versions < V8.1 Upd5), OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd1), SIMATIC BATCH V7.1 and earlier (All versions), SIMATIC BATCH V8.0 (All versions < V8.0 SP1 Upd21), SIMATIC BATCH V8.1 (All versions < V8.1 SP1 Upd16), SIMATIC BATCH V8.2 (All versions < V8.2 Upd10), SIMATIC BATCH V9.0 (All versions < V9.0 SP1), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC NET PC Software V15 (All versions < 15 SP1), SIMATIC PCS 7 V7.1 and earlier (All versions), SIMATIC PCS 7 V8.0 (All versions), SIMATIC PCS 7 V8.1 (All versions), SIMATIC PCS 7 V8.2 (All versions < V8.2 SP1), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP1), SIMATIC Route Control V7.1 and earlier (All versions), SIMATIC Route Control V8.0 (All versions), SIMATIC Route Control V8.1 (All versions), SIMATIC Route Control V8.2 (All versions), SIMATIC Route Control V9.0 (All versions < V9.0 Upd1), SIMATIC WinCC Runtime Professional V13 (All versions < V13 SP2 Upd2), SIMATIC WinCC Runtime Professional V14 (All versions < V14 SP1 Upd5), SIMATIC WinCC V7.2 and earlier (All versions < WinCC 7.2 Upd 15), SIMATIC WinCC V7.3 (All versions < WinCC 7.3 Upd 16), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Upd 4), SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). Specially crafted messages sent to the RPC service of the affected products could cause a Denial-of-Service condition on the remote and local communication functionality of the affected products. A reboot of the system is required to recover the remote and local communication functionality. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known. plural Siemens SIMATIC The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. SIMATIC WinCC, SIMATIC PCS 7, SIMATIC BATCH, etc. are all industrial automation products from Siemens AG. Siemens OpenPCS, etc. Siemens OpenPCS is a process control system. SIMATIC BATCH is a set of software packages for batch automation. Input validation vulnerabilities exist in several Siemens products