VARIoT IoT vulnerabilities database

The Head Unit HU_NBT (aka Infotainment) component on BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, and BMW 7 Series vehicles produced in 2012 through 2018 allows a local attack when a USB device is plugged in. plural BMW In the series Head Unit HU_NBT ( alias Infotainment) The component contains a vulnerability related to failure of the protection mechanism.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. HeadUnitHU_NBT (Infotainment) component is a system of infotainment systems. There are security holes in the HeadUnitHU_NBT component on several BMW cars (cars produced in 2012-2018). There are currently no detailed vulnerability descriptions. BMW Infotainment System Telematics/Control Unit/Central Gateway Module are prone to the following multiple security vulnerabilities: 1. A local code-execution vulnerability 2. A security-bypass vulnerability 3. A denial-of-service vulnerability 4. Multiple remote code-execution vulnerabilities An attacker can leverage these issues to execute arbitrary code with root privileges, bypass certain security restrictions, perform unauthorized actions, or gain sensitive information within the context of the affected system. Failed exploit attempts will likely result in denial of service conditions

Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a. Has speculative execution function CPU Is vulnerable to a cache-side channel attack. "Variant 4" Or "SpectreNG" It is called. Has speculative execution function CPU The following vulnerabilities have been reported that perform cache timing side-channel attacks against. * CVE-2018-3639 (Variant 4 "SpectreNG") : Speculative Store Bypass (SSB) * CVE-2018-3640 (Variant 3a) : Rogue System Register Read (RSRE) For more information, Project Zero <a href="https://bugs.chromium.org/p/project-zero/issues/detail?id=1528">bug report</a> , Intel security advisory <a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html">INTEL-SA-00115</a> and ARM <a href="https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability">whitepaper</a> Please refer to. This vulnerability has been announced in the past <a href="https://www.kb.cert.org/vuls/id/584653"> Vulnerability </a> CVE-2017-5753 (Variant 1 "Spectre") , CVE-2017-5715 (Variant 2 "Spectre") , CVE-2017-5754 (Variant 3 "Meltdown") To be similar to "SpectreNG" It is reported with the name.By using a cache timing side channel attack, a third party who can access as a local user may be able to read arbitrary privilege data or system register values. CPUhardware is firmware that runs in the central processor for managing and controlling the CPU. A number of CPUHardwares have information disclosure vulnerabilities. The vulnerability is caused by a race condition in the CPU cache processing. Local attackers can exploit vulnerabilities to obtain sensitive information through side channel analysis. Multiple CPU Hardwares are prone to an information-disclosure vulnerability. AMD, ARM, and Intel CPUs are all CPU (central processing unit) products from different manufacturers. For the stable distribution (stretch), these problems have been fixed in version 3.20180703.2~deb9u1. We recommend that you upgrade your intel-microcode packages. For the detailed security status of intel-microcode please refer to its security tracker page at: https://security-tracker.debian.org/tracker/intel-microcode Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlt11DsACgkQEMKTtsN8 TjaLRQ/7BRb1atQVGNSPWx7bSE1NTEGIv7MKLSQTBrAJt6VjsVoZPA/B4rgoxG8b li6UzUt0UfuEsS4H14O0fKqXHFWxeld1MjkEtMYaDbcaJ9PLUh2u3KxlEspmKhHG 2QTVwD88FZkeUgbGyfkI0w4n93UU7Kzm5FotKYiz1oRcdNgnCqpp+m/s9FpgWi00 np2DAYv6Qr4OixiT877pQS7vVJhp5QjFRysNb2FXHz9BagdpJgTpEid5tWkS50uy mABQefuajZuPXxhksR3d0BxCJErws9jnuXn7kd5P/Mv2lTpKgxTRkq8VzzhQRO1U TRn0p9Xg8g3lt+t8hdMGUsfwbbtX9kuOHwdT5QjURHhMN9BQSpk9jS6tqUF9tHXV Udbx6mYcRaBOjSBSDGs3VfH6PQEiHGMhXZWKWcJw3OlaUmLn147Mcj8OSIDJ8bIZ EYTiKtHJrZWAYmwWaeY1C8lfI7hUGPMpBbK8xXjTX5Iqjh8ibjYU6F5YnCFJ7N6t bFihXym3yapPOBZxE8BrDDX+tQ28juFU9qXjJ/VCc6Qpd6Y3aJXcnU+g7AUaYbGE SveoEMDPv4DeqA1wqc4ZJtc8T2E2fUHG8hhdWG24Os3zvjuiUg43UemIDgyoTL/A nL49y6Z/Jx6IxL+qiteaUJZzukel4ocGhOV9HAprahYjvV0v7Ps-aH -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ VMware Security Advisory Advisory ID: VMSA-2018-0012.1 Severity: Moderate Synopsis: VMware vSphere, Workstation and Fusion updates enable Hypervisor-Assisted Guest Mitigations for Speculative Store Bypass issue Issue date: 2018-05-21 Updated on: 2018-06-28 CVE number: CVE-2018-3639 1. Summary VMware vSphere, Workstation and Fusion updates enable Hypervisor- Assisted Guest Mitigations for Speculative Store Bypass issue. The mitigations in this advisory are categorized as Hypervisor- Assisted Guest Mitigations described by VMware Knowledge Base article 54951. KB54951 also covers CVE-2018-3640 mitigations which do not require VMware product updates. 2. Relevant Products VMware vCenter Server (VC) VMware vSphere ESXi (ESXi) VMware Workstation Pro / Player (Workstation) VMware Fusion Pro / Fusion (Fusion) 3. Problem Description vCenter Server, ESXi, Workstation, and Fusion update speculative execution control mechanism for Virtual Machines (VMs). As a result, a patched Guest Operating System (GOS) can remediate the Speculative Store bypass issue (CVE-2018-3639) using the Speculative-Store- Bypass-Disable (SSBD) control bit. This issue may allow for information disclosure in applications and/or execution runtimes which rely on managed code security mechanisms. Based on current evaluations, we do not believe that CVE-2018-3639 could allow for VM to VM or Hypervisor to VM Information disclosure. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2018-3639 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Mitigation/ Product Version on Severity Apply Patch Workaround =========== ======= ======= ======== ==================== ========== VC 6.7 Any Moderate 6.7.0b * None VC 6.5 Any Moderate 6.5 U2b * None VC 6.0 Any Moderate 6.0 U3f * None VC 5.5 Any Moderate 5.5 U3i * None ESXi 6.7 Any Moderate ESXi670-201806401-BG * None ESXi670-201806402-BG ** ESXi 6.5 Any Moderate ESXi650-201806401-BG * None ESXi650-201806402-BG ** ESXi 6.0 Any Moderate ESXi600-201806401-BG * None ESXi600-201806402-BG ** ESXi 5.5 Any Moderate ESXi550-201806401-BG * None ESXi550-201806402-BG ** Workstation 14.x Any Moderate 14.1.2 * None Fusion 10.x OSX Moderate 10.1.2 * None * There are additional VMware and 3rd party requirements for CVE-2018-3639 mitigation beyond applying these updates. Please see VMware Knowledge Base article 55111 for details. ** If available, these ESXi patches apply the required microcode updates. The included microcode updates are documented in the VMware Knowledge Base articles listed in the Solution section. 4. Solution Please review the patch/release notes for your product and version and verify the checksum of your downloaded file. vCenter Server 6.7.0b Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VC670B&productId=742 &rPId=24511 Documentation: https://docs.vmware.com/en/VMware-vSphere/6.7/rn/vsphere-vcenter-server-670 b-release-notes.html vCenter Server 6.5 U2b Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VC65U2B&productId=61 4&rPId=24437 Documentation: https://docs.vmware.com/en/VMware-vSphere/6.5/rn/vsphere-vcenter-server-65u 2b-release-notes.html vCenter Server 6.0 U3f Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VC60U3F&productId=49 1&rPId=24398 Documentation: https://docs.vmware.com/en/VMware-vSphere/6.0/rn/vsphere-vcenter-server-60u 3f-release-notes.html vCenter Server 5.5 U3i Downloads: https://my.vmware.com/web/vmware/details?downloadGroup=VC55U3I&productId=35 3&rPId=24327 Documentation: https://docs.vmware.com/en/VMware-vSphere/5.5/rn/vsphere-vcenter-server-55u 3i-release-notes.html VMware ESXi 6.7 Downloads: https://my.vmware.com/group/vmware/patch Documentation: https://kb.vmware.com/kb/55920 https://kb.vmware.com/kb/55921 (microcode) VMware ESXi 6.5 Downloads: https://my.vmware.com/group/vmware/patch Documentation: https://kb.vmware.com/kb/55915 https://kb.vmware.com/kb/55916 (microcode) VMware ESXi 6.0 Downloads: https://my.vmware.com/group/vmware/patch Documentation: https://kb.vmware.com/kb/55910 https://kb.vmware.com/kb/55911 (microcode) VMware ESXi 5.5 Downloads: https://my.vmware.com/group/vmware/patch Documentation: https://kb.vmware.com/kb/55905 https://kb.vmware.com/kb/55906 (microcode) VMware Workstation Pro, Player 14.1.2 Downloads and Documentation: https://www.vmware.com/go/downloadworkstation https://www.vmware.com/go/downloadplayer VMware Fusion Pro / Fusion 10.1.2 Downloads and Documentation: https://www.vmware.com/go/downloadfusion 5. References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3639 https://kb.vmware.com/kb/54951 https://kb.vmware.com/kb/55111 - ------------------------------------------------------------------------ 6. Change log 2018-05-21: VMSA-2018-0012 Initial security advisory in conjunction with the release of Workstation 14.1.2 and Fusion 10.1.2 on 2018-05-21. 2018-06-28: VMSA-2018-0012.1 Updated security advisory in conjunction with the release of vCenter Server 5.5 U3i, 6.0 U3f, 6.5 U2b, 6.7.0b and ESXi 5.5 - 6.7 patches on 2018-06-28. - ------------------------------------------------------------------------ 7. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: security-announce at lists.vmware.com bugtraq at securityfocus.com fulldisclosure at seclists.org E-mail: security at vmware.com PGP key at: https://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html VMware Security & Compliance Blog https://blogs.vmware.com/security Twitter https://twitter.com/VMwareSRC Copyright 2018 VMware Inc. All rights reserved. -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.8.3 (Build 4028) Charset: utf-8 wj8DBQFbNaFeDEcm8Vbi9kMRAn4NAJ42HgDjfXkcTVfDupwE4KPdPVsf7wCcDaLy aN23XiAmhvFSxcQ5GnJR0ls= =frKv -----END PGP SIGNATURE----- . ========================================================================== Ubuntu Security Notice USN-3756-1 August 27, 2018 intel-microcode vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: The system could be made to expose sensitive information. Software Description: - intel-microcode: Processor microcode for Intel CPUs Details: It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). A local attacker in a guest virtual machine could use this to expose sensitive information (memory from other guests or the host OS). This vulnerability is also known as Rogue System Register Read (RSRE). (CVE-2018-3640) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: intel-microcode 3.20180807a.0ubuntu0.18.04.1 Ubuntu 16.04 LTS: intel-microcode 3.20180807a.0ubuntu0.16.04.1 Ubuntu 14.04 LTS: intel-microcode 3.20180807a.0ubuntu0.14.04.1 After a standard system update you need to reboot your computer to make all the necessary changes

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4. CPU hardware utilizing speculative execution may be vulnerable to cache timing side-channel analysis. Two vulnerabilities are identified, known as "Variant 3a" and "Variant 4". CPUhardware is firmware that runs in the central processor for managing and controlling the CPU. Multiple CPUHardware information disclosure vulnerabilities. The vulnerability is caused by a race condition in the CPU cache processing. Local attackers can exploit vulnerabilities to obtain sensitive information through side channel analysis. AMD, ARM, and Intel CPUs are all CPU (central processing unit) products from different manufacturers. AMD, ARM, and Intel CPUs have security vulnerabilities. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2018:1854-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:1854 Issue date: 2018-06-19 CVE Names: CVE-2012-6701 CVE-2015-8830 CVE-2016-8650 CVE-2017-2671 CVE-2017-6001 CVE-2017-7308 CVE-2017-7616 CVE-2017-7889 CVE-2017-8890 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077 CVE-2017-12190 CVE-2017-15121 CVE-2017-18203 CVE-2018-1130 CVE-2018-3639 CVE-2018-5803 ===================================================================== 1. Summary: An update for kernel is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - noarch, x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639, PowerPC) * kernel: net/packet: overflow in check for priv area size (CVE-2017-7308) * kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access (CVE-2012-6701) * kernel: AIO write triggers integer overflow in some protocols (CVE-2015-8830) * kernel: Null pointer dereference via keyctl (CVE-2016-8650) * kernel: ping socket / AF_LLC connect() sin_family race (CVE-2017-2671) * kernel: Race condition between multiple sys_perf_event_open() calls (CVE-2017-6001) * kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c (CVE-2017-7616) * kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism (CVE-2017-7889) * kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c (CVE-2017-8890) * kernel: net: sctp_v6_create_accept_sk function mishandles inheritance (CVE-2017-9075) * kernel: net: IPv6 DCCP implementation mishandles inheritance (CVE-2017-9076) * kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance (CVE-2017-9077) * kernel: memory leak when merging buffers in SCSI IO vectors (CVE-2017-12190) * kernel: vfs: BUG in truncate_inode_pages_range() and fuse client (CVE-2017-15121) * kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service (CVE-2017-18203) * kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash (CVE-2018-1130) * kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service (CVE-2018-5803) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting CVE-2018-3639; Vitaly Mayatskih for reporting CVE-2017-12190; and Evgenii Shatokhin (Virtuozzo Team) for reporting CVE-2018-1130. The CVE-2017-15121 issue was discovered by Miklos Szeredi (Red Hat). Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.10 Release Notes and Red Hat Enterprise Linux 6.10 Technical Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 869942 - Kernel crashes on reading an ACL containing 190 ACEs over NFSv4 1314275 - CVE-2015-8830 kernel: AIO write triggers integer overflow in some protocols 1314288 - CVE-2012-6701 kernel: AIO interface didn't use rw_verify_area() for checking mandatory locking on files and size of access 1395187 - CVE-2016-8650 kernel: Null pointer dereference via keyctl 1422825 - CVE-2017-6001 kernel: Race condition between multiple sys_perf_event_open() calls 1436649 - CVE-2017-2671 kernel: ping socket / AF_LLC connect() sin_family race 1437404 - CVE-2017-7308 kernel: net/packet: overflow in check for priv area size 1441088 - CVE-2017-7616 kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c 1444493 - CVE-2017-7889 kernel: mm subsystem does not properly enforce the CONFIG_STRICT_DEVMEM protection mechanism 1448170 - RHEL6.9: sunrpc reconnect logic now may trigger a SYN storm when a TCP connection drops and a burst of RPC commands hit the transport 1450972 - CVE-2017-8890 kernel: Double free in the inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c 1452688 - CVE-2017-9076 kernel: net: IPv6 DCCP implementation mishandles inheritance 1452691 - CVE-2017-9075 kernel: net: sctp_v6_create_accept_sk function mishandles inheritance 1452744 - CVE-2017-9077 kernel: net: tcp_v6_syn_recv_sock function mishandles inheritance 1495089 - CVE-2017-12190 kernel: memory leak when merging buffers in SCSI IO vectors 1497152 - systool causes panic on 2.6.32-696.6.3.el6.x86_64 using be2iscsi 1520893 - CVE-2017-15121 kernel: vfs: BUG in truncate_inode_pages_range() and fuse client 1550811 - CVE-2017-18203 kernel: Race condition in drivers/md/dm.c:dm_get_from_kobject() allows local users to cause a denial of service 1551051 - CVE-2018-5803 kernel: Missing length check of payload in net/sctp/sm_make_chunk.c:_sctp_make_chunk() function allows denial of service 1560494 - i686: Using invpcid_flush_all_nonglobals() can cause user-space panic on .i686 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass 1576419 - CVE-2018-1130 kernel: a null pointer dereference in net/dccp/output.c:dccp_write_xmit() leads to a system crash 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: kernel-2.6.32-754.el6.src.rpm i386: kernel-2.6.32-754.el6.i686.rpm kernel-debug-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-devel-2.6.32-754.el6.i686.rpm kernel-headers-2.6.32-754.el6.i686.rpm perf-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: kernel-2.6.32-754.el6.src.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: kernel-2.6.32-754.el6.src.rpm i386: kernel-2.6.32-754.el6.i686.rpm kernel-debug-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-devel-2.6.32-754.el6.i686.rpm kernel-headers-2.6.32-754.el6.i686.rpm perf-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm ppc64: kernel-2.6.32-754.el6.ppc64.rpm kernel-bootwrapper-2.6.32-754.el6.ppc64.rpm kernel-debug-2.6.32-754.el6.ppc64.rpm kernel-debug-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debug-devel-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-754.el6.ppc64.rpm kernel-devel-2.6.32-754.el6.ppc64.rpm kernel-headers-2.6.32-754.el6.ppc64.rpm perf-2.6.32-754.el6.ppc64.rpm perf-debuginfo-2.6.32-754.el6.ppc64.rpm python-perf-debuginfo-2.6.32-754.el6.ppc64.rpm s390x: kernel-2.6.32-754.el6.s390x.rpm kernel-debug-2.6.32-754.el6.s390x.rpm kernel-debug-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debug-devel-2.6.32-754.el6.s390x.rpm kernel-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-754.el6.s390x.rpm kernel-devel-2.6.32-754.el6.s390x.rpm kernel-headers-2.6.32-754.el6.s390x.rpm kernel-kdump-2.6.32-754.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-754.el6.s390x.rpm kernel-kdump-devel-2.6.32-754.el6.s390x.rpm perf-2.6.32-754.el6.s390x.rpm perf-debuginfo-2.6.32-754.el6.s390x.rpm python-perf-debuginfo-2.6.32-754.el6.s390x.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm ppc64: kernel-debug-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-2.6.32-754.el6.ppc64.rpm kernel-debuginfo-common-ppc64-2.6.32-754.el6.ppc64.rpm perf-debuginfo-2.6.32-754.el6.ppc64.rpm python-perf-2.6.32-754.el6.ppc64.rpm python-perf-debuginfo-2.6.32-754.el6.ppc64.rpm s390x: kernel-debug-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debuginfo-2.6.32-754.el6.s390x.rpm kernel-debuginfo-common-s390x-2.6.32-754.el6.s390x.rpm kernel-kdump-debuginfo-2.6.32-754.el6.s390x.rpm perf-debuginfo-2.6.32-754.el6.s390x.rpm python-perf-2.6.32-754.el6.s390x.rpm python-perf-debuginfo-2.6.32-754.el6.s390x.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: kernel-2.6.32-754.el6.src.rpm i386: kernel-2.6.32-754.el6.i686.rpm kernel-debug-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-devel-2.6.32-754.el6.i686.rpm kernel-headers-2.6.32-754.el6.i686.rpm perf-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm noarch: kernel-abi-whitelists-2.6.32-754.el6.noarch.rpm kernel-doc-2.6.32-754.el6.noarch.rpm kernel-firmware-2.6.32-754.el6.noarch.rpm x86_64: kernel-2.6.32-754.el6.x86_64.rpm kernel-debug-2.6.32-754.el6.x86_64.rpm kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debug-devel-2.6.32-754.el6.i686.rpm kernel-debug-devel-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm kernel-devel-2.6.32-754.el6.x86_64.rpm kernel-headers-2.6.32-754.el6.x86_64.rpm perf-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: kernel-debug-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-2.6.32-754.el6.i686.rpm kernel-debuginfo-common-i686-2.6.32-754.el6.i686.rpm perf-debuginfo-2.6.32-754.el6.i686.rpm python-perf-2.6.32-754.el6.i686.rpm python-perf-debuginfo-2.6.32-754.el6.i686.rpm x86_64: kernel-debug-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-2.6.32-754.el6.x86_64.rpm kernel-debuginfo-common-x86_64-2.6.32-754.el6.x86_64.rpm perf-debuginfo-2.6.32-754.el6.x86_64.rpm python-perf-2.6.32-754.el6.x86_64.rpm python-perf-debuginfo-2.6.32-754.el6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2012-6701 https://access.redhat.com/security/cve/CVE-2015-8830 https://access.redhat.com/security/cve/CVE-2016-8650 https://access.redhat.com/security/cve/CVE-2017-2671 https://access.redhat.com/security/cve/CVE-2017-6001 https://access.redhat.com/security/cve/CVE-2017-7308 https://access.redhat.com/security/cve/CVE-2017-7616 https://access.redhat.com/security/cve/CVE-2017-7889 https://access.redhat.com/security/cve/CVE-2017-8890 https://access.redhat.com/security/cve/CVE-2017-9075 https://access.redhat.com/security/cve/CVE-2017-9076 https://access.redhat.com/security/cve/CVE-2017-9077 https://access.redhat.com/security/cve/CVE-2017-12190 https://access.redhat.com/security/cve/CVE-2017-15121 https://access.redhat.com/security/cve/CVE-2017-18203 https://access.redhat.com/security/cve/CVE-2018-1130 https://access.redhat.com/security/cve/CVE-2018-3639 https://access.redhat.com/security/cve/CVE-2018-5803 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/ssbd https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/6/html/6.10_release_notes/index.html https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/6/html/6.10_technical_notes/index.html 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBWyiNN9zjgjWX9erEAQgn7g/8DeDvxkh3SCpVN2ma5SLYXBnG5pss2Qp7 P5a5zLae8g0OjnZMg2LoCC+Qk0Fe4mpXKB3Wu4yZmRNs7Y5WRWa4imP7ZYvLiSKa KMXLcJhZBMN16ICFw2YX9rN3+wnRC94XY9cW5x0x2uJXoBOMb0MvccLE9z5DIZ7s KI03p2JEHLMt60oZVK6Vdcs+RbfoKLgh3Z2C2ryybjl3LGO+YcqCLvDgsvXnOJl8 TBZRBBd/X6V3xld3x0N3qgPOc4uRXQuqH/QmELZAhcc0MdyhTDQV6JZsYBMV2w5n T0lo71xuPJxLZvMt8UXkQwsCWIuFMQk8uyV6mV+peXxUS0y2LUY2uwWs1AXWOUxx FfYm0jAsZW8kTLZfag9w2zWREib8bs0sx44Etz0HBs+dMHLZc7j6PvTk3zyFijSC qqk+AFGnvM76cQmP8m/SxzEr0YV5FH1wp0eJ/mdn4tl42OBu7Zu7joTI04n6DFsg 1tP5a+46eb8bFLI3FjvoN/Z3Qyaln27tVhFpTY88f3lonDDlFo8BkWNG038JxGRk R6Wjln6724pFfBT9vj+/RQFpSptFKXL3h4Fd/x+XNTFbx1dqpnVaVsstRDxOaqPO ugnRxLgzybXC1UQO0ExMu85jUM3QYLKFSv/G1dHhSsbfbOfnfbPaazpoAvClfWw5 FIbNr61v/A8= =BnkQ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . Description: Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. (CVE-2018-3639) Note: This is the qemu-kvm side of the CVE-2018-3639 mitigation. * QEMU: cirrus: OOB access when updating VGA display (CVE-2018-7858) * QEMU: vga: OOB read access during display update (CVE-2017-13672) * Qemu: Out-of-bounds read in vga_draw_text routine (CVE-2018-5683) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Once all virtual machines have shut down, start them again for this update to take effect. Bugs fixed (https://bugzilla.redhat.com/): 1486560 - CVE-2017-13672 QEMU: vga: OOB read access during display update 1530356 - CVE-2018-5683 Qemu: Out-of-bounds read in vga_draw_text routine 1553402 - CVE-2018-7858 QEMU: cirrus: OOB access when updating VGA display 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass 6. Note: This is the qemu-kvm-rhev side of the CVE-2018-3639 mitigation that includes support for guests running on hosts with AMD processors. Bug Fix(es): * Previously, using device passthrough for a SCSI-2 device failed and returned an "Illegal Request" error. With this update, the QEMU emulator checks the SCSI version of the device when performing passthrough. As a result, the described problem no longer occurs. (BZ#1571370) * Under certain circumstances, resuming a paused guest generated redundant "VIR_DOMAIN_PAUSED_UNKNOWN" error messages in the libvirt log. This update corrects the event sending order when resuming guests, which prevents the errors being logged. (BZ#1582122) Enhancement(s): * With this update, Ceph storage is supported by KVM virtualization on all CPU architectures supported by Red Hat. (BZ#1588001) 4. 6.4) - x86_64 3. Description: The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Bugs fixed (https://bugzilla.redhat.com/): 1566890 - CVE-2018-3639 hw: cpu: speculative store bypass 6. Software Description: - intel-microcode: Processor microcode for Intel CPUs Details: It was discovered that memory present in the L1 data cache of an Intel CPU core may be exposed to a malicious process that is executing on the CPU core. This vulnerability is also known as L1 Terminal Fault (L1TF). This vulnerability is also known as Rogue System Register Read (RSRE). ========================================================================== Ubuntu Security Notice USN-3653-2 May 22, 2018 linux-hwe, linux-azure, linux-gcp, linux-oem vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were addressed in the Linux kernel. This update provides the corresponding updates for the Linux Hardware Enablement (HWE) kernel from Ubuntu 17.10 for Ubuntu 16.04 LTS. (CVE-2018-3639) It was discovered that the netlink subsystem in the Linux kernel did not properly restrict observations of netlink messages to the appropriate net namespace. (CVE-2017-17449) Tuba Yavuz discovered that a double-free error existed in the USBTV007 driver of the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2017-17975) It was discovered that a race condition existed in the Device Mapper component of the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2017-18203) It was discovered that an infinite loop could occur in the madvise(2) implementation in the Linux kernel in certain circumstances. A local attacker could use this to cause a denial of service (system hang). (CVE-2017-18208) Silvio Cesare discovered a buffer overwrite existed in the NCPFS implementation in the Linux kernel. A remote attacker controlling a malicious NCPFS server could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2018-8822) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: linux-image-4.13.0-1017-gcp 4.13.0-1017.21 linux-image-4.13.0-1018-azure 4.13.0-1018.21 linux-image-4.13.0-1028-oem 4.13.0-1028.31 linux-image-4.13.0-43-generic 4.13.0-43.48~16.04.1 linux-image-4.13.0-43-generic-lpae 4.13.0-43.48~16.04.1 linux-image-4.13.0-43-lowlatency 4.13.0-43.48~16.04.1 linux-image-azure 4.13.0.1018.19 linux-image-gcp 4.13.0.1017.19 linux-image-generic-hwe-16.04 4.13.0.43.62 linux-image-generic-lpae-hwe-16.04 4.13.0.43.62 linux-image-gke 4.13.0.1017.19 linux-image-lowlatency-hwe-16.04 4.13.0.43.62 linux-image-oem 4.13.0.1028.33 Please note that fully mitigating CVE-2018-3639 (Spectre Variant 4) may require corresponding processor microcode/firmware updates or, in virtual environments, hypervisor updates. On i386 and amd64 architectures, the SSBD feature is required to enable the kernel mitigations. BIOS vendors will be making updates available for Intel processors that implement SSBD and Ubuntu is working with Intel to provide future microcode updates. Ubuntu users with a processor from a different vendor should contact the vendor to identify necessary firmware updates. Ubuntu provided corresponding QEMU updates for users of self-hosted virtual environments in USN 3651-1. Ubuntu users in cloud environments should contact the cloud provider to confirm that the hypervisor has been updated to expose the new CPU features to virtual machines. Issue date: 2018-05-21 Updated on: 2018-05-21 (Initial Advisory) CVE number: CVE-2018-3639 1. Summary VMware vSphere, Workstation and Fusion updates enable Hypervisor- Assisted Guest Mitigations for Speculative Store Bypass issue. The mitigations in this advisory are categorized as Hypervisor Assisted Guest Mitigations described by VMware Knowledge Base article 54951. KB54951 also covers CVE-2018-3640 mitigations which do not require VMware product updates. Relevant Products VMware vCenter Server (VC) VMware vSphere ESXi (ESXi) VMware Workstation Pro / Player (Workstation) VMware Fusion Pro / Fusion (Fusion) 3. Problem Description vCenter Server, ESXi, Workstation, and Fusion update speculative execution control mechanism for Virtual Machines (VMs). As a result, a patched Guest Operating System (GOS) can remediate the Speculative Store bypass issue (CVE-2018-3639) using the Speculative-Store- Bypass-Disable (SSBD) control bit. This issue may allow for information disclosure in applications and/or execution runtimes which rely on managed code security mechanisms. Based on current evaluations, we do not believe that CVE-2018-3639 could allow for VM to VM or Hypervisor to VM Information disclosure. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2018-3639 to this issue. Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product Running Replace with/ Mitigation/ Product Version on Severity Apply Patch Workaround =========== ========= ======= ========= ================= ========== VC 6.7 Any Moderate Patch Pending* None VC 6.5 Any Moderate Patch Pending* None VC 6.0 Any Moderate Patch Pending* None VC 5.5 Any Moderate Patch Pending* None ESXi 6.7 Any Moderate Patch Pending* None ESXi 6.5 Any Moderate Patch Pending* None ESXi 6.0 Any Moderate Patch Pending* None ESXi 5.5 Any Moderate Patch Pending* None Workstation 14.x Any Moderate 14.1.2** None Fusion 10.x Any Moderate 10.1.2** None *These updates are on hold until Intel has released updated microcode which has been tested by VMware. **There are additional VMware and 3rd party requirements for CVE-2018-3639 mitigation beyond applying these updates. Please see VMware Knowledge Base Article 55111 for details. Solution VMware Workstation Pro, Player 14.1.2 Downloads and Documentation: https://www.vmware.com/go/downloadworkstation https://www.vmware.com/go/downloadplayer VMware Fusion Pro / Fusion 10.1.2 Downloads and Documentation: https://www.vmware.com/go/downloadfusion 5. Change log 2018-05-21: Initial security advisory in conjunction with the release of Workstation 14.1.2 and Fusion 10.1.2 on 2018-05-21. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: security-announce@lists.vmware.com bugtraq@securityfocus.com fulldisclosure@seclists.org E-mail: security at vmware.com PGP key at: https://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories VMware Security Response Policy https://www.vmware.com/support/policies/security_response.html VMware Lifecycle Support Phases https://www.vmware.com/support/policies/lifecycle.html VMware Security & Compliance Blog https://blogs.vmware.com/security Twitter https://twitter.com/VMwareSRC Copyright 2018 VMware Inc. All rights reserved

A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FTP server on port 2121, and upload files or list directories, by entering these credentials. mySCADA myPRO Contains a vulnerability in the use of hard-coded credentials.Information may be obtained and information may be altered

The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remote device temperature control, as demonstrated by a tstat t_heat request that accesses a device purchased in the Spring of 2018, and sets a home's target temperature to 95 degrees Fahrenheit. This vulnerability might be described as an addendum to CVE-2013-4860. Radio Thermostat CT50 and CT80 Contains an input validation vulnerability.Information may be tampered with. Radio Thermostat CT50 and CT80 are touch screen thermostat products of American Radio Thermostat Company. This product manages heating and cooling systems in homes. Local HTTP API is one of the local HTTP interfaces

On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can forge an HTTP request to inject operating system commands that can be executed on the device with higher privileges, aka remote code execution. D-Link DIR-550A and DIR-604M The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-Link DIR-550A and DIR-604M are both D-Link wireless router products. A remote code execution vulnerability exists in D-LinkDIR-550A and DIR-604M2.10KR and earlier

totemomail Encryption Gateway before 6.0_b567 allows remote attackers to obtain sensitive information about user sessions and encryption key material via a JSONP hijacking attack. totemomail Encryption Gateway Contains an information disclosure vulnerability.Information may be obtained. A security vulnerability exists in previous versions of totemomailEncryptionGateway6.0_b567

On D-Link DIR-550A and DIR-604M devices through v2.10KR, a malicious user can use a default TELNET account to get unauthorized access to vulnerable devices, aka a backdoor access vulnerability. D-Link DIR-550A and DIR-604M Devices have vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The D-Link DIR-550A and DIR-604M are both D-Link wireless router products. Security vulnerabilities existed in D-LinkDIR-550A and DIR-604M2.10KR and earlier

procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution in proc utilities run by other users. procps-ng Contains an integer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Procps-ng Procps is prone to the following security vulnerabilities: 1. A local security-bypass vulnerability 2. A local privilege-escalation vulnerability 3. A local denial-of-service vulnerability 4. Multiple local integer-overflow vulnerabilities 5. A stack-based buffer-overflow vulnerability Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201805-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: procps: Multiple vulnerabilities Date: May 30, 2018 Bugs: #656022 ID: 201805-14 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in procps, the worst of which could result in the execution of arbitrary code. Background ========== A bunch of small useful utilities that give information about processes using the /proc filesystem. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-process/procps < 3.3.15-r1 >= 3.3.15-r1 Description =========== Multiple vulnerabilities have been discovered in procps. Please review the CVE identifiers referenced below for details. Impact ====== A local attacker could execute arbitrary code, escalate privileges, or cause a Denial of Service condition. Workaround ========== There is no known workaround at this time. Resolution ========== All procps users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-process/procps-3.3.15-r1" References ========== [ 1 ] CVE-2018-1120 https://nvd.nist.gov/vuln/detail/CVE-2018-1120 [ 2 ] CVE-2018-1121 https://nvd.nist.gov/vuln/detail/CVE-2018-1121 [ 3 ] CVE-2018-1122 https://nvd.nist.gov/vuln/detail/CVE-2018-1122 [ 4 ] CVE-2018-1123 https://nvd.nist.gov/vuln/detail/CVE-2018-1123 [ 5 ] CVE-2018-1124 https://nvd.nist.gov/vuln/detail/CVE-2018-1124 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201805-14 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2018 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5

In Delta Electronics Automation TPEditor version 1.89 or prior, parsing a malformed program file may cause heap-based buffer overflow vulnerability, which may allow remote code execution. Delta Electronics Automation TPEditor Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Delta Industrial Automation TPEditor is a programming software for Delta Electronics' Delta Text Panel running on Windows. Failed attempts will likely result in denial-of-service conditions

In GE PACSystems RX3i CPE305/310 version 9.20 and prior, RX3i CPE330 version 9.21 and prior, RX3i CPE 400 version 9.30 and prior, PACSystems RSTi-EP CPE 100 all versions, and PACSystems CPU320/CRU320 RXi all versions, the device does not properly validate input, which could allow a remote attacker to send specially crafted packets causing the device to become unavailable. plural GE The product contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. PACSystems RX3i CPE305/310, RX3i CPE330, RX3i CPE 400 are all GE programmable programmable controller products. GE PACSystems are prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause the device to reboot and change its state, denying service to legitimate users. GE PACSystems RX3i CPE305, etc. A security vulnerability exists in several GE products due to the program not properly validating input

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 allow reading the configuration file by an unauthenticated user. plural Phoenix Contact FL SWITCH The product contains an information disclosure vulnerability.Information may be obtained. PhoenixContact is a German provider of industrial automation, connectivity and interface solutions for critical infrastructure applications such as communications, critical manufacturing and information technology. PhoenixContactmanagedFLSWITCH has an information disclosure vulnerability that allows unauthenticated attackers to read the device's profile content. An OS command-execution vulnerability 2. An information-disclosure vulnerability 3. Multiple stack-based buffer-overflow vulnerabilities Attackers can exploit these issues to execute arbitrary code, execute arbitrary OS commands, obtain sensitive information, and perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very large cookies (a different vulnerability than CVE-2018-10728). plural Phoenix Contact FL SWITCH The product contains a buffer error vulnerability. This vulnerability CVE-2018-10728 Is a different vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PHOENIXCONTACTFLSWITCH3xxx, 4xxx and 48xxxSeries are all different series of switch devices from the Phoenix Contact group in Germany. A stack buffer overflow vulnerability exists in PHOENIXCONTACTFLSWITCH3xxx, 4xxx, and 48xxxSeries products using firmware versions 1.0 through 1.32. A remote attacker could exploit the vulnerability to gain unauthorized access to the switch operating system files and to inject executable code into the operating system. An OS command-execution vulnerability 2. An information-disclosure vulnerability 3. Multiple stack-based buffer-overflow vulnerabilities Attackers can exploit these issues to execute arbitrary code, execute arbitrary OS commands, obtain sensitive information, and perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection. PhoenixContact is a German provider of industrial automation, connectivity and interface solutions for critical infrastructure applications such as communications, critical manufacturing and information technology. PhoenixContactmanagedFLSWITCH has a command injection vulnerability. If the configuration file can be transferred to the switch or transferred from the switch, the attacker can upgrade the firmware to execute any OSshell command. An OS command-execution vulnerability 2. An information-disclosure vulnerability 3. Multiple stack-based buffer-overflow vulnerabilities Attackers can exploit these issues to execute arbitrary code, execute arbitrary OS commands, obtain sensitive information, and perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition

All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows (a different vulnerability than CVE-2018-10731). plural Phoenix Contact FL SWITCH The product contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PhoenixContact is a German provider of industrial automation, connectivity and interface solutions for critical infrastructure applications such as communications, critical manufacturing and information technology. PhoenixContactmanagedFLSWITCH has a buffer overflow vulnerability that allows an attacker to insert a specially crafted cookie into a GET request to cause a buffer overflow, thereby triggering a denial of service attack and executing arbitrary code. An OS command-execution vulnerability 2. An information-disclosure vulnerability 3. Multiple stack-based buffer-overflow vulnerabilities Attackers can exploit these issues to execute arbitrary code, execute arbitrary OS commands, obtain sensitive information, and perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition

Medtronic N'Vision Clinician Programmer 8840 N'Vision Clinician Programme and 8870 N'Vision removable Application Card do not encrypt PII and PHI while at rest. The Medtronic N'Vision Clinician Programmer is a small, portable device that provides a single programming platform for Medtronic nerve graft therapy devices. The Medtronic N'Vision Clinician Programmer has an information disclosure vulnerability that allows an attacker to exploit sensitive information. Medtronic N'Vision Clinician Programmer is prone to an information-disclosure vulnerability. The vulnerability is caused by the program not encrypting PII and PHI

PrinterOn Enterprise 4.1.3 stores the Active Directory bind credentials using base64 encoding, which allows local users to obtain credentials for a domain user by reading the cps_config.xml file. PrinterOn Contains information disclosure vulnerabilities and certificate / password management vulnerabilities.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. PrinterOn Enterprise is a set of secure cloud printing solutions from PrinterOn Canada. The solution supports printing from laptops, desktops, and mobile devices to connected printers. There is an information disclosure vulnerability in PrinterOn Enterprise 4.1.3, which stems from the fact that the program uses base64 encoding to store credentials

PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration, (2) description field in the print server configuration, and (3) username field for authentication to print as guest. PrinterOn Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. PrinterOn Enterprise is a set of secure cloud printing solutions from PrinterOn Canada. The solution supports printing from laptops, desktops, and mobile devices to connected printers

procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124. procps-ng Contains an integer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Procps-ng Procps is prone to the following security vulnerabilities: 1. A local security-bypass vulnerability 2. A local privilege-escalation vulnerability 3. A local denial-of-service vulnerability 4. Multiple local integer-overflow vulnerabilities 5. A stack-based buffer-overflow vulnerability Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application or perform unauthorized actions. Failed exploit attempts will likely cause a denial-of-service condition

The AppFirewall functionality in Citrix NetScaler Application Delivery Controller and NetScaler Gateway 10.5 before Build 68.7, 11.0 before Build 71.24, 11.1 before Build 58.13, and 12.0 before Build 57.24 allows remote attackers to execute arbitrary code via unspecified vectors. A security vulnerability exists in the AppFirewall feature in Citrix NetScaler ADC and NetScaler Gateway. A remote attacker could exploit this vulnerability to execute arbitrary code