VARIoT IoT vulnerabilities database

Weak password exists on Lakodi camera, allowing initial password login

The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software VNS-L21C185B130 and earlier versions and P8 Lite with software ALE-L02C636B150 and earlier versions has an input validation vulnerability, which allows attackers to cause the system to restart. Huawei P9, P9Lite, and P8Lite are Huawei smartphones. A denial of service vulnerability exists in some of Huawei's mobile phone TrustZone drivers. An attacker could convince a user to install a malicious application, and the application exploited the vulnerability to pass specific parameters to the TrustZone driver, causing the system to reboot. Multiple Huawei Products are prone to the following multiple security vulnerabilities. 1. A denial-of-service vulnerability. 2. A privilege escalation vulnerability. 3. A security bypass vulnerability. Attackers can exploit these issues to perform certain unauthorized actions or gain elevated privileges. Failed exploit attempts will likely cause denial-of-service conditions

The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software VNS-L21C185B130 and earlier versions and P8 Lite with software ALE-L02C636B150 and earlier versions has an improper resource release vulnerability, which allows attackers to cause a system restart or privilege elevation. Huawei P9, P9Lite, and P8Lite are Huawei smartphones. Some of Huawei's mobile phone TrustZone drivers have privilege escalation vulnerabilities. An attacker could convince a user to install a malicious application that could be exploited by an application to send specific parameters to the TrustZone driver, resulting in a system reboot or elevated user rights. Multiple Huawei Products are prone to the following multiple security vulnerabilities. 1. A denial-of-service vulnerability. 2. 3. A security bypass vulnerability. Attackers can exploit these issues to perform certain unauthorized actions or gain elevated privileges. Failed exploit attempts will likely cause denial-of-service conditions

The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software VNS-L21C185B130 and earlier versions and P8 Lite with software ALE-L02C636B150 and earlier versions has an input validation vulnerability, which allows attackers to read and write user-mode memory data anywhere in the TrustZone driver. Huawei P9, P9Lite, and P8Lite are Huawei smartphones. Some of Huawei's mobile secure storage trusted applications (SecureStorageTrustedApp) have security bypass vulnerabilities. An attacker who has obtained root access to the Android system can exploit the vulnerability to read and write user-state memory data at any location in TrustZone. Multiple Huawei Products are prone to the following multiple security vulnerabilities. 1. A denial-of-service vulnerability. 2. A privilege escalation vulnerability. 3. Attackers can exploit these issues to perform certain unauthorized actions or gain elevated privileges. Failed exploit attempts will likely cause denial-of-service conditions

The HIFI driver in Huawei Mate 8 phones with software versions before NXT-AL10C00B386, versions before NXT-CL00C92B386, versions before NXT-DL00C17B386, versions before NXT-TL00C01B386; Mate S phones with software Versions before CRR-CL00C92B368, Versions before CRR-CL20C92B368, Versions before CRR-TL00C01B368, Versions before CRR-UL00C00B368, Versions before CRR-UL20C00B368; P8 phones with software Versions before GRA-TL00C01B366, Versions before GRA-CL00C92B366, Versions before GRA-CL10C92B366, Versions before GRA-UL00C00B366, Versions before GRA-UL10C00B366; and P9 phones with software Versions before EVA-AL10C00B190, Versions before EVA-DL10C00B190, Versions before EVA-TL10C00B190, Versions before EVA-CL10C00B190 allows attackers to get root privilege or crash the system or execute arbitrary code, related to a buffer overflow. plural Huawei Smartphone software HIFI The driver has a deficiency in processing related to buffer overflow. root There are vulnerabilities that can be used to gain privileges, crash the system, or execute arbitrary code.By the attacker, root It may be possible to gain privileges, crash the system, or execute arbitrary code. HuaweiMate8, MateS, P8, and P9 are Huawei smartphones. Because some HIFI drivers of Huawei mobile phones lack parameter checking, the attacker uses the vulnerability to construct specific parameters to the HIFI driver after obtaining root privileges, resulting in system restart or arbitrary code execution. Multiple Huawei Products are prone to a local buffer-overflow vulnerability because they fail to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts will likely result in denial-of-service conditions. The Huawei Mate 8 and others are smartphones from the Chinese company Huawei

The mDNIe system service on Samsung Mobile S7 devices with M(6.0) software does not properly restrict setmDNIeScreenCurtain API calls, enabling attackers to control a device's screen. This can be exploited via a crafted application to eavesdrop after phone shutdown or record a conversation. The Samsung ID is SVE-2016-6343. SamsungMobile is a series of smart mobile devices released by South Korea's Samsung. Multiple Samsung Galaxy products are prone to a security-bypass vulnerability. An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Samsung Galaxy devices with Marshmallow 6.0 are vulnerable

TP-LINKTDDP is a device debugging protocol. A buffer overflow vulnerability exists in TP-LINKTDDP. The attacker exploits the vulnerability by sending a \"setconfiguration\" message containing the v1 package to the TDDP service by hand to execute arbitrary code.

TP-LINKTDDP is a device debugging protocol. TP-LINKTDDP has an information disclosure vulnerability. An attacker can exploit the vulnerability to obtain a web interface configuration file, including web login credentials.

Huawei CloudEngine 12800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 5800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 6800 with software V100R002C00, V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 7800 with software V100R003C00, V100R003C10, V100R005C00, V100R005C10, V100R006C00; CloudEngine 8800 with software V100R006C00; and Secospace USG6600 with software V500R001C00 allow remote unauthenticated attackers to craft specific IPFPM packets to trigger an integer overflow and cause the device to reset. HuaweiCloudEngine12800, CloudEngine5800, CloudEngine6800, CloudEngine7800, and CloudEngine8800 are Huawei switch devices. An integer overflow vulnerability exists in some Huawei switches. Multiple Huawei CloudEngine Products are prone to an integer-overflow vulnerability. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed. Huawei CloudEngine 5800 and others are data center switches of China's Huawei (Huawei). The vulnerability is caused by the fact that the programs do not check specific fields in IPFPM packets. The following products and versions are affected: versions earlier than Huawei CloudEngine 12800 V200R001C00, versions earlier than CloudEngine 5800 V200R001C00, versions earlier than CloudEngine 6800 V200R001C00, versions earlier than CloudEngine 7800 V200R001C00, versions earlier than CloudEngine 8800 V200R001C

Touch Panel (TP) driver in Huawei NEM phones with software Versions before NEM-AL10C00B130, Versions before NEM-UL10C17B160, Versions before NEM-UL10C00B160, Versions before NEM-TL00C01B160 allows attackers to get root privilege or crash the system or execute arbitrary code, related to a buffer overflow. Huawei Play 5C is Huawei's smartphone. There is a buffer overflow vulnerability in Huawei's 5C mobile phone TP touch screen driver. Huawei NEM is prone to a local buffer-overflow vulnerability. Local attackers can exploit this issue to run arbitrary code, elevate root privilege or crash the system causing a denial of service condition. The following versions are vulnerable: Huawei NEM versions prior to AL10C00B130 are affected. Huawei NEM versions prior to UL10C17B160 are affected. Huawei NEM versions prior to UL10C00B160 are affected. Huawei NEM versions prior to TL00C01B160 are affected. Huawei NEM versions prior to TL00HC00B160 are affected. Huawei NEM is a smartphone product of China's Huawei (Huawei)

The maintenance module in Huawei FusionStorage V100R003C30U1 allows attackers to create documents according to special rules to obtain the OS root privilege of FusionStorage. Huawei FusionStorage is prone to a local privilege-escalation vulnerability. Local attackers may exploit this issue to gain elevated privileges. Huawei FusionStorage is a set of distributed block storage software specially designed for the storage infrastructure of cloud computing data centers by Huawei in China. There is a privilege escalation vulnerability in Huawei FusionStorage

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible. The Apache Software Foundation From Apache Tomcat Updates for the following multiple vulnerabilities have been released: * * HTTP Response falsification (CVE-2016-6816) * * Service operation interruption (DoS) (CVE-2016-6817) * * Arbitrary code execution (CVE-2016-8735)Expected impact varies depending on each vulnerability, but information leakage, service operation interruption (DoS) May be affected by arbitrary code execution. Apache Tomcat is prone to a denial-of-service vulnerability. Attackers may leverage this issue to cause denial-of-service conditions. The following versions are affected: Apache Tomcat 9.0.0.M1 through 9.0.0.M11 Apache Tomcat 8.5.0 through 8.5.6

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own. The Apache Software Foundation From Apache Tomcat Updates for the following multiple vulnerabilities have been released: * * HTTP Response falsification (CVE-2016-6816) * * Service operation interruption (DoS) (CVE-2016-6817) * * Arbitrary code execution (CVE-2016-8735)Expected impact varies depending on each vulnerability, but information leakage, service operation interruption (DoS) May be affected by arbitrary code execution. Apache Tomcat is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks. Apache Tomcat 9.0.0.M1 through 9.0.0.M11, 8.5.0 through 8.5.6, 8.0.0.RC1 through 8.0.38, 7.0.0 through 7.0.72 and 6.0.0 through 6.0.47 are vulnerable. 6) - noarch 3. Description: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. The newly introduced system property tomcat.util.http.parser.HttpParser.requestTargetAllow can be used to configure Tomcat to accept curly braces ({ and }) and the pipe symbol (|) in not encoded form, as these are often used in URLs without being properly encoded. (CVE-2016-8745) 4. Note: the current version of the following document is available here: https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03302206 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: KM03302206 Version: 1 MFSBGN03837 rev.1 - Network Node Manager i, Multiple Vulnerabilities NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2018-12-12 Last Updated: 2018-12-12 Potential Security Impact: Remote: Cross-Site Scripting (XSS), Disclosure of Information Source: Micro Focus, Product Security Response Team VULNERABILITY SUMMARY A vulnerabilities in Apache Tomcat was addressed by Micro Focus Network Node Manager i. The vulnerability could be exploited Remote Cross-Site Scripting (XSS) and Remote Disclosure of Information References: - PSRT110650 - CVE-2016-6816 - CVE-2017-5664 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HPE Network Node Manager I (NNMi) Software 9.2x, 10.0x, 10.00 Patch 1, 10.00 Patch 2, 10.00 Patch 3, 10.00 Patch 4, 10.00 Patch 5, 10.1x, 10.10 Patch 1, 10.10 Patch 2, 10.10 Patch 3, 10.10 Patch 4, 10.2x, 10.20 Patch 1, 10.20 Patch 2, 10.20 Patch 3, 10.30, 10.30 Patch 1 BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector RESOLUTION Micro Focus has made the following software updates and mitigation information to resolve the vulnerability in Micro Focus Network Node Manager i: Customers using v9.X must upgrade to v10.x and then install the patch below. Patches are available to address the vulnerabilities: For v10.0x: Network Node Manager i 10.00 Patch 8 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139745](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139745) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139763](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139763) For v10.1x: Network Node Manager i 10.10 Patch 7 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139729](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139729) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139781](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139781) For v10.2x: Network Node Manager i 10.20 Patch 6 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139701](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139701) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139715](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139715) For v10.3x: Network Node Manager i 10.30 Patch 2 Linux [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139685](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139685) Windows [https://softwaresupport.softwaregrp.com/group/softwaresupport/search-result/ /facetsearch/document/KM03139693](https://softwaresupport.softwaregrp.com/gro p/softwaresupport/search-result/-/facetsearch/document/KM03139693) HISTORY Version:1 (rev.1) - 12 December 2018 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Micro Focus products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal Micro Focus services support channel. For other issues about the content of this Security Bulletin, send e-mail to security@microfocus.com. Report: To report a potential security vulnerability for any supported product: Web form: https://softwaresupport.softwaregrp.com/psrt Email: security@microfocus.com Subscribe: To initiate receiving subscriptions for future Micro Focus Security Bulletin alerts via Email, please subscribe here - https://softwaresupport.softwaregrp.com/group/softwaresupport/email-notification/-/subscriptions/registerdocumentnotification Once you are logged in to the portal, please choose security bulletins under product and document types. Please note that you will need to sign in using a Passport account. If you do not have a Passport account yet, you can create one- its free and easy https://cf.passport.softwaregrp.com/hppcf/createuser.do Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://softwaresupport.softwaregrp.com/security-vulnerability Software Product Category: The Software Product Category is represented in the title by the two characters following Micro Focus Security Bulletin. 3P = 3rd Party Software GN = Micro Focus General Software MU = Multi-Platform Software System management and security procedures must be reviewed frequently to maintain system integrity. Micro Focus is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. "Micro Focus is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected Micro Focus products the important security information contained in this Bulletin. Micro Focus recommends that all users determine the applicability of this information to their individual situations and take appropriate action. Micro Focus does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, Micro Focus will not be responsible for any damages resulting from user's use or disregard of the information provided in this Security Bulletin. To the extent permitted by law, Micro Focus disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement." Copyright Micro Focus Micro Focus shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither Micro Focus nor its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Micro Focus and the names of Micro Focus products referenced herein are trademarks of Micro Focus in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. ========================================================================= Ubuntu Security Notice USN-4557-1 September 30, 2020 tomcat6 vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 LTS Summary: Several security issues were fixed in Tomcat. Software Description: - tomcat6: Servlet and JSP engine Details: It was discovered that the Tomcat realm implementations incorrectly handled passwords when a username didn't exist. A remote attacker could possibly use this issue to enumerate usernames. (CVE-2016-5018) It was discovered that Tomcat incorrectly controlled reading system properties. (CVE-2016-6816) Pierre Ernst discovered that the Tomcat JmxRemoteLifecycleListener did not implement a recommended fix. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2016-8735) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 LTS: libservlet2.5-java 6.0.45+dfsg-1ubuntu0.1 In general, a standard system update will make all the necessary changes. (CVE-2016-6816) * An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired. (CVE-2016-8627) * It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information. The References section of this erratum contains a download link (you must log in to download the update). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Web Server 3.1.0 security and enhancement update Advisory ID: RHSA-2017:0456-01 Product: Red Hat JBoss Web Server Advisory URL: https://access.redhat.com/errata/RHSA-2017:0456 Issue date: 2015-11-12 Updated on: 2017-03-07 CVE Names: CVE-2016-0762 CVE-2016-1240 CVE-2016-3092 CVE-2016-5018 CVE-2016-6325 CVE-2016-6794 CVE-2016-6796 CVE-2016-6797 CVE-2016-6816 CVE-2016-8735 CVE-2016-8745 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss Web Server 3 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Web Server 3.1 for RHEL 7 - noarch, ppc64, x86_64 3. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. This release of Red Hat JBoss Web Server 3.1.0 serves as a replacement for Red Hat JBoss Web Server 3.0.3, and includes enhancements. Security Fix(es): * It was reported that the Tomcat init script performed unsafe file handling, which could result in local privilege escalation. (CVE-2016-1240) * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325) * The JmxRemoteLifecycleListener was not updated to take account of Oracle's fix for CVE-2016-3427. JMXRemoteLifecycleListener is only included in EWS 2.x and JWS 3.x source distributions. If you deploy a Tomcat instance built from source, using the EWS 2.x, or JWS 3.x distributions, an attacker could use this flaw to launch a remote code execution attack on your deployed instance. (CVE-2016-8735) * A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-6816) * A bug was discovered in the error handling of the send file code for the NIO HTTP connector. This led to the current Processor object being added to the Processor cache multiple times allowing information leakage between requests including, and not limited to, session ID and the response body. (CVE-2016-8745) * The Realm implementations did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder. (CVE-2016-0762) * It was discovered that a malicious web application could bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications. (CVE-2016-5018) * It was discovered that when a SecurityManager is configured Tomcat's system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible. (CVE-2016-6794) * It was discovered that a malicious web application could bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. (CVE-2016-6796) * It was discovered that it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not. (CVE-2016-6797) The CVE-2016-6325 issue was discovered by Red Hat Product Security. Enhancement(s): * This enhancement update adds the Red Hat JBoss Web Server 3.1.0 packages to Red Hat Enterprise Linux 7. These packages provide a number of enhancements over the previous version of Red Hat JBoss Web Server. (JIRA#JWS-268) 4. Solution: Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service 1367447 - CVE-2016-6325 tomcat: tomcat writable config files allow privilege escalation 1376712 - CVE-2016-1240 tomcat: unsafe chown of catalina.log in tomcat init script allows privilege escalation 1390493 - CVE-2016-6797 tomcat: unrestricted access to global resources 1390515 - CVE-2016-6796 tomcat: security manager bypass via JSP Servlet config parameters 1390520 - CVE-2016-6794 tomcat: system property disclosure 1390525 - CVE-2016-5018 tomcat: security manager bypass via IntrospectHelper utility function 1390526 - CVE-2016-0762 tomcat: timing attack in Realm implementation 1397484 - CVE-2016-6816 tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests 1397485 - CVE-2016-8735 tomcat: Remote code execution vulnerability in JmxRemoteLifecycleListener 1403824 - CVE-2016-8745 tomcat: information disclosure due to incorrect Processor sharing 6. JIRA issues fixed (https://issues.jboss.org/): JWS-268 - RHEL 7 Errata JIRA 7. Package List: Red Hat JBoss Web Server 3.1 for RHEL 7: Source: hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.src.rpm jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el7.src.rpm jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el7.src.rpm mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el7.src.rpm tomcat-native-1.2.8-9.redhat_9.ep7.el7.src.rpm tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el7.src.rpm tomcat7-7.0.70-16.ep7.el7.src.rpm tomcat8-8.0.36-17.ep7.el7.src.rpm noarch: hibernate4-c3p0-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.noarch.rpm hibernate4-core-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.noarch.rpm hibernate4-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.noarch.rpm hibernate4-entitymanager-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.noarch.rpm hibernate4-envers-eap6-4.2.23-1.Final_redhat_1.1.ep6.el7.noarch.rpm jbcs-httpd24-apache-commons-daemon-1.0.15-1.redhat_2.1.jbcs.el7.noarch.rpm jbcs-httpd24-runtime-1-3.jbcs.el7.noarch.rpm mod_cluster-1.3.5-2.Final_redhat_2.1.ep7.el7.noarch.rpm mod_cluster-tomcat7-1.3.5-2.Final_redhat_2.1.ep7.el7.noarch.rpm mod_cluster-tomcat8-1.3.5-2.Final_redhat_2.1.ep7.el7.noarch.rpm tomcat-vault-1.0.8-9.Final_redhat_2.1.ep7.el7.noarch.rpm tomcat7-7.0.70-16.ep7.el7.noarch.rpm tomcat7-admin-webapps-7.0.70-16.ep7.el7.noarch.rpm tomcat7-docs-webapp-7.0.70-16.ep7.el7.noarch.rpm tomcat7-el-2.2-api-7.0.70-16.ep7.el7.noarch.rpm tomcat7-javadoc-7.0.70-16.ep7.el7.noarch.rpm tomcat7-jsp-2.2-api-7.0.70-16.ep7.el7.noarch.rpm tomcat7-jsvc-7.0.70-16.ep7.el7.noarch.rpm tomcat7-lib-7.0.70-16.ep7.el7.noarch.rpm tomcat7-log4j-7.0.70-16.ep7.el7.noarch.rpm tomcat7-selinux-7.0.70-16.ep7.el7.noarch.rpm tomcat7-servlet-3.0-api-7.0.70-16.ep7.el7.noarch.rpm tomcat7-webapps-7.0.70-16.ep7.el7.noarch.rpm tomcat8-8.0.36-17.ep7.el7.noarch.rpm tomcat8-admin-webapps-8.0.36-17.ep7.el7.noarch.rpm tomcat8-docs-webapp-8.0.36-17.ep7.el7.noarch.rpm tomcat8-el-2.2-api-8.0.36-17.ep7.el7.noarch.rpm tomcat8-javadoc-8.0.36-17.ep7.el7.noarch.rpm tomcat8-jsp-2.3-api-8.0.36-17.ep7.el7.noarch.rpm tomcat8-jsvc-8.0.36-17.ep7.el7.noarch.rpm tomcat8-lib-8.0.36-17.ep7.el7.noarch.rpm tomcat8-log4j-8.0.36-17.ep7.el7.noarch.rpm tomcat8-selinux-8.0.36-17.ep7.el7.noarch.rpm tomcat8-servlet-3.1-api-8.0.36-17.ep7.el7.noarch.rpm tomcat8-webapps-8.0.36-17.ep7.el7.noarch.rpm ppc64: jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el7.ppc64.rpm jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el7.ppc64.rpm x86_64: jbcs-httpd24-apache-commons-daemon-jsvc-1.0.15-17.redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.0.15-17.redhat_2.jbcs.el7.x86_64.rpm tomcat-native-1.2.8-9.redhat_9.ep7.el7.x86_64.rpm tomcat-native-debuginfo-1.2.8-9.redhat_9.ep7.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2016-0762 https://access.redhat.com/security/cve/CVE-2016-1240 https://access.redhat.com/security/cve/CVE-2016-3092 https://access.redhat.com/security/cve/CVE-2016-5018 https://access.redhat.com/security/cve/CVE-2016-6325 https://access.redhat.com/security/cve/CVE-2016-6794 https://access.redhat.com/security/cve/CVE-2016-6796 https://access.redhat.com/security/cve/CVE-2016-6797 https://access.redhat.com/security/cve/CVE-2016-6816 https://access.redhat.com/security/cve/CVE-2016-8735 https://access.redhat.com/security/cve/CVE-2016-8745 https://access.redhat.com/security/updates/classification/#important 9. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFYvwx1XlSAg2UNWIIRAlcaAJ9BAGykX/bGrxjm/OJ4KkTD2Jol4QCfaFhA I1dYmPbbHiEL1qBik1MSZME= =IQj5 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Long lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could violate a security policy during IPS signature updates when the FortiGate's IPSengine is configured in flow mode. All FortiGate versions with IPS configured in proxy mode (the default mode) are not affected. FortiOS Contains vulnerabilities related to security features.Information may be tampered with. FortiGate FortiOS is prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks. Fortinet FortiOS is a set of security operating systems developed by Fortinet Corporation for the FortiGate network security platform. The system provides users with various security functions such as firewall, anti-virus, IPSec/SSL VPN, Web content filtering and anti-spam. Fortinet has a security vulnerability in FortiOS versions 5.2.x prior to 5.2.10 GA and Long lived sessions in versions 5.4.x prior to 5.4.2 GA

The implementation of an ANSI X9.31 RNG in Fortinet FortiGate allows attackers to gain unauthorized read access to data handled by the device via IPSec/TLS decryption. Fortinet FortiOS is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in further attacks. Fortinet FortiOS 4.3.0 through 4.3.18 are vulnerable. Fortinet FortiWLC is a wireless controller produced by Fortinet. A security vulnerability exists in the ANSI X9.31 RNG implementation in Fortinet FortiWLC

A vulnerability has been identified in SIMATIC CP 343-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.0.53), SIMATIC CP 443-1 Advanced (incl. SIPLUS NET variant) (All versions < V3.2.17), SIMATIC S7-300 PN/DP CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP CPU family (incl. SIPLUS variants) (All versions). The integrated web server at port 80/TCP or port 443/TCP of the affected devices could allow remote attackers to perform actions with the permissions of an authenticated user, provided the targeted user has an active session and is induced to trigger the malicious request. plural Siemens SIMATIC Product integration Web The server contains a cross-site request forgery vulnerability.A remote attacker could hijack an arbitrary user's authentication. SiemensSIMATICCP343-1Advanceddevices is an Ethernet communication module from Siemens AG to support PROFINET, the next generation of industrial bus technology-based automation bus standard. A cross-site request forgery vulnerability exists in SiemensSIMATICCP343-1Advanceddevices. A successful exploit may allow an attacker to obtain sensitive information, and perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible. The vulnerability stems from the WEB application not adequately verifying that the request is from a trusted user. An attacker could exploit this vulnerability to send unexpected requests to the server through an affected client

Huawei is a Chinese provider of information and communication solutions. The HuaweiFlybox B660Router is a router device of Huawei. HuaweiFlyboxB660Router has a bypass validation vulnerability. Due to a vulnerability in the local path \"./htmlcode/html/\" module and \"indexdefault.asp\" file, an unauthenticated remote attacker exploited the vulnerability to log in to the management background of the Huawei Flybox B660 router.

siemens 840D is a numerical control system of Siemens, which has a wide range of application environments, including: packaging printing industry, such as: food packaging wheel cutting positioning, plastic rubber industry, such as: plastic tableware production line, white goods industry, can be used in fixed power production lines, CNC machine tool industry, suitable for small lathes, milling machines, etc. siemens 840D has a buffer overflow vulnerability. Allowing an attacker to exploit the vulnerability and obtain system administrator permissions, they can perform arbitrary operations on the host computer, such as shutting down, operating configuration software, obtaining configuration software files, and sending arbitrary instructions to the controller

Shanghai Guangsheng Information Technology Co., Ltd. is a leading global provider of terminal management cloud platforms. FOTA (Wireless Upgrade) provides professional wireless upgrade solutions for IoT devices (smart cars, wearables, homes, VR, etc.). A number of mtk platform mobile phone Guangsheng FOTA services have system privilege elevation vulnerabilities. Because the mobile phone using the Guangsheng FOTA service has a vulnerability in the system app of a certain binding service, it is possible to execute commands with system permissions. An attacker could exploit the vulnerability to elevate permissions to system permissions.

40NOE77101 is an Ethernet communication module for Schneider's Quantum series PLC. The Schneider 140NOE77101 Ethernet module's TCP / IP protocol stack has a Land attack vulnerability. As the program sends a TCP SYN packet with the same source and destination IP (both the IP address of the 140NOE7710 module) to the 140NOE7710 module at a rate greater than 15kpps, the attacker can use The vulnerability can cause the module protocol stack to crash and the system to become unresponsive. The module needs to be powered off and restarted to return to normal