VARIoT IoT vulnerabilities database
| VAR-201607-0235 | CVE-2016-5131 | Proxy auto-config (PAC) files have access to full HTTPS URLs |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function. Web proxy auto-config (PAC) files are passed the full HTTPS URL in GET requests which may expose sensitive data. Supplementary information : CWE Vulnerability type by CWE-416: Use After Free ( Use of freed memory ) Has been identified. Google Chrome is prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code in the context of the browser, bypass security restriction and perform unauthorized actions, cause denial-of-service conditions, retrieve sensitive information; other attacks may also be possible.
Versions prior to Chrome 52.0.2743.82 are vulnerable.
Note: The issue described by CVE-2016-1706 has been moved to BID 92263 (Google Chrome CVE-2016-1706 Sandbox Security Bypass Vulnerability) for better documentation. Google Chrome is a web browser developed by Google (Google).
CVE-2016-1704
The chrome development team found and fixed various issues during
internal auditing.
CVE-2016-1705
The chrome development team found and fixed various issues during
internal auditing.
CVE-2016-1706
Pinkie Pie discovered a way to escape the Pepper Plugin API sandbox.
CVE-2016-1709
ChenQin a buffer overflow issue in the sfntly library.
CVE-2016-5128
A same-origin bypass issue was discovered in the v8 javascript library.
CVE-2016-5132
Ben Kelly discovered a same-origin bypass.
CVE-2016-5137
Xiaoyin Liu discovered a way to discover whether an HSTS web side had been
visited.
For the stable distribution (jessie), these problems have been fixed in
version 52.0.2743.82-1~deb8u1.
For the testing (stretch) and unstable (sid) distributions, these problems
have been fixed in version 52.0.2743.82-1.
We recommend that you upgrade your chromium-browser packages.
Background
==========
libxml2 is the XML (eXtended Markup Language) C parser and toolkit
initially developed for the Gnome project.
=========================================================================
Ubuntu Security Notice USN-3041-1
August 05, 2016
oxide-qt vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
Summary:
Several security issues were fixed in Oxide.
Software Description:
- oxide-qt: Web browser engine for Qt (QML plugin)
Details:
Multiple security issues were discovered in Chromium. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to read uninitialized memory, cause a denial
of service (application crash) or execute arbitrary code. (CVE-2016-1705)
It was discovered that the PPAPI implementation does not validate the
origin of IPC messages to the plugin broker process. A remote attacker
could potentially exploit this to bypass sandbox protection mechanisms.
(CVE-2016-1706)
It was discovered that Blink does not prevent window creation by a
deferred frame. A remote attacker could potentially exploit this to bypas
s
same origin restrictions. (CVE-2016-1710)
It was discovered that Blink does not disable frame navigation during a
detach operation on a DocumentLoader object. A remote attacker could
potentially exploit this to bypass same origin restrictions.
(CVE-2016-1711)
A use-after-free was discovered in Blink. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploi
t
this to cause a denial of service via renderer process crash, or execute
arbitrary code. (CVE-2016-5127)
It was discovered that objects.cc in V8 does not prevent API interceptors
from modifying a store target without setting a property. A remote
attacker could potentially exploit this to bypass same origin
restrictions. (CVE-2016-5128)
A memory corruption was discovered in V8. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploi
t
this to cause a denial of service via renderer process crash, or execute
arbitrary code. (CVE-2016-5129)
A security issue was discovered in Chromium. A remote attacker could
potentially exploit this to spoof the currently displayed URL.
(CVE-2016-5130)
A use-after-free was discovered in libxml. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploi
t
this to cause a denial of service via renderer process crash, or execute
arbitrary code. (CVE-2016-5131)
The Service Workers implementation in Chromium does not properly implemen
t
the Secure Contexts specification during decisions about whether to
control a subframe. A remote attacker could potentially exploit this to
bypass same origin restrictions. (CVE-2016-5132)
It was discovered that Chromium mishandles origin information during prox
y
authentication. A man-in-the-middle attacker could potentially exploit th
is
to spoof a proxy authentication login prompt. (CVE-2016-5133)
It was discovered that the Proxy Auto-Config (PAC) feature in Chromium
does not ensure that URL information is restricted to a scheme, host and
port. A remote attacker could potentially exploit this to obtain sensitiv
e
information. (CVE-2016-5134)
It was discovered that Blink does not consider referrer-policy informatio
n
inside an HTML document during a preload request. A remote attacker could
potentially exploit this to bypass Content Security Policy (CSP)
protections. (CVE-2016-5135)
It was discovered that the Content Security Policy (CSP) implementation i
n
Blink does not apply http :80 policies to https :443 URLs. A remote
attacker could potentially exploit this to determine whether a specific
HSTS web site has been visited by reading a CSP report. (CVE-2016-5137)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
liboxideqtcore0 1.16.5-0ubuntu0.16.04.1
Ubuntu 14.04 LTS:
liboxideqtcore0 1.16.5-0ubuntu0.14.04.1
In general, a standard system update will make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: libxml2 security update
Advisory ID: RHSA-2020:1190-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1190
Issue date: 2020-03-31
CVE Names: CVE-2015-8035 CVE-2016-5131 CVE-2017-15412
CVE-2017-18258 CVE-2018-14404 CVE-2018-14567
====================================================================
1. Summary:
An update for libxml2 is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
3. Description:
The libxml2 library is a development toolbox providing the implementation
of various XML standards.
Security Fix(es):
* libxml2: Use after free triggered by XPointer paths beginning with
range-to (CVE-2016-5131)
* libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate()
function in xpath.c (CVE-2017-15412)
* libxml2: DoS caused by incorrect error detection during XZ decompression
(CVE-2015-8035)
* libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in
xpath.c (CVE-2018-14404)
* libxml2: Unrestricted memory usage in xz_head() function in xzlib.c
(CVE-2017-18258)
* libxml2: Infinite loop caused by incorrect error detection during LZMA
decompression (CVE-2018-14567)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.8 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
The desktop must be restarted (log out, then log back in) for this update
to take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1277146 - CVE-2015-8035 libxml2: DoS caused by incorrect error detection during XZ decompression
1358641 - CVE-2016-5131 libxml2: Use after free triggered by XPointer paths beginning with range-to
1523128 - CVE-2017-15412 libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c
1566749 - CVE-2017-18258 libxml2: Unrestricted memory usage in xz_head() function in xzlib.c
1595985 - CVE-2018-14404 libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c
1619875 - CVE-2018-14567 libxml2: Infinite loop caused by incorrect error detection during LZMA decompression
6. Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
libxml2-2.9.1-6.el7.4.src.rpm
x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
libxml2-2.9.1-6.el7.4.src.rpm
x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
libxml2-2.9.1-6.el7.4.src.rpm
ppc64:
libxml2-2.9.1-6.el7.4.ppc.rpm
libxml2-2.9.1-6.el7.4.ppc64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc64.rpm
libxml2-devel-2.9.1-6.el7.4.ppc.rpm
libxml2-devel-2.9.1-6.el7.4.ppc64.rpm
libxml2-python-2.9.1-6.el7.4.ppc64.rpm
ppc64le:
libxml2-2.9.1-6.el7.4.ppc64le.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc64le.rpm
libxml2-devel-2.9.1-6.el7.4.ppc64le.rpm
libxml2-python-2.9.1-6.el7.4.ppc64le.rpm
s390x:
libxml2-2.9.1-6.el7.4.s390.rpm
libxml2-2.9.1-6.el7.4.s390x.rpm
libxml2-debuginfo-2.9.1-6.el7.4.s390.rpm
libxml2-debuginfo-2.9.1-6.el7.4.s390x.rpm
libxml2-devel-2.9.1-6.el7.4.s390.rpm
libxml2-devel-2.9.1-6.el7.4.s390x.rpm
libxml2-python-2.9.1-6.el7.4.s390x.rpm
x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64:
libxml2-debuginfo-2.9.1-6.el7.4.ppc.rpm
libxml2-debuginfo-2.9.1-6.el7.4.ppc64.rpm
libxml2-static-2.9.1-6.el7.4.ppc.rpm
libxml2-static-2.9.1-6.el7.4.ppc64.rpm
ppc64le:
libxml2-debuginfo-2.9.1-6.el7.4.ppc64le.rpm
libxml2-static-2.9.1-6.el7.4.ppc64le.rpm
s390x:
libxml2-debuginfo-2.9.1-6.el7.4.s390.rpm
libxml2-debuginfo-2.9.1-6.el7.4.s390x.rpm
libxml2-static-2.9.1-6.el7.4.s390.rpm
libxml2-static-2.9.1-6.el7.4.s390x.rpm
x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
libxml2-2.9.1-6.el7.4.src.rpm
x86_64:
libxml2-2.9.1-6.el7.4.i686.rpm
libxml2-2.9.1-6.el7.4.x86_64.rpm
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-devel-2.9.1-6.el7.4.i686.rpm
libxml2-devel-2.9.1-6.el7.4.x86_64.rpm
libxml2-python-2.9.1-6.el7.4.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64:
libxml2-debuginfo-2.9.1-6.el7.4.i686.rpm
libxml2-debuginfo-2.9.1-6.el7.4.x86_64.rpm
libxml2-static-2.9.1-6.el7.4.i686.rpm
libxml2-static-2.9.1-6.el7.4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2015-8035
https://access.redhat.com/security/cve/CVE-2016-5131
https://access.redhat.com/security/cve/CVE-2017-15412
https://access.redhat.com/security/cve/CVE-2017-18258
https://access.redhat.com/security/cve/CVE-2018-14404
https://access.redhat.com/security/cve/CVE-2018-14567
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXoOdR9zjgjWX9erEAQhgbQ/+JolcknqNffv7HQZNxYOtS/M2Zx/E3IB4
QwmkXhfmgV44ig4prUpghE/+O5eTUPjqSq6rHjih/pjCjG4bVcK6BptxBFi7WQwo
GM0ryvm0p0fib0dy+Ov3NNC6Dhg32NIVwC0pWTIEdYcOGBfDY3mXlLXx5aHefisu
p1C7F6rP4xxMRDOlQhAB4UPMkPSD/MtKIyxIEqiAT5olybSTl0um2AB5XtLlCbkT
h4IXDsAyswvBIS/bxnyZkn6oHEiD3JBwcP+ZU0jgSEy34O92ttV7hRQb1H1+YHOO
li1bX5IcbmFzATwBfCZQmNfrp/XU4Ra28GT/3JGntnhhxFmz1xe/h5YNJTwZ+0TX
yxKZdAz3brm/mt6uvbY4PpGERyA+X/Moz4ToXCEL2jVfSXbOuajRtCV8Cp3X7bCd
Ed2imuXZQPpUXNVdF73RJ7YB6vEhQRIdlKgEXzPPpuHFH1HprvSLoJyrDD1T8bfx
TVrrmvtWKtXq0DYSD7wGw23WZJJeUIgyKiZNTlIxvb0c7r8+aZ+toY07sZlBkTCA
cjWNRnHDNkdYH2ZoNPQlzYzk5rSYGqhoOvF85pNCY4v4fofyMEnyAY7MEZ/Z991X
Ko2ShKSzEtKSMcx2B2wPg+hFcACP8HbKxSbW3SzoCSKCOGEAPLQlJ5eHXwLOAO3Q
IZIK7xZywNw=8RZh
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
. (CVE-2016-4448)
It was discovered that libxml2 incorrectly handled certain malformed
documents. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201610-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Chromium: Multiple vulnerabilities
Date: October 29, 2016
Bugs: #589278, #590420, #592630, #593708, #595614, #597016
ID: 201610-09
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in the Chromium web browser,
the worst of which allows remote attackers to execute arbitrary code.
Background
==========
Chromium is an open-source browser project that aims to build a safer,
faster, and more stable way for all users to experience the web. Please review the CVE identifiers referenced below for
details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Chromium users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-client/chromium-54.0.2840.59"
References
==========
[ 1 ] CVE-2016-5127
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5127
[ 2 ] CVE-2016-5128
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5128
[ 3 ] CVE-2016-5129
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5129
[ 4 ] CVE-2016-5130
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5130
[ 5 ] CVE-2016-5131
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5131
[ 6 ] CVE-2016-5132
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5132
[ 7 ] CVE-2016-5133
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5133
[ 8 ] CVE-2016-5134
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5134
[ 9 ] CVE-2016-5135
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5135
[ 10 ] CVE-2016-5136
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5136
[ 11 ] CVE-2016-5137
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5137
[ 12 ] CVE-2016-5138
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5138
[ 13 ] CVE-2016-5139
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5139
[ 14 ] CVE-2016-5140
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5140
[ 15 ] CVE-2016-5141
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5141
[ 16 ] CVE-2016-5142
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5142
[ 17 ] CVE-2016-5143
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5143
[ 18 ] CVE-2016-5144
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5144
[ 19 ] CVE-2016-5145
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5145
[ 20 ] CVE-2016-5146
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5146
[ 21 ] CVE-2016-5147
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5147
[ 22 ] CVE-2016-5148
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5148
[ 23 ] CVE-2016-5149
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5149
[ 24 ] CVE-2016-5150
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5150
[ 25 ] CVE-2016-5151
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5151
[ 26 ] CVE-2016-5152
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5152
[ 27 ] CVE-2016-5153
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5153
[ 28 ] CVE-2016-5154
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5154
[ 29 ] CVE-2016-5155
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5155
[ 30 ] CVE-2016-5156
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5156
[ 31 ] CVE-2016-5157
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5157
[ 32 ] CVE-2016-5158
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5158
[ 33 ] CVE-2016-5159
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5159
[ 34 ] CVE-2016-5160
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5160
[ 35 ] CVE-2016-5161
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5161
[ 36 ] CVE-2016-5162
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5162
[ 37 ] CVE-2016-5163
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5163
[ 38 ] CVE-2016-5164
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5164
[ 39 ] CVE-2016-5165
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5165
[ 40 ] CVE-2016-5166
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5166
[ 41 ] CVE-2016-5167
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5167
[ 42 ] CVE-2016-5170
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5170
[ 43 ] CVE-2016-5171
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5171
[ 44 ] CVE-2016-5172
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5172
[ 45 ] CVE-2016-5173
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5173
[ 46 ] CVE-2016-5174
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5174
[ 47 ] CVE-2016-5175
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5175
[ 48 ] CVE-2016-5177
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5177
[ 49 ] CVE-2016-5178
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5178
[ 50 ] CVE-2016-5181
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5181
[ 51 ] CVE-2016-5182
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5182
[ 52 ] CVE-2016-5183
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5183
[ 53 ] CVE-2016-5184
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5184
[ 54 ] CVE-2016-5185
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5185
[ 55 ] CVE-2016-5186
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5186
[ 56 ] CVE-2016-5187
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5187
[ 57 ] CVE-2016-5188
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5188
[ 58 ] CVE-2016-5189
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5189
[ 59 ] CVE-2016-5190
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5190
[ 60 ] CVE-2016-5191
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5191
[ 61 ] CVE-2016-5192
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5192
[ 62 ] CVE-2016-5193
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5193
[ 63 ] CVE-2016-5194
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5194
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201610-09
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2016 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
| VAR-201607-0243 | CVE-2016-5080 | Objective Systems ASN1C generates code that contains a heap overflow vulnerability |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
Integer overflow in the rtxMemHeapAlloc function in asn1rt_a.lib in Objective Systems ASN1C for C/C++ before 7.0.2 allows context-dependent attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow), on a system running an application compiled by ASN1C, via crafted ASN.1 data. ASN.1 Is a standard data structure notation for network and communication applications. Heap-based buffer overflow (CWE-122) - CVE-2016-5080 ASN1C Is ASN.1 Used to generate high-level language source code from the syntax. According to the reporter, ASN1C Generated by C Or C++ The source code of the heap manager rtxMemHeapAlloc A heap-based buffer overflow vulnerability exists in the function. 2016 Year 7 Moon 20 As of today, similar vulnerabilities Java And C# It is unknown whether it exists in the source code output by. rtxMemHeapAlloc It depends on whether you are using a function. Specifically, it was received from an unreliable communication partner ASN.1 Processing your data may be affected by this vulnerability. For development of in-house products ASN1C Developers using are required to verify the source code to see if their products contain this vulnerability. The reporter has published further information as a security advisory. In the most serious case, received from an unreliable partner ASN.1 By processing the data, the authority of the application by a remote third party (root Or SYSTEM Authority etc. ) May execute arbitrary code. Failed exploit attempts will likely result in denial-of-service conditions. FundaciA3n Dr. ASN1C compiler for C/C++
1. ASN1C compiler for C/C++
Advisory ID: STIC-2016-0603
Advisory URL: http://www.fundacionsadosky.org.ar/publicaciones-2
Date published: 2016-07-18
Date of last update: 2016-07-19
Vendors contacted: Objective Systems Inc.
Release mode: Coordinated release
2. *Vulnerability Description*
Abstract Syntax Notation One (ASN.1) is a technical standard and formal
notation that describes rules and structures for representing, encoding,
transmitting, and decoding data in telecommunications and computer
networking[1]. It is a joint standard of the International Organization
for Standardization (ISO), International Electrotechnical Commission
(IEC), and International Telecommunication Union Telecommunication
Standardization Sector ITU-T[2] used in technical standards for wireless
communications such as GSM, UMTS and LTE, Lawful Interception,
Intelligent Transportation Systems, signalling in fixed and mobile
telecommunications networks (SS7), wireless broadband access (WiMAX),
data security (X.509), network management (SNMP), voice over IP and
IP-based videoconferencing (H.323), manufacturing, aviation, aerospace
and several other areas[3].
Software components that generate, transmit and parse ASN.1 encoded data
constitute a critical building block of software that runs on billions
of mobile devices, telecommunication switching equipment and systems for
operation and management of critical infrastructures. The ASN.1
specification is sufficiently complicated to make writing programs that
parse ASN.1 encoded data a perilious and error-prone activity. Many
technology vendors have adopted the practice of using computer-generated
programs to parse ASN.1 encoded data. This is accomplished by using an
ASN.1 compiler, a software tool that given as input a data specification
written in ASN.1 generates as output the source code of a program that
can be used to encode and decode in compliance with the specification.
The output of an ASN.1 compiler is generally incorporated as a building
block in a software system that transmits or processes ASN.1 encoded data. is a US-based private company[5] that develops
and commercializes ASN1C, a ASN1 compiler for various programming
languages, to vendors in the telecommunications, data networking,
aviation, aerospace, defense and law enforcement sectors[6].
The vulnerability could be triggered remotely without any authentication
in scenarios where the vulnerable code receives and processes ASN.1
encoded data from untrusted sources, these may include communications
between mobile devices and telecommunication network infrastructure
nodes, communications between nodes in a carrier's network or across
carrier boundaries, or communication between mutually untrusted
endpoints in a data network. has addressed the issue and built a fixed interim
version of the ASN1C for C/C++ compiler that is a available to customers
upon request. The fixes will be incorporated in the next (v7.0.2)
release of ASN1C for C/C++.
For further information about vulnerable vendors and available fixes
refer to the CERT/CC vulnerability note [4].
4. ASN1C compiler for C/C++ version 7.0 or below. Refer to the
CERT/CC vulnerability note[4] for a list of potentially affected vendors.
5. *Vendor Information, Solutions and Workarounds*
Vendor fixed the issue in an interim release of the ASN1C v7.0.1
compiler available to customers upon request[5]. The upcoming ASN1C
v7.0.2 release will incorporate the fixes.
6. *Credits*
This vulnerability was discovered and researched by Lucas Molas. The
publication of this advisory was coordinated by Programa Seguridad en TIC.
7. *Technical Description*
This document details a bug found in the latest release of Objective
Systems Inc,. ASN1C compiler for C/C++ (v7.0.0), particularly in the
'rtxMemHeapAlloc' function contained in the pre-compiled 'asn1rt_a.lib'
library, where two integer overflows have been detected, which could
lead to corruption of heap memory in an attacker-controlled scenario.
The component analyzed was the "evaluation package of ASN1C" (v7.0.0)
for Windows (x86) MSVC 32-bit, but the analysis also applies to other
platforms. The analysis was performed with the IDA (v6.9) disassembler,
from which the assembly blocks shown below have been extracted (the
assembly syntax and location addresses may vary).
The pre-compiled library analyzed, 'asn1rt_a.lib', was extracted from
'<installdir>\c\lib\' (which corresponds to the Visual C++ 2013 version).
In 'rtxMemHeapAlloc', after initial checks to the context's internal
memory heap ('pMemHeap') which may entail calls to 'rtxMemHeapCreate'
and 'rtxMemHeapCheck', the 'nbytes' argument ('arg_4' in the
disassembly) is manipulated. Its value is rounded to the next multiple
of 8 bytes using 'ecx' and storing the result in 'var_9C'. To accomplish
this, a value of '7' is added to 'ecx' before making the shift without
checking the resulting value, which could lead to an integer overflow of
the 32-bit register if the value of 'nbytes' is '0xFFFFFFF9' or higher.
The following assembly blocks illustrate this.
/-----
loc_A6:
mov ecx, [ebp+arg_4]
add ecx, 7
shr ecx, 3
mov [ebp+var_9C], ecx
mov edx, [ebp+var_18]
mov eax, [edx+18h]
and eax, 20000000h
jnz short loc_D2
-----/
The 'rtxMemHeapAlloc' function does not perform any validation of the
'nbytes' argument and therefore it is up to the caller to make sure its
value does not overflow when the allocator rounds it up to a multiple of
8 bytes and adds 20 bytes to the memory to be allocated to accomodate a
heap control structure. However, the caller of 'rtxMemHeapAlloc' will be
a function automatically generated by the ASN1C compiler and typically
will not have any size contrains on the arguments passed to
'rtxMemHeapAlloc', and indireddctly to 'malloc', unless added manually.
The resulting value of 'var_9C' is checked against the constant '0FFFCh'
to decide whether to allocate the memory requested using the internal
heap implementation or the system's memory allocator, which is usually
available through the 'malloc' function.
A similar pattern is found later when 'malloc' is called.
If 'malloc' is used, the value in 'var_9C' is discarded in favor of the
original value of the 'nbytes' argument. This value is added to '14h' in
'ecx' before saving it to 'var_E8' without any validation which could
lead to an integer overflow if the value of argument 'nbytes' is
'0xFFFFFFEC' or greater. The resulting value in 'var_E8' is then used as
the argument for the call to 'malloc'. As a consequence, large values
passsed in the 'nbytes' argument to 'rtxMemHeapAlloc' will result in a
size calculation that wraps around and ends up calling 'malloc' with a
size argument that is less that what is needed to store the data that
will be copied to it later on. The following assembly block illustrates
this.
/-----
loc_D2:
mov ecx, [ebp+arg_4]
add ecx, 14h
mov [ebp+var_E8], ecx
mov edx, [ebp+var_E8]
push edx
mov eax, [ebp+var_18]
mov ecx, [eax+1Ch]
call ecx
add esp, 4
mov [ebp+var_24], eax
cmp [ebp+var_24], 0
jnz short loc_120
-----/
Due to the fact that the bugs are located in the core runtime support
library, it is hard to assess its exploitability in all scenarios but it
is safe to assume that it would lead attacker controlled memory
corruption of either the system's heap (if 'malloc' is called) or in the
internal memory allocator (if the number of bytes requested is below the
aforementioned threshold). Since heap control structures can be
overwritten with attacker controlled data, it is safe to assume that
remote code execution can be achieved in many scenarios in which ASN.1
parsing code generated by the ASN1C compiler for C/C++ is used without
manual modification. Manual modification of automatically generated code
is generally not recommended so mechanisms that would prevent triggering
of these bugs are not likely to be found in deployed systems.
As an illustrative example, the 3GPP APIs can be mentioned, particularly
the '[NAS/RRC add-on for ASN1C SDK]'[7]. The C code generated by the
ASN1C for the RRC decoder ('EUTRA-RRC-DefinitionsDec.c'), uses
'rtxMemHeapAlloc' for the allocation of the extension optional bits of
the extension elements) where the length, not known in advance, is
obtained from the encoded element received from an untrusted source,
calling 'pd_SmallLength' which allows unconstrained whole numbers,
resulting in a call to 'rtxMemHeapAlloc' with an externally controlled
'nbytes' argument.
/-----
/* decode extension elements */
if (extbit) {
OSOCTET* poptbits;
/* decode extension optional bits length */
stat = pd_SmallLength (pctxt, &bitcnt);
if (stat != 0) return stat;
poptbits = (OSOCTET*) rtxMemAlloc (pctxt, bitcnt);
if (0 == poptbits) return RTERR_NOMEM;
for (i_ = 0; i_ < bitcnt; i_++) {
stat = DEC_BIT (pctxt, &poptbits[i_]);
if (stat != 0) {
rtxMemFreePtr (pctxt, poptbits);
return stat;
}
}
-----/
8. *Report Timeline*
. 2016-06-03:
Sent email to Objective Systems Inc. 2016-06-06:
Vendor responded with contact information to send the bug report
in plaintext. 2016-06-06:
Bug report sent in plaintext to the email address provided by
the vendor. The report included technical details to identify and
reproduce the bug. Publication date set to July
6, 2016. 2016-06-08:
CERT/CC contacted, bug report filed in a web form, encrypted
using the CERT/CC PGP public key. 2016-06-08:
CERT/CC replied by email acknowledging report, assigned VR-198
as internal tracking number. 2016-06-08:
Email sent to CERT/CC saying that the bug is present in code
generated by the ASN1C compiler for C, it is also likely that C++ code
is also buggy and not likely in Java code but neither C++ not Java code
were tested. 2016-06-10:
Email sent to the vendor requesting acknowledgement of the
report sent on June 6 and noting that CERT/CC was contacted. 2016-06-10:
Vendor acknowledged reception of the bug report and stated that
it will look into the issue as time permits. indicated that the issues were fixed in
an interim v7.0.1.x version of ASN1C that will be available to customers
upon request and that the next v7.0.2 release will incorporate the
fixes. Offered a version of ASN1C updated with the fixes for testing. 2016-06-14:
Programa STIC replied to the vendor accepting the offer for the
pre-release version of ASN1C with the fixes and stated it is on track
for publication on July 6. 2016-06-15:
Programa STIC notified CERT/CC that the vendor has fixed the
issues and will make available an updated version of ASN1C to customers
upon request. Asked CERT/CC about plans for dissemination of the report
and whether it had contact information for ITU IMPACT. Publication is
still planned for July 6. 2016-06-16:
CERT/CC replied saying they have no contact information for ITU
IMPACT but will try to reach as many potentially affected vendors as
possible. The vulnerabilities were assigned the CVE-2016-5080
identifier. CERT/CC will likely publish a Vulnerability Note on its
website once the report becomes public. 2016-06-16:
Programa STIC said that vendors will need to assess whether
they're vulnerable and determine if they want to ask Objective Systems
for the fixed interim v7.0.1.x version or wait for the v7.0.2 release.
Programa STIC recommends the former since the v7.0.2 release may include
non-security fixed and feature and does not have a estimated release
date at the moment. 2016-06-27:
Programa STIC sent mail to CERT/CC requesting a status update
and saying its on track to publish on July 6. 2016-07-01:
CERT/CC replied saying one of the contacted vendors requested to
delay the publication for 2 months while they investigate their
products. Asked if Programa STIC would accept the request or proceed
with the current publication date. 2016-07-01:
Programa STIC replied that a two month delay seemed excessive
and that at least 2 additional factors should be weighed: 1. memory
corruption bugs in ASN.1 related components of an LTE stack have been
announced or hinted at in several infosec conference presentations over
the past few weeks and its likely the same or similar bugs will become
public soon. 2. Objective Systems has already produced a fix that is
available upon request to all its customers. It does not seem reasonable
to impose a 2 month publication delay on every other vendor. Asked
CERT/CC: 1. Did other vendors request to postpone publication or
indicated they were or were not vulnerable? 2. Did CERT/CC disseminate
the information to any other parties?
. 2016-07-01:
CERT/CC indicated they've contacted as many vendors as possible,
US-CERT and international CERT partners and that only one vendor has
requested to delay publication so far. Agreed that proceeding with the
original publication schedule is reasonable given the partial disclosure
due to dissemination that already occurred plus the fact that a fix is
available
. 2016-07-01:
Programa STIC sent mail to CERT/CC saying that for the moment it
will proceed with the original deadline but make a final decision on July 5. 2016-07-06:
Programa STIC sent email to CERT/CC indicating it decided to
postpone publication for a week to give vendors some additional time to
assess whether they are vulnerable and plan for issuing fixes. The new
publication date was set to July 13. 2016-07-06:
CERT/CC replied that it will notify vendors of the new
publication date. 2016-07-14:
Programa STIC told CERT/CC that publication was postponed to
Monday, July 18. 2016-07-13:
Programa STIC sent mail to Objective Systems Inc. asked if a CVE ID has been assigned to the
issue. 2016-07-13:
Programa STIC sent mail to Objective Systems Inc. saying
CVE-2016-5080 was assigned by CERT and promising to send draft of the
security advisory when ready for publication. 2016-07-14:
Programa STIC sent email to Objective Systems informing them that
the security advisory will bul published on July 18 with guidance for
potentially affected vendors to contact them to request a fixed version
of the ASN1C compiler for C/C++.
9. *References*
[1] Abstract Syntaxt Notation One (ASN1)
http://www.itu.int/en/ITU-T/asn1/Pages/introduction.aspx
[2] ASN.1 Project (ITU)
http://www.itu.int/en/ITU-T/asn1/Pages/asn1_project.aspx
[3] ASN.1 Applications and Standards
http://www.oss.com/asn1/resources/standards-use-asn1.html
[4] CERT/CC Vulnerability Notes
http://www.kb.cert.org/vuls
[5] Objective Systems Inc.
https://www.obj-sys.com
[6] Vendors possibly using ASN.1 compiler for C/C++.
https://www.obj-sys.com/customers/
[7] Non-Access Stratum (NAS) LTE, GERAN-RRC, and other non-ASN.1 APIs
3GPP TS 24.007 24.008 24.011 24.301 44.018.
https://www.obj-sys.com/products/asn1apis/lte_3gpp_apis.php
10. *About FundaciA3n Dr. Manuel Sadosky*
The Dr. Manuel Sadosky Foundation is a mixed (public / private)
institution whose goal is to promote stronger and closer interaction
between industry and the scientific-technological system in all aspects
related to Information and Communications Technology (ICT). The
Foundation was formally created by a Presidential Decree in 2009. Its
Chairman is the Minister of Science, Technology, and Productive
Innovation of Argentina; and the Vice-chairmen are the chairmen of the
countryas most important ICT chambers: The Software and Computer
Services Chamber (CESSI) and the Argentine Computing and
Telecommunications Chamber (CICOMRA). For more information visit:
http://www.fundacionsadosky.org.ar
11. *Copyright Notice*
The contents of this advisory are copyright (c) 2014-2016 FundaciA3n
Sadosky and are licensed under a Creative Commons Attribution
Non-Commercial Share-Alike 4.0 License:
http://creativecommons.org/licenses/by-nc-sa/4.0/
--
Programa de Seguridad en TIC
FundaciA3n Dr. Manuel Sadosky
Av. CA3rdoba 744 Piso 5 Oficina I
TE/FAX: 4328-5164
| VAR-201607-0365 | CVE-2016-4627 | plural Apple Product IOAcceleratorFamily Vulnerability gained in |
CVSS V2: 7.2 CVSS V3: 7.8 Severity: HIGH |
IOAcceleratorFamily in Apple iOS before 9.3.3, tvOS before 9.2.2, and watchOS before 2.2.2 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-476: NULL Pointer Dereference (NULL Pointer dereference ) Has been identified. Apple iOS, tvOS and watchOS are prone to a local privilege-escalation vulnerability.
Local attackers may exploit this issue to execute arbitrary code with kernel privileges. in the United States. Apple iOS is an operating system developed for mobile devices; tvOS is a smart TV operating system; watchOS is a smart watch operating system. IOAcceleratorFamily is one of the IO acceleration management components. The following products and versions are affected: Apple iOS prior to 9.3.3, OS X prior to 10.11.6, tvOS prior to 9.2.2, watchOS prior to 2.2.2. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2016-07-18-3 watchOS 2.2.2
watchOS 2.2.2 is now available and addresses the following:
CoreGraphics
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to execute arbitrary code
Description: A memory corruption issue was addressed through
improved memory handling.
CVE-2016-4637 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4631 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2016-4632 : Evgeny Sidorov of Yandex
IOAcceleratorFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved validation.
CVE-2016-4627 : Ju Zhu of Trend Micro
IOAcceleratorFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2016-4628 : Ju Zhu of Trend Micro
IOHIDFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-4626 : Stefan Esser of SektionEins
Kernel
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to cause a system denial of service
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-1865 : CESG, Marco Grassi (@marcograss) of KeenLab
(@keen_lab), Tencent
Kernel
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1863 : Ian Beer of Google Project Zero
CVE-2016-1864 : Ju Zhu of Trend Micro
CVE-2016-4582 : Shrek_wzw and Proteas of Qihoo 360 Nirvan Team
libxml2
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Multiple vulnerabilities in libxml2
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4447 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4448 : Apple
CVE-2016-4483 : Gustavo Grieco
CVE-2016-4614 : Nick Wellnhofe
CVE-2016-4615 : Nick Wellnhofer
CVE-2016-4616 : Michael Paddon
CVE-2016-4619 : Hanno Boeck
libxml2
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Parsing a maliciously crafted XML document may lead to
disclosure of user information
Description: An access issue existed in the parsing of maliciously
crafted XML files. This issue was addressed through improved input
validation.
CVE-2016-4449 : Kostya Serebryany
libxslt
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Multiple vulnerabilities in libxslt
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1684 : Nicolas GrA(c)goire
CVE-2016-4607 : Nick Wellnhofer
CVE-2016-4608 : Nicolas GrA(c)goire
CVE-2016-4609 : Nick Wellnhofer
CVE-2016-4610 : Nick Wellnhofer
CVE-2016-4612 : Nicolas GrA(c)goire
Sandbox Profiles
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local application may be able to access the process list
Description: An access issue existed with privileged API calls. This
issue was addressed through additional restrictions.
CVE-2016-4594 : Stefan Esser of SektionEins
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/en-us/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJXjXA7AAoJEIOj74w0bLRGEXgP+weQFMlAuBOyZg11jFauawDt
r+LmaHifpMysV13r6cLkKP6cVqV4G6EEOGp9hSqC2lsHKQYDN5vdyLwLl5sE3kSg
PyQgp5iE3Eihe9ArswPbsrm/c1aIMZbKNnAVQkHOQX7STTmYDfp5ATxxFp7yueld
0QVCEbr4QCpqpQCJhqRO7RHWnlOCmTKdYxsD6rYqOEALnZzfB9A5bZPyeM1LNnJL
ntom0d1GzuBjowrEIFPyZBE+oZP1wEfUBsYnr5sD5jkAHphMCyI0/MPAwH3181aZ
T9jHgJMc/0xlitBHwCT7nv7AE3YpxPYpM8lM1a+cLOfHNaUiX7bfX2w+6PVEDFiP
5X0raq+QYnqKdNXanG2nMhQjIYJEIWbOBKanM7hMWM6C2kd4YAc4eLACX3vObWNS
m1Fbj1/Qxqtng0sqw66HhyFEcz9Cqgg7UX2MEmxVV86Oxqcb2PW5XrwUZ9PtgByP
ks8UNaOXYKaRo+OIhaAPn1qfSSlhp086LfGPuCm5lP0c5hZ9TfyErWPG+1nhD6Vd
l48RQOYcAAE//wMLuSf38CbvS0RVcfzKA6DfUAlEAv0Aw4GOZRNCmtLVZo2QS8kc
nUItEluM+03NkqrGROZiyoC+FIrXunr47JzdP5kawB6C1zsJrP2vFr1au9gbwUZ3
nb7PSAEOmpjCwkMbzdvm
=l25N
-----END PGP SIGNATURE-----
| VAR-201705-2332 | CVE-2016-5810 | Advantech WebAccess of upAdminPg.asp Vulnerable to obtaining important password information |
CVSS V2: 4.0 CVSS V3: 4.9 Severity: MEDIUM |
upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified vectors. Authentication is required to exploit this vulnerability.The specific flaw exists within upAdminPg.asp. One project administrator can view other project administrators' passwords along with the system administrator's password. An attacker can leverage this vulnerability to escalate privileges within the system. Advantech WebAccess (formerly known as BroadWin WebAccess) is a suite of browser-based HMI/SCADA software from Advantech, China. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. ActiveX is one of the components used to transmit dynamic images in surveillance. A version of ActiveX prior to Advantech WebAccess 8.1_20160519 has a security vulnerability. An attacker could exploit the vulnerability to insert or run arbitrary code on an affected system
| VAR-201607-0657 | CVE-2016-5385 | CGI web servers assign Proxy header values from client requests to internal HTTP_PROXY environment variables |
CVSS V2: 5.1 CVSS V3: 8.1 Severity: HIGH |
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue. Web servers running in a CGI or CGI-like context may assign client request Proxy header values to internal HTTP_PROXY environment variables. This vulnerability can be leveraged to conduct man-in-the-middle (MITM) attacks on internal subrequests or to direct the server to initiate connections to arbitrary hosts. This vulnerability "httpoxy" Is called a problem. PHP is prone to a security-bypass vulnerability.
Successfully exploiting this issue may allow attackers to perform unauthorized actions. This may lead to other attacks. PHP (PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor) is an open source general-purpose computer scripting language jointly maintained by the PHP Group and the open source community. The language is mainly used for Web development and supports a variety of databases and operating systems. There is a security vulnerability in PHP 7.0.8 and earlier versions, the vulnerability stems from the fact that the program does not resolve namespace conflicts in RFC 3875 mode. The program does not properly handle data from untrusted client applications in the HTTP_PROXY environment variable. A remote attacker uses the specially crafted Proxy header message in the HTTP request to exploit this vulnerability to implement a man-in-the-middle attack, directing the server to send a connection to any host.
References:
- CVE-2016-5385 - PHP, HTTPoxy
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
The vulnerabilities are addressed by upgrading PHP to the new upstream
version 5.6.24, which includes additional bug fixes. Please refer to the
upstream changelog for more information:
https://php.net/ChangeLog-5.php#5.6.24
For the stable distribution (jessie), these problems have been fixed in
version 5.6.24+dfsg-0+deb8u1.
For the unstable distribution (sid), these problems have been fixed in
version 7.0.9-1 of the php7.0 source package.
We recommend that you upgrade your php5 packages.
Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/php-5.6.24-i586-1_slack14.2.txz: Upgraded.
For more information, see:
http://php.net/ChangeLog-5.php#5.6.24
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5385
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6207
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/php-5.6.24-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/php-5.6.24-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/php-5.6.24-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/php-5.6.24-x86_64-1_slack14.1.txz
Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/php-5.6.24-i586-1_slack14.2.txz
Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/php-5.6.24-x86_64-1_slack14.2.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/php-5.6.24-i586-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/php-5.6.24-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 14.0 package:
712cc177c9ac10f3d58e871ff27260dc php-5.6.24-i486-1_slack14.0.txz
Slackware x86_64 14.0 package:
47f6ad4a81517f5b2959abc73475742b php-5.6.24-x86_64-1_slack14.0.txz
Slackware 14.1 package:
aea6a8869946186781e55c5ecec952b0 php-5.6.24-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
ab16db742762605b9b219b37cdd7e8db php-5.6.24-x86_64-1_slack14.1.txz
Slackware 14.2 package:
c88a731667e741443712267d9b30286a php-5.6.24-i586-1_slack14.2.txz
Slackware x86_64 14.2 package:
ed5b31c94e2fb91f0e6c40051f51da1c php-5.6.24-x86_64-1_slack14.2.txz
Slackware -current package:
c25a85fece34101d35b8785022cef94d n/php-5.6.24-i586-1.txz
Slackware x86_64 -current package:
17f8886fc0901cea6d593170ea00fe7b n/php-5.6.24-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg php-5.6.24-i586-1_slack14.2.txz
Then, restart Apache httpd:
# /etc/rc.d/rc.httpd stop
# /etc/rc.d/rc.httpd start
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. 6) - i386, x86_64
3.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: rh-php56-php security update
Advisory ID: RHSA-2016:1612-01
Product: Red Hat Software Collections
Advisory URL: https://rhn.redhat.com/errata/RHSA-2016-1612.html
Issue date: 2016-08-11
CVE Names: CVE-2016-5385
=====================================================================
1. Summary:
An update for rh-php56-php is now available for Red Hat Software
Collections.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64
3. (CVE-2016-5385)
Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon must be restarted
for the update to take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1353794 - CVE-2016-5385 PHP: sets environmental variable based on user supplied Proxy request header
6. Package List:
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):
Source:
rh-php56-php-5.6.5-9.el6.src.rpm
x86_64:
rh-php56-php-5.6.5-9.el6.x86_64.rpm
rh-php56-php-bcmath-5.6.5-9.el6.x86_64.rpm
rh-php56-php-cli-5.6.5-9.el6.x86_64.rpm
rh-php56-php-common-5.6.5-9.el6.x86_64.rpm
rh-php56-php-dba-5.6.5-9.el6.x86_64.rpm
rh-php56-php-dbg-5.6.5-9.el6.x86_64.rpm
rh-php56-php-debuginfo-5.6.5-9.el6.x86_64.rpm
rh-php56-php-devel-5.6.5-9.el6.x86_64.rpm
rh-php56-php-embedded-5.6.5-9.el6.x86_64.rpm
rh-php56-php-enchant-5.6.5-9.el6.x86_64.rpm
rh-php56-php-fpm-5.6.5-9.el6.x86_64.rpm
rh-php56-php-gd-5.6.5-9.el6.x86_64.rpm
rh-php56-php-gmp-5.6.5-9.el6.x86_64.rpm
rh-php56-php-imap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-intl-5.6.5-9.el6.x86_64.rpm
rh-php56-php-ldap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-mbstring-5.6.5-9.el6.x86_64.rpm
rh-php56-php-mysqlnd-5.6.5-9.el6.x86_64.rpm
rh-php56-php-odbc-5.6.5-9.el6.x86_64.rpm
rh-php56-php-opcache-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pdo-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pgsql-5.6.5-9.el6.x86_64.rpm
rh-php56-php-process-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pspell-5.6.5-9.el6.x86_64.rpm
rh-php56-php-recode-5.6.5-9.el6.x86_64.rpm
rh-php56-php-snmp-5.6.5-9.el6.x86_64.rpm
rh-php56-php-soap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-tidy-5.6.5-9.el6.x86_64.rpm
rh-php56-php-xml-5.6.5-9.el6.x86_64.rpm
rh-php56-php-xmlrpc-5.6.5-9.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6):
Source:
rh-php56-php-5.6.5-9.el6.src.rpm
x86_64:
rh-php56-php-5.6.5-9.el6.x86_64.rpm
rh-php56-php-bcmath-5.6.5-9.el6.x86_64.rpm
rh-php56-php-cli-5.6.5-9.el6.x86_64.rpm
rh-php56-php-common-5.6.5-9.el6.x86_64.rpm
rh-php56-php-dba-5.6.5-9.el6.x86_64.rpm
rh-php56-php-dbg-5.6.5-9.el6.x86_64.rpm
rh-php56-php-debuginfo-5.6.5-9.el6.x86_64.rpm
rh-php56-php-devel-5.6.5-9.el6.x86_64.rpm
rh-php56-php-embedded-5.6.5-9.el6.x86_64.rpm
rh-php56-php-enchant-5.6.5-9.el6.x86_64.rpm
rh-php56-php-fpm-5.6.5-9.el6.x86_64.rpm
rh-php56-php-gd-5.6.5-9.el6.x86_64.rpm
rh-php56-php-gmp-5.6.5-9.el6.x86_64.rpm
rh-php56-php-imap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-intl-5.6.5-9.el6.x86_64.rpm
rh-php56-php-ldap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-mbstring-5.6.5-9.el6.x86_64.rpm
rh-php56-php-mysqlnd-5.6.5-9.el6.x86_64.rpm
rh-php56-php-odbc-5.6.5-9.el6.x86_64.rpm
rh-php56-php-opcache-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pdo-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pgsql-5.6.5-9.el6.x86_64.rpm
rh-php56-php-process-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pspell-5.6.5-9.el6.x86_64.rpm
rh-php56-php-recode-5.6.5-9.el6.x86_64.rpm
rh-php56-php-snmp-5.6.5-9.el6.x86_64.rpm
rh-php56-php-soap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-tidy-5.6.5-9.el6.x86_64.rpm
rh-php56-php-xml-5.6.5-9.el6.x86_64.rpm
rh-php56-php-xmlrpc-5.6.5-9.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):
Source:
rh-php56-php-5.6.5-9.el6.src.rpm
x86_64:
rh-php56-php-5.6.5-9.el6.x86_64.rpm
rh-php56-php-bcmath-5.6.5-9.el6.x86_64.rpm
rh-php56-php-cli-5.6.5-9.el6.x86_64.rpm
rh-php56-php-common-5.6.5-9.el6.x86_64.rpm
rh-php56-php-dba-5.6.5-9.el6.x86_64.rpm
rh-php56-php-dbg-5.6.5-9.el6.x86_64.rpm
rh-php56-php-debuginfo-5.6.5-9.el6.x86_64.rpm
rh-php56-php-devel-5.6.5-9.el6.x86_64.rpm
rh-php56-php-embedded-5.6.5-9.el6.x86_64.rpm
rh-php56-php-enchant-5.6.5-9.el6.x86_64.rpm
rh-php56-php-fpm-5.6.5-9.el6.x86_64.rpm
rh-php56-php-gd-5.6.5-9.el6.x86_64.rpm
rh-php56-php-gmp-5.6.5-9.el6.x86_64.rpm
rh-php56-php-imap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-intl-5.6.5-9.el6.x86_64.rpm
rh-php56-php-ldap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-mbstring-5.6.5-9.el6.x86_64.rpm
rh-php56-php-mysqlnd-5.6.5-9.el6.x86_64.rpm
rh-php56-php-odbc-5.6.5-9.el6.x86_64.rpm
rh-php56-php-opcache-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pdo-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pgsql-5.6.5-9.el6.x86_64.rpm
rh-php56-php-process-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pspell-5.6.5-9.el6.x86_64.rpm
rh-php56-php-recode-5.6.5-9.el6.x86_64.rpm
rh-php56-php-snmp-5.6.5-9.el6.x86_64.rpm
rh-php56-php-soap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-tidy-5.6.5-9.el6.x86_64.rpm
rh-php56-php-xml-5.6.5-9.el6.x86_64.rpm
rh-php56-php-xmlrpc-5.6.5-9.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):
Source:
rh-php56-php-5.6.5-9.el6.src.rpm
x86_64:
rh-php56-php-5.6.5-9.el6.x86_64.rpm
rh-php56-php-bcmath-5.6.5-9.el6.x86_64.rpm
rh-php56-php-cli-5.6.5-9.el6.x86_64.rpm
rh-php56-php-common-5.6.5-9.el6.x86_64.rpm
rh-php56-php-dba-5.6.5-9.el6.x86_64.rpm
rh-php56-php-dbg-5.6.5-9.el6.x86_64.rpm
rh-php56-php-debuginfo-5.6.5-9.el6.x86_64.rpm
rh-php56-php-devel-5.6.5-9.el6.x86_64.rpm
rh-php56-php-embedded-5.6.5-9.el6.x86_64.rpm
rh-php56-php-enchant-5.6.5-9.el6.x86_64.rpm
rh-php56-php-fpm-5.6.5-9.el6.x86_64.rpm
rh-php56-php-gd-5.6.5-9.el6.x86_64.rpm
rh-php56-php-gmp-5.6.5-9.el6.x86_64.rpm
rh-php56-php-imap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-intl-5.6.5-9.el6.x86_64.rpm
rh-php56-php-ldap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-mbstring-5.6.5-9.el6.x86_64.rpm
rh-php56-php-mysqlnd-5.6.5-9.el6.x86_64.rpm
rh-php56-php-odbc-5.6.5-9.el6.x86_64.rpm
rh-php56-php-opcache-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pdo-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pgsql-5.6.5-9.el6.x86_64.rpm
rh-php56-php-process-5.6.5-9.el6.x86_64.rpm
rh-php56-php-pspell-5.6.5-9.el6.x86_64.rpm
rh-php56-php-recode-5.6.5-9.el6.x86_64.rpm
rh-php56-php-snmp-5.6.5-9.el6.x86_64.rpm
rh-php56-php-soap-5.6.5-9.el6.x86_64.rpm
rh-php56-php-tidy-5.6.5-9.el6.x86_64.rpm
rh-php56-php-xml-5.6.5-9.el6.x86_64.rpm
rh-php56-php-xmlrpc-5.6.5-9.el6.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):
Source:
rh-php56-php-5.6.5-9.el7.src.rpm
x86_64:
rh-php56-php-5.6.5-9.el7.x86_64.rpm
rh-php56-php-bcmath-5.6.5-9.el7.x86_64.rpm
rh-php56-php-cli-5.6.5-9.el7.x86_64.rpm
rh-php56-php-common-5.6.5-9.el7.x86_64.rpm
rh-php56-php-dba-5.6.5-9.el7.x86_64.rpm
rh-php56-php-dbg-5.6.5-9.el7.x86_64.rpm
rh-php56-php-debuginfo-5.6.5-9.el7.x86_64.rpm
rh-php56-php-devel-5.6.5-9.el7.x86_64.rpm
rh-php56-php-embedded-5.6.5-9.el7.x86_64.rpm
rh-php56-php-enchant-5.6.5-9.el7.x86_64.rpm
rh-php56-php-fpm-5.6.5-9.el7.x86_64.rpm
rh-php56-php-gd-5.6.5-9.el7.x86_64.rpm
rh-php56-php-gmp-5.6.5-9.el7.x86_64.rpm
rh-php56-php-intl-5.6.5-9.el7.x86_64.rpm
rh-php56-php-ldap-5.6.5-9.el7.x86_64.rpm
rh-php56-php-mbstring-5.6.5-9.el7.x86_64.rpm
rh-php56-php-mysqlnd-5.6.5-9.el7.x86_64.rpm
rh-php56-php-odbc-5.6.5-9.el7.x86_64.rpm
rh-php56-php-opcache-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pdo-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pgsql-5.6.5-9.el7.x86_64.rpm
rh-php56-php-process-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pspell-5.6.5-9.el7.x86_64.rpm
rh-php56-php-recode-5.6.5-9.el7.x86_64.rpm
rh-php56-php-snmp-5.6.5-9.el7.x86_64.rpm
rh-php56-php-soap-5.6.5-9.el7.x86_64.rpm
rh-php56-php-xml-5.6.5-9.el7.x86_64.rpm
rh-php56-php-xmlrpc-5.6.5-9.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1):
Source:
rh-php56-php-5.6.5-9.el7.src.rpm
x86_64:
rh-php56-php-5.6.5-9.el7.x86_64.rpm
rh-php56-php-bcmath-5.6.5-9.el7.x86_64.rpm
rh-php56-php-cli-5.6.5-9.el7.x86_64.rpm
rh-php56-php-common-5.6.5-9.el7.x86_64.rpm
rh-php56-php-dba-5.6.5-9.el7.x86_64.rpm
rh-php56-php-dbg-5.6.5-9.el7.x86_64.rpm
rh-php56-php-debuginfo-5.6.5-9.el7.x86_64.rpm
rh-php56-php-devel-5.6.5-9.el7.x86_64.rpm
rh-php56-php-embedded-5.6.5-9.el7.x86_64.rpm
rh-php56-php-enchant-5.6.5-9.el7.x86_64.rpm
rh-php56-php-fpm-5.6.5-9.el7.x86_64.rpm
rh-php56-php-gd-5.6.5-9.el7.x86_64.rpm
rh-php56-php-gmp-5.6.5-9.el7.x86_64.rpm
rh-php56-php-intl-5.6.5-9.el7.x86_64.rpm
rh-php56-php-ldap-5.6.5-9.el7.x86_64.rpm
rh-php56-php-mbstring-5.6.5-9.el7.x86_64.rpm
rh-php56-php-mysqlnd-5.6.5-9.el7.x86_64.rpm
rh-php56-php-odbc-5.6.5-9.el7.x86_64.rpm
rh-php56-php-opcache-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pdo-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pgsql-5.6.5-9.el7.x86_64.rpm
rh-php56-php-process-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pspell-5.6.5-9.el7.x86_64.rpm
rh-php56-php-recode-5.6.5-9.el7.x86_64.rpm
rh-php56-php-snmp-5.6.5-9.el7.x86_64.rpm
rh-php56-php-soap-5.6.5-9.el7.x86_64.rpm
rh-php56-php-xml-5.6.5-9.el7.x86_64.rpm
rh-php56-php-xmlrpc-5.6.5-9.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2):
Source:
rh-php56-php-5.6.5-9.el7.src.rpm
x86_64:
rh-php56-php-5.6.5-9.el7.x86_64.rpm
rh-php56-php-bcmath-5.6.5-9.el7.x86_64.rpm
rh-php56-php-cli-5.6.5-9.el7.x86_64.rpm
rh-php56-php-common-5.6.5-9.el7.x86_64.rpm
rh-php56-php-dba-5.6.5-9.el7.x86_64.rpm
rh-php56-php-dbg-5.6.5-9.el7.x86_64.rpm
rh-php56-php-debuginfo-5.6.5-9.el7.x86_64.rpm
rh-php56-php-devel-5.6.5-9.el7.x86_64.rpm
rh-php56-php-embedded-5.6.5-9.el7.x86_64.rpm
rh-php56-php-enchant-5.6.5-9.el7.x86_64.rpm
rh-php56-php-fpm-5.6.5-9.el7.x86_64.rpm
rh-php56-php-gd-5.6.5-9.el7.x86_64.rpm
rh-php56-php-gmp-5.6.5-9.el7.x86_64.rpm
rh-php56-php-intl-5.6.5-9.el7.x86_64.rpm
rh-php56-php-ldap-5.6.5-9.el7.x86_64.rpm
rh-php56-php-mbstring-5.6.5-9.el7.x86_64.rpm
rh-php56-php-mysqlnd-5.6.5-9.el7.x86_64.rpm
rh-php56-php-odbc-5.6.5-9.el7.x86_64.rpm
rh-php56-php-opcache-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pdo-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pgsql-5.6.5-9.el7.x86_64.rpm
rh-php56-php-process-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pspell-5.6.5-9.el7.x86_64.rpm
rh-php56-php-recode-5.6.5-9.el7.x86_64.rpm
rh-php56-php-snmp-5.6.5-9.el7.x86_64.rpm
rh-php56-php-soap-5.6.5-9.el7.x86_64.rpm
rh-php56-php-xml-5.6.5-9.el7.x86_64.rpm
rh-php56-php-xmlrpc-5.6.5-9.el7.x86_64.rpm
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):
Source:
rh-php56-php-5.6.5-9.el7.src.rpm
x86_64:
rh-php56-php-5.6.5-9.el7.x86_64.rpm
rh-php56-php-bcmath-5.6.5-9.el7.x86_64.rpm
rh-php56-php-cli-5.6.5-9.el7.x86_64.rpm
rh-php56-php-common-5.6.5-9.el7.x86_64.rpm
rh-php56-php-dba-5.6.5-9.el7.x86_64.rpm
rh-php56-php-dbg-5.6.5-9.el7.x86_64.rpm
rh-php56-php-debuginfo-5.6.5-9.el7.x86_64.rpm
rh-php56-php-devel-5.6.5-9.el7.x86_64.rpm
rh-php56-php-embedded-5.6.5-9.el7.x86_64.rpm
rh-php56-php-enchant-5.6.5-9.el7.x86_64.rpm
rh-php56-php-fpm-5.6.5-9.el7.x86_64.rpm
rh-php56-php-gd-5.6.5-9.el7.x86_64.rpm
rh-php56-php-gmp-5.6.5-9.el7.x86_64.rpm
rh-php56-php-intl-5.6.5-9.el7.x86_64.rpm
rh-php56-php-ldap-5.6.5-9.el7.x86_64.rpm
rh-php56-php-mbstring-5.6.5-9.el7.x86_64.rpm
rh-php56-php-mysqlnd-5.6.5-9.el7.x86_64.rpm
rh-php56-php-odbc-5.6.5-9.el7.x86_64.rpm
rh-php56-php-opcache-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pdo-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pgsql-5.6.5-9.el7.x86_64.rpm
rh-php56-php-process-5.6.5-9.el7.x86_64.rpm
rh-php56-php-pspell-5.6.5-9.el7.x86_64.rpm
rh-php56-php-recode-5.6.5-9.el7.x86_64.rpm
rh-php56-php-snmp-5.6.5-9.el7.x86_64.rpm
rh-php56-php-soap-5.6.5-9.el7.x86_64.rpm
rh-php56-php-xml-5.6.5-9.el7.x86_64.rpm
rh-php56-php-xmlrpc-5.6.5-9.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFXrPTMXlSAg2UNWIIRAiQCAJ0dfYfBJiwAbTVStw+pFUwIMP5jhwCgi+MO
fr/VPvwdPqG/A0DnoFIO9PE=
=7VKA
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
.
=========================================================================
Ubuntu Security Notice USN-3045-1
August 02, 2016
php5, php7.0 vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in PHP.
Software Description:
- php7.0: HTML-embedded scripting language interpreter
- php5: HTML-embedded scripting language interpreter
Details:
It was discovered that PHP incorrectly handled certain SplMinHeap::compar
e
operations. A remote attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code. Thi
s
issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-4116
)
It was discovered that PHP incorrectly handled recursive method calls. A
remote attacker could use this issue to cause PHP to crash, resulting in
a
denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu
14.04 LTS. (CVE-2015-8873)
It was discovered that PHP incorrectly validated certain Exception object
s
when unserializing data. A remote attacker could use this issue to cause
PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.0
4
LTS. (CVE-2015-8876)
It was discovered that PHP header() function performed insufficient
filtering for Internet Explorer. A remote attacker could possibly use thi
s
issue to perform a XSS attack. This issue only affected Ubuntu 12.04 LTS
and Ubuntu 14.04 LTS. (CVE-2015-8935)
It was discovered that PHP incorrectly handled certain locale operations.
An attacker could use this issue to cause PHP to crash, resulting in a
denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu
14.04 LTS. (CVE-2016-5093)
It was discovered that the PHP php_html_entities() function incorrectly
handled certain string lengths. A remote attacker could use this issue to
cause PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.0
4
LTS. (CVE-2016-5094, CVE-2016-5095)
It was discovered that the PHP fread() function incorrectly handled certa
in
lengths. An attacker could use this issue to cause PHP to crash, resultin
g
in a denial of service, or possibly execute arbitrary code. This issue on
ly
affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5096)
It was discovered that the PHP FastCGI Process Manager (FPM) SAPI
incorrectly handled memory in the access logging feature. An attacker cou
ld
use this issue to cause PHP to crash, resulting in a denial of service, o
r
possibly expose sensitive information. This issue only affected Ubuntu
12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5114)
It was discovered that PHP would not protect applications from contents o
f
the HTTP_PROXY environment variable when based on the contents of the Pro
xy
header from HTTP requests. A remote attacker could possibly use this issu
e
in combination with scripts that honour the HTTP_PROXY variable to redire
ct
outgoing HTTP requests. (CVE-2016-5385)
Hans Jerry Illikainen discovered that the PHP bzread() function incorrect
ly
performed error handling. A remote attacker could use this issue to cause
PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-5399)
It was discovered that certain PHP multibyte string functions incorrectly
handled memory. A remote attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-5768)
It was discovered that the PHP Mcrypt extension incorrectly handled memor
y.
A remote attacker could use this issue to cause PHP to crash, resulting i
n
a denial of service, or possibly execute arbitrary code. This issue only
affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5769)
It was discovered that the PHP garbage collector incorrectly handled
certain objects when unserializing malicious data. A remote attacker coul
d
use this issue to cause PHP to crash, resulting in a denial of service, o
r
possibly execute arbitrary code. This issue was only addressed in Ubuntu
Ubuntu 14.04 LTS. (CVE-2016-5771, CVE-2016-5773)
It was discovered that PHP incorrectly handled memory when unserializing
malicious xml data. A remote attacker could use this issue to cause PHP t
o
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
(CVE-2016-5772)
It was discovered that the PHP php_url_parse_ex() function incorrectly
handled string termination. A remote attacker could use this issue to cau
se
PHP to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.0
4
LTS. (CVE-2016-6288)
It was discovered that PHP incorrectly handled path lengths when extracti
ng
certain Zip archives. A remote attacker could use this issue to cause PHP
to crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-6289)
It was discovered that PHP incorrectly handled session deserialization. A
remote attacker could use this issue to cause PHP to crash, resulting in
a
denial of service, or possibly execute arbitrary code. (CVE-2016-6290)
It was discovered that PHP incorrectly handled exif headers when processi
ng
certain JPEG images. A remote attacker could use this issue to cause PHP
to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-6291, CVE-2016-6292)
It was discovered that PHP incorrectly handled certain locale operations.
A
remote attacker could use this issue to cause PHP to crash, resulting in
a
denial of service, or possibly execute arbitrary code. (CVE-2016-6294)
It was discovered that the PHP garbage collector incorrectly handled
certain objects when unserializing SNMP data. A remote attacker could use
this issue to cause PHP to crash, resulting in a denial of service, or
possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LT
S
and Ubuntu 16.04 LTS. (CVE-2016-6295)
It was discovered that the PHP xmlrpc_encode_request() function incorrect
ly
handled certain lengths. An attacker could use this issue to cause PHP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2016-6296)
It was discovered that the PHP php_stream_zip_opener() function incorrect
ly
handled memory. An attacker could use this issue to cause PHP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-6297)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
libapache2-mod-php7.0 7.0.8-0ubuntu0.16.04.2
php7.0-cgi 7.0.8-0ubuntu0.16.04.2
php7.0-cli 7.0.8-0ubuntu0.16.04.2
php7.0-fpm 7.0.8-0ubuntu0.16.04.2
Ubuntu 14.04 LTS:
libapache2-mod-php5 5.5.9+dfsg-1ubuntu4.19
php5-cgi 5.5.9+dfsg-1ubuntu4.19
php5-cli 5.5.9+dfsg-1ubuntu4.19
php5-fpm 5.5.9+dfsg-1ubuntu4.19
Ubuntu 12.04 LTS:
libapache2-mod-php5 5.3.10-1ubuntu3.24
php5-cgi 5.3.10-1ubuntu3.24
php5-cli 5.3.10-1ubuntu3.24
php5-fpm 5.3.10-1ubuntu3.24
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-3045-1
CVE-2015-4116, CVE-2015-8873, CVE-2015-8876, CVE-2015-8935,
CVE-2016-5093, CVE-2016-5094, CVE-2016-5095, CVE-2016-5096,
CVE-2016-5114, CVE-2016-5385, CVE-2016-5399, CVE-2016-5768,
CVE-2016-5769, CVE-2016-5771, CVE-2016-5772, CVE-2016-5773,
CVE-2016-6288, CVE-2016-6289, CVE-2016-6290, CVE-2016-6291,
CVE-2016-6292, CVE-2016-6294, CVE-2016-6295, CVE-2016-6296,
CVE-2016-6297
Package Information:
https://launchpad.net/ubuntu/+source/php7.0/7.0.8-0ubuntu0.16.04.2
https://launchpad.net/ubuntu/+source/php5/5.5.9+dfsg-1ubuntu4.19
https://launchpad.net/ubuntu/+source/php5/5.3.10-1ubuntu3.24
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Note: the current version of the following document is available here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05333297
SUPPORT COMMUNICATION - SECURITY BULLETIN
Document ID: c05333297
Version: 2
HPSBST03671 rev.2 - HPE StoreEver MSL6480 Tape Library Management Interface,
Multiple Remote Vulnerabilities
NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.
Release Date: 2017-01-14
Last Updated: 2017-01-13
Potential Security Impact: Remote: Denial of Service (DoS), Unauthorized
Disclosure of Information
Source: Hewlett Packard Enterprise, Product Security Response Team
VULNERABILITY SUMMARY
A security vulnerability in PHP was addressed by the HPE StoreEver MSL6480
Tape Library firmware version 5.10. The vulnerability could be exploited
remotely to allow Unauthorized Disclosure of Information or Denial of Service
via the Ethernet Management Interface. Please note that the Management
Interface cannot access data stored on tape media, so this vulnerability does
not allow for remote unauthorized disclosure of data stored on tape media or
remote denial of service.
References:
- CVE-2016-5385 - PHP, HTTPoxy
- CVE-2016-3074 - PHP
- CVE-2013-7456 - PHP
- CVE-2016-5093 - PHP
- CVE-2016-5094 - PHP
- CVE-2016-5096 - PHP
- CVE-2016-5766 - PHP
- CVE-2016-5767 - PHP
- CVE-2016-5768 - PHP
- CVE-2016-5769 - PHP
- CVE-2016-5770 - PHP
- CVE-2016-5771 - PHP
- CVE-2016-5772 - PHP
- CVE-2016-5773 - PHP
- CVE-2016-6207 - GD Graphics Library
- CVE-2016-6289 - PHP
- CVE-2016-6290 - PHP
- CVE-2016-6291 - PHP
- CVE-2016-6292 - PHP
- CVE-2016-6293 - PHP
- CVE-2016-6294 - PHP
- CVE-2016-6295 - PHP
- CVE-2016-6296 - PHP
- CVE-2016-6297 - PHP
- CVE-2016-5399 - PHP
SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
- HP StoreEver MSL6480 Tape Library prior to 5.10
BACKGROUND
CVSS Base Metrics
=================
Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector
CVE-2013-7456
7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVE-2016-3074
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-5093
8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-5094
8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-5096
8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-5385
8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CVE-2016-5399
8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
CVE-2016-5766
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVE-2016-5767
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVE-2016-5768
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-5769
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-5770
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-5771
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-5772
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-5773
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-6207
6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVE-2016-6289
7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVE-2016-6290
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-6291
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-6292
6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVE-2016-6293
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-6294
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-6295
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-6296
9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVE-2016-6297
8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Information on CVSS is documented in
HPE Customer Notice HPSN-2008-002 here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499
RESOLUTION
HPE has provided the following software update to resolve the vulnerabilities
for the impacted versions of the HPE StoreEver MSL6480 Tape Library:
* <http://www.hpe.com/support/msl6480>
HISTORY
Version:1 (rev.1) - 15 November 2016 Initial release
Version:2 (rev.2) - 13 January 2017 Updating CVE list
Third Party Security Patches: Third party security patches that are to be
installed on systems running Hewlett Packard Enterprise (HPE) software
products should be applied in accordance with the customer's patch management
policy.
Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HPE Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-alert@hpe.com.
Report: To report a potential security vulnerability for any HPE supported
product:
Web form: https://www.hpe.com/info/report-security-vulnerability
Email: security-alert@hpe.com
Subscribe: To initiate a subscription to receive future HPE Security Bulletin
alerts via Email: http://www.hpe.com/support/Subscriber_Choice
Security Bulletin Archive: A list of recently released Security Bulletins is
available here: http://www.hpe.com/support/Security_Bulletin_Archive
Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.
3C = 3COM
3P = 3rd Party Software
GN = HPE General Software
HF = HPE Hardware and Firmware
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PV = ProCurve
ST = Storage Software
UX = HP-UX
Copyright 2016 Hewlett Packard Enterprise
Hewlett Packard Enterprise shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is provided
"as is" without warranty of any kind. To the extent permitted by law, neither
HP or its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits; damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice. Hewlett
Packard Enterprise and the names of Hewlett Packard Enterprise products
referenced herein are trademarks of Hewlett Packard Enterprise in the United
States and other countries. Other product and company names mentioned herein
may be trademarks of their respective owners
| VAR-201704-0179 | CVE-2016-4650 | plural Apple Product IOHIDFamily Heap-based buffer overflow vulnerability |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: HIGH |
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. User interaction is required to exploit this vulnerability in that the target must open a malicious file.The specific flaw exists within the IOHIDFamily kernel extension. The issue lies in the failure to validate a supplied length value causing a heap buffer overflow. An attacker can leverage this vulnerability to escalate privileges and execute code under the context of the kernel. Apple tvOS, Mac OS X and iOS are prone to a memory-corruption vulnerability. Failed exploit attempts may result in a denial-of-service condition.
Note: This issue was previously titled 'PHP CVE-2016-4650 Multiple Remote Code Execution Vulnerabilities'. The title has been changed to better reflect the vulnerability information. Apple iOS is an operating system developed for mobile devices; OS X is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. IOHIDFamily is one of the kernel extensions (Abstract Interface for Human Interface Devices) component
| VAR-201607-0687 | CVE-2014-9862 | Apple OS X Used in products such as bsdiff of bspatch of bspatch.c Integer sign error vulnerability |
CVSS V2: 7.2 CVSS V3: 7.8 Severity: HIGH |
Integer signedness error in bspatch.c in bspatch in bsdiff, as used in Apple OS X before 10.11.6 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted patch file. Apple OS X Used in and other products bsdiff of bspatch of bspatch.c Contains an integer sign error vulnerability. Supplementary information : CWE Vulnerability type by CWE-190: Integer Overflow or Wraparound ( Integer overflow or wraparound ) Has been identified.
Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable. bsdiff is one of the tool components used to build patched binaries. ==========================================================================
Ubuntu Security Notice USN-4500-1
September 15, 2020
bsdiff vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
bsdiff could be made to crash or run programs as your login if it
opened a specially crafted file.
Software Description:
- bsdiff: generate/apply a patch between two binary files
Details:
It was discovered that bsdiff mishandled certain input.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
bsdiff 4.3-15+deb8u1build0.16.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4500-1
CVE-2014-9862
Package Information:
https://launchpad.net/ubuntu/+source/bsdiff/4.3-15+deb8u1build0.16.04.1
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-16:25.bspatch Security Advisory
The FreeBSD Project
Topic: Heap vulnerability in bspatch
Category: core
Module: bsdiff
Announced: 2016-07-25
Affects: All supported versions of FreeBSD.
Corrected: 2016-07-25 14:52:12 UTC (stable/11, 11.0-BETA2-p1)
2016-07-25 14:52:12 UTC (stable/11, 11.0-BETA1-p1)
2016-07-25 14:53:04 UTC (stable/10, 10.3-STABLE)
2016-07-25 15:04:17 UTC (releng/10.3, 10.3-RELEASE-p6)
2016-07-25 15:04:17 UTC (releng/10.2, 10.2-RELEASE-p20)
2016-07-25 15:04:17 UTC (releng/10.1, 10.1-RELEASE-p37)
2016-07-25 14:53:04 UTC (stable/9, 9.3-STABLE)
2016-07-25 15:04:17 UTC (releng/9.3, 9.3-RELEASE-p45)
CVE Name: CVE-2014-9862
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The bspatch utility generates newfile from oldfile and patchfile where
patchfile is a binary patch built by bsdiff(1).
II. Problem Description
The implementation of bspatch does not check for a negative value on numbers
of bytes read from the diff and extra streams, allowing an attacker who
can control the patch file to write at arbitrary locations in the heap.
This issue was first discovered by The Chromium Project and reported
independently by Lu Tung-Pin to the FreeBSD project.
III. Impact
An attacker who can control the patch file can cause a crash or run arbitrary
code under the credentials of the user who runs bspatch, in many cases, root.
IV. Workaround
No workaround is available.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
No reboot is needed.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
No reboot is needed.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-16:25/bspatch.patch
# fetch https://security.FreeBSD.org/patches/SA-16:25/bspatch.patch.asc
# gpg --verify bspatch.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r303301
releng/9.3/ r303304
stable/10/ r303301
releng/10.1/ r303304
releng/10.2/ r303304
releng/10.3/ r303304
stable/11/ r303300
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://bugs.chromium.org/p/chromium/issues/detail?id=372525>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9862>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:25.bspatch.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.13 (FreeBSD)
iQIcBAEBCgAGBQJXlir7AAoJEO1n7NZdz2rnTtAP/iFnhrcmRuxmeMGtVPWHZFhH
/I2iB62wGf4vNGVedwh3fHPEgjEpMvDVP7S+OCLB7Fnf+Mwm9uL47cjxdr/P5dy8
iKRsojG7HVE3Iia7DyaSEQwbJMQZGWsy2wr9epiHPoOpnSaWKUBx94C+oc7gPdM5
8LW5OpUgSpFCztQ82gbM/2Bjy5OREJQP6ASW62WO+MkD7n+ZUzsUCdR13bzvpA23
BaNeInQArn5Zf3OiZXjQ9Go1muml2llQmqxeb8p3V9IbJ3mdUBQat1AtF/yXfpWA
tkUfgqAaoKbjOrk22h/wBRssPlqqftZDXWqi2KlkEltqyU1evnsb5UVCu0SZdgkW
lQlnE1vymJCnxC211SweDNbbP8laR0OpjRxUxljSXVMXag4Lh9+9aD6zIZ9zZNi7
MxXEasLZViwq8gEbZLlLUfcOQVv6T+3jTiH8aRUYFp5PsBGBgQCAQgGCEaztQTNr
lnSp/rqnP7FEu7gsHtP3wGK03RItNketbKMSUzV5eXiWmVYC3a6/WboqqJuqhDka
zs3W0h0Fw6iqk6CfImHnhD1unarXnSQU5vRcf9srnUvS0XgYS/113BQK23SjGmki
OIJe3Wm0CrcChAf8lKdeyPlKFcN906EkQ8Hh8vB00B9BZCXYLY9zBK6lW40NA1UN
cy+ljfLX/xwCNIJJXdwH
=FL3H
-----END PGP SIGNATURE-----
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2016-07-18-1 OS X El Capitan v10.11.6 and Security Update
2016-004
OS X El Capitan v10.11.6 and Security Update 2016-004 is now
available and addresses the following:
apache_mod_php
Available for:
OS X Yosemite v10.10.5 and OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple issues existed in PHP versions prior to
5.5.36. These were addressed by updating PHP to version 5.5.36.
CVE-2016-4650
Audio
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed through
improved memory handling.
CVE-2016-4647 : Juwei Lin (@fuzzerDOTcn) of Trend Micro
Audio
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to determine kernel memory layout
Description: An out-of-bounds read was addressed through improved
input validation.
CVE-2016-4648 : Juwei Lin(@fuzzerDOTcn) of Trend Micro
Audio
Available for: OS X El Capitan v10.11 and later
Impact: Parsing a maliciously crafted audio file may lead to the
disclosure of user information
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2016-4646 : Steven Seeley of Source Incite working with Trend
Micro's Zero Day Initiative
Audio
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to cause a system denial of service
Description: A null pointer dereference was addressed through
improved input validation. This issue was
addressed through improved bounds checking.
CVE-2014-9862 : an anonymous researcher
CFNetwork
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to view sensitive user information
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed through improved
restrictions.
CVE-2016-4645 : Abhinav Bansal of Zscaler Inc.
CoreGraphics
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,
and OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: A memory corruption issue was addressed through
improved memory handling.
CVE-2016-4637 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
CoreGraphics
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to elevate privileges
Description: An out-of-bounds read issue existed that led to the
disclosure of kernel memory. This was addressed through improved
input validation.
CVE-2016-4652 : Yubin Fu of Tencent KeenLab working with Trend
Micro's Zero Day Initiative
FaceTime
Available for: OS X El Capitan v10.11 and later
Impact: An attacker in a privileged network position may be able to
cause a relayed call to continue transmitting audio while appearing
as if the call terminated
Description: User interface inconsistencies existed in the handling
of relayed calls. These issues were addressed through improved
FaceTime display logic.
CVE-2016-4635 : Martin Vigo
Graphics Drivers
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed through
improved input validation.
CVE-2016-4634 : Stefan Esser of SektionEins
ImageIO
Available for: OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2016-4632 : Evgeny Sidorov of Yandex
ImageIO
Available for: OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4631 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,
and OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4629 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
CVE-2016-4630 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
Intel Graphics Driver
Available for: OS X El Capitan v10.11 and later
Impact: A malicious application may be able to execute arbitrary
code with kernel privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4633 : an anonymous researcher
IOHIDFamily
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-4626 : Stefan Esser of SektionEins
IOSurface
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A use-after-free was addressed through improved memory
management.
CVE-2016-4625 : Ian Beer of Google Project Zero
Kernel
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1863 : Ian Beer of Google Project Zero
CVE-2016-1864 : Ju Zhu of Trend Micro
CVE-2016-4582 : Shrek_wzw and Proteas of Qihoo 360 Nirvan Team
Kernel
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to cause a system denial of service
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-1865 : CESG, Marco Grassi (@marcograss) of KeenLab
(@keen_lab), Tencent
libc++abi
Available for: OS X El Capitan v10.11 and later
Impact: An application may be able to execute arbitrary code with
root privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4621 : an anonymous researcher
libexpat
Available for: OS X El Capitan v10.11 and later
Impact: Processing maliciously crafted XML may lead to unexpected
application termination or arbitrary code execution
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-0718 : Gustavo Grieco
LibreSSL
Available for: OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple issues existed in LibreSSL before 2.2.7. These
were addressed by updating LibreSSL to version 2.2.7.
CVE-2016-2108 : Huzaifa Sidhpurwala (Red Hat), Hanno Boeck, David Benjamin (Google) Mark Brand,
Ian Beer of Google Project Zero
CVE-2016-2109 : Brian Carpenter
libxml2
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,
and OS X El Capitan v10.11 and later
Impact: Parsing a maliciously crafted XML document may lead to
disclosure of user information
Description: An access issue existed in the parsing of maliciously
crafted XML files. This issue was addressed through improved input
validation.
CVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4447 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4448 : Apple
CVE-2016-4483 : Gustavo Grieco
CVE-2016-4614 : Nick Wellnhofe
CVE-2016-4615 : Nick Wellnhofer
CVE-2016-4616 : Michael Paddon
CVE-2016-4619 : Hanno Boeck
libxslt
Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5,
and OS X El Capitan v10.11 and later
Impact: Multiple vulnerabilities in libxslt
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1684 : Nicolas GrA(c)goire
CVE-2016-4607 : Nick Wellnhofer
CVE-2016-4608 : Nicolas GrA(c)goire
CVE-2016-4609 : Nick Wellnhofer
CVE-2016-4610 : Nick Wellnhofer
CVE-2016-4612 : Nicolas GrA(c)goire
Login Window
Available for: OS X El Capitan v10.11 and later
Impact: A malicious application may be able to execute arbitrary
code leading to compromise of user information
Description: A memory corruption issue was addressed through
improved input validation.
CVE-2016-4640 : Yubin Fu of Tencent KeenLab working with Trend
Micro's Zero Day Initiative
Login Window
Available for: OS X El Capitan v10.11 and later
Impact: A malicious application may be able to execute arbitrary
code leading to the compromise of user information
Description: A type confusion issue was addressed through improved
memory handling.
CVE-2016-4641 : Yubin Fu of Tencent KeenLab working with Trend
Micro's Zero Day Initiative
Login Window
Available for: OS X El Capitan v10.11 and later
Impact: A local user may be able to cause a denial of service
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2016-4639 : Yubin Fu of Tencent KeenLab working with Trend
Micro's Zero Day Initiative
Login Window
Available for: OS X El Capitan v10.11 and later
Impact: A malicious application may be able to gain root privileges
Description: A type confusion issue was addressed through improved
memory handling.
CVE-2016-4638 : Yubin Fu of Tencent KeenLab working with Trend
Micro's Zero Day Initiative
OpenSSL
Available for: OS X El Capitan v10.11 and later
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple issues existed in OpenSSL. These issues were resolved by backporting the fixes from OpenSSL 1.0.2h/1.0.1 to OpenSSL 0.9.8.
CVE-2016-2105 : Guido Vranken
CVE-2016-2106 : Guido Vranken
CVE-2016-2107 : Juraj Somorovsky
CVE-2016-2108 : Huzaifa Sidhpurwala (Red Hat), Hanno Boeck, David Benjamin (Google), Mark Brand and Ian Beer of Google Project Zero
CVE-2016-2109 : Brian Carpenter
CVE-2016-2176 : Guido Vranken
QuickTime
Available for: OS X El Capitan v10.11 and later
Impact: Processing a maliciously crafted FlashPix Bitmap Image may
lead to unexpected application termination or arbitrary code
execution
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4596 : Ke Liu of Tencent's Xuanwu Lab
CVE-2016-4597 : Ke Liu of Tencent's Xuanwu Lab
CVE-2016-4600 : Ke Liu of Tencent's Xuanwu Lab
CVE-2016-4602 : Ke Liu of Tencent's Xuanwu Lab
QuickTime
Available for: OS X El Capitan v10.11 and later
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: A memory corruption issue was addressed through
improved input validation.
CVE-2016-4598 : Ke Liu of Tencent's Xuanwu Lab
QuickTime
Available for: OS X El Capitan v10.11 and later
Impact: Processing a maliciously crafted SGI file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through
improved input validation.
CVE-2016-4601 : Ke Liu of Tencent's Xuanwu Lab
QuickTime
Available for: OS X El Capitan v10.11 and later
Impact: Processing a maliciously crafted Photoshop document may lead
to unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed through
improved input validation.
CVE-2016-4599 : Ke Liu of Tencent's Xuanwu Lab
Safari Login AutoFill
Available for: OS X El Capitan v10.11 and later
Impact: A user's password may be visible on screen
Description: An issue existed in Safari's password auto-fill. This
issue was addressed through improved matching of form fields.
CVE-2016-4595 : Jonathan Lewis from DeARX Services (PTY) LTD
Sandbox Profiles
Available for: OS X El Capitan v10.11 and later
Impact: A local application may be able to access the process list
Description: An access issue existed with privileged API calls. This
issue was addressed through additional restrictions.
CVE-2016-4594 : Stefan Esser of SektionEins
Note: OS X El Capitan 10.11.6 includes the security content of Safari
9.1.2. For further details see https://support.apple.com/kb/HT206900
OS X El Capitan v10.11.6 and Security Update 2016-004 may be obtained
from the Mac App Store or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJXjXAvAAoJEIOj74w0bLRG/5EP/2v9SJTrO+/4b3A1gqC1ch8y
+cJ04tXRsO7rvjKT5nCylo30U0Sanz/bUbDx4559YS7/P/IyeyZVheaTJwK8wzEy
pSOPpy35hUuVIw0/p4YsuHDThSBPFMmDljTxH7elkfuBV1lPSrCkyDXc0re2HxWV
xj68zAxtM0jkkhgcxb2ApZSZVXhrjUZtbY0xEVOoWKKFwbMvKfx+4xSqunwQeS1u
wevs1EbxfvsZbc3pG+xYcOonbegBzOy9aCvNO1Yv1zG+AYXC5ERMq1vk3PsWOTQN
ZVY1I7mvCaEfvmjq2isRw8XYapAIKISDLwMKBSYrZDQFwPQLRi1VXxQZ67Kq1M3k
ah04/lr0RIcoosIcBqxD2+1UAFjUzEUNFkYivjhuaeegN2QdL7Ujegf1QjdAt8lk
mmKduxYUDOaRX50Kw7n14ZveJqzE1D5I6QSItaZ9M1vR60a7u91DSj9D87vbt1YC
JM/Rvf/4vonp1NjwA2JQwCiZfYliBDdn9iiCl8mzxdsSRD/wXcZCs05nnKmKsCfc
55ET7IwdG3622lVheOJGQZuucwJiTn36zC11XVzZysQd/hLD5rUKUQNX1WOgZdzs
xPsslXF5MWx9jcdyWVSWxDrN0sFk+GpQFQDuVozP60xuxqR3qQ0TXir2NP39uIF5
YozOGPQFmX0OviWCQsX6
=ng+m
-----END PGP SIGNATURE-----
.
Resolution
==========
All Binary diff users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-util/bsdiff-4.3-r4"
References
==========
[ 1 ] CVE-2014-9862
https://nvd.nist.gov/vuln/detail/CVE-2014-9862
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202003-44
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2020 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
| VAR-201607-0376 | CVE-2016-4639 | Apple OS X Service operation in the login window (DoS) Vulnerabilities |
CVSS V2: 4.4 CVSS V3: 7.0 Severity: HIGH |
Login Window in Apple OS X before 10.11.6 does not properly initialize memory, which allows local users to cause a denial of service via unspecified vectors. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within CoreGraphics. By interacting with PKGTransactionWillSwitchSpaces, an attacker can cause a memory corruption condition. An attacker could leverage this vulnerability to execute arbitrary code under the context of the WindowServer. Apple Mac OS X is prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable. Login Window is one of the login window components
| VAR-201607-0378 | CVE-2016-4641 | Apple OS X Login window arbitrary code execution vulnerability in privileged context |
CVSS V2: 9.3 CVSS V3: 7.3 Severity: HIGH |
Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a "type confusion.". User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within CoreGraphics. By interacting with _XSetDictionaryForCurrentSession, an attacker can cause a type confusion condition. An attacker could leverage this vulnerability to execute arbitrary code under the context of the WindowServer. Apple Mac OS X is prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable. Login Window is one of the login window components
| VAR-201607-0372 | CVE-2016-4634 | Apple OS X Vulnerability in graphic drivers |
CVSS V2: 7.2 CVSS V3: 7.8 Severity: HIGH |
The Graphics Drivers subsystem in Apple OS X before 10.11.6 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors. Apple Mac OS X is prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable. Graphics Drivers is one of the graphics driver components
| VAR-201607-0375 | CVE-2016-4638 | Apple OS X Vulnerabilities in which the login window of Windows can gain privileges |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: MEDIUM |
Login Window in Apple OS X before 10.11.6 allows attackers to gain privileges via a crafted app that leverages a "type confusion.". By interacting with _XSetApplicationBindingsForWorkspaces, an attacker can cause a type confusion condition. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the CoreGraphics module. The issue lies in the failure to properly validate user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges under the context of WindowServer. Apple Mac OS X is prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable. Login Window is one of the login window components
| VAR-201607-0377 | CVE-2016-4640 | Apple OS X Login window arbitrary code execution vulnerability in privileged context |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: MEDIUM |
Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context, obtain sensitive user information, or cause a denial of service (memory corruption) via a crafted app. The issue lies in the failure to properly validate user-supplied data which can result in a memory corruption condition. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within CoreGraphics. By interacting with _XRegisterCursorWithData, an attacker can cause a heap buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code under the context of the WindowServer. Apple Mac OS X is prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable. Login Window is one of the login window components
| VAR-201607-0371 | CVE-2016-4633 | Apple OS X of Intel Graphics Driver Vulnerable to arbitrary code execution in a privileged context |
CVSS V2: 6.9 CVSS V3: 7.8 Severity: HIGH |
Intel Graphics Driver in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of the AppleIntelBDWGraphics kernel extension. The issue lies in the failure to properly check user-supplied arguments during an IOKit call. An attacker can leverage this vulnerability to execute code within the context of the kernel. Apple Mac OS X is prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable. Intel Graphics Driver is one of the graphics driver components
| VAR-201607-0368 | CVE-2016-4630 | Apple OS X of ImageIO Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted EXR image with B44 compression. Apple Mac OS X is prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable. ImageIO is one of the static methods used to perform common image I/O operations
| VAR-201607-0367 | CVE-2016-4629 | Apple OS X of ImageIO Vulnerable to arbitrary code execution |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
ImageIO in Apple OS X before 10.11.6 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted xStride and yStride values in an EXR image. Apple Mac OS X is prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable. ImageIO is one of the static methods used to perform common image I/O operations
| VAR-201607-0370 | CVE-2016-4632 | plural Apple Product ImageIO Service disruption in (DoS) Vulnerabilities |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors. plural Apple Product ImageIO There is a service disruption ( Memory consumption ) There are vulnerabilities that are put into a state.Service disruption by a third party ( Memory consumption ) There is a possibility of being put into a state. Apple Mac OS X, watchOS, iOS, and tvOS are prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code or bypass security restrictions. Failed exploit attempts may result in a denial-of-service condition.
Versions prior to iOS 9.3.3, watchOS 2.2.2, OS X 10.11.6, and tvOS 9.2.2 are vulnerable. in the United States. Apple iOS is an operating system developed for mobile devices; OS X is a dedicated operating system developed for Mac computers; watchOS is a smart watch operating system. ImageIO is one of the static methods used to perform common image I/O operations. A security vulnerability exists in ImageIO in several Apple products. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2016-07-18-3 watchOS 2.2.2
watchOS 2.2.2 is now available and addresses the following:
CoreGraphics
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to execute arbitrary code
Description: A memory corruption issue was addressed through
improved memory handling.
CVE-2016-4637 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4631 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2016-4632 : Evgeny Sidorov of Yandex
IOAcceleratorFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved validation.
CVE-2016-4627 : Ju Zhu of Trend Micro
IOAcceleratorFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2016-4628 : Ju Zhu of Trend Micro
IOHIDFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-4626 : Stefan Esser of SektionEins
Kernel
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to cause a system denial of service
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-1865 : CESG, Marco Grassi (@marcograss) of KeenLab
(@keen_lab), Tencent
Kernel
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1863 : Ian Beer of Google Project Zero
CVE-2016-1864 : Ju Zhu of Trend Micro
CVE-2016-4582 : Shrek_wzw and Proteas of Qihoo 360 Nirvan Team
libxml2
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Multiple vulnerabilities in libxml2
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4447 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4448 : Apple
CVE-2016-4483 : Gustavo Grieco
CVE-2016-4614 : Nick Wellnhofe
CVE-2016-4615 : Nick Wellnhofer
CVE-2016-4616 : Michael Paddon
CVE-2016-4619 : Hanno Boeck
libxml2
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Parsing a maliciously crafted XML document may lead to
disclosure of user information
Description: An access issue existed in the parsing of maliciously
crafted XML files. This issue was addressed through improved input
validation.
CVE-2016-4449 : Kostya Serebryany
libxslt
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Multiple vulnerabilities in libxslt
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1684 : Nicolas GrA(c)goire
CVE-2016-4607 : Nick Wellnhofer
CVE-2016-4608 : Nicolas GrA(c)goire
CVE-2016-4609 : Nick Wellnhofer
CVE-2016-4610 : Nick Wellnhofer
CVE-2016-4612 : Nicolas GrA(c)goire
Sandbox Profiles
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local application may be able to access the process list
Description: An access issue existed with privileged API calls. This
issue was addressed through additional restrictions.
CVE-2016-4594 : Stefan Esser of SektionEins
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/en-us/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJXjXA7AAoJEIOj74w0bLRGEXgP+weQFMlAuBOyZg11jFauawDt
r+LmaHifpMysV13r6cLkKP6cVqV4G6EEOGp9hSqC2lsHKQYDN5vdyLwLl5sE3kSg
PyQgp5iE3Eihe9ArswPbsrm/c1aIMZbKNnAVQkHOQX7STTmYDfp5ATxxFp7yueld
0QVCEbr4QCpqpQCJhqRO7RHWnlOCmTKdYxsD6rYqOEALnZzfB9A5bZPyeM1LNnJL
ntom0d1GzuBjowrEIFPyZBE+oZP1wEfUBsYnr5sD5jkAHphMCyI0/MPAwH3181aZ
T9jHgJMc/0xlitBHwCT7nv7AE3YpxPYpM8lM1a+cLOfHNaUiX7bfX2w+6PVEDFiP
5X0raq+QYnqKdNXanG2nMhQjIYJEIWbOBKanM7hMWM6C2kd4YAc4eLACX3vObWNS
m1Fbj1/Qxqtng0sqw66HhyFEcz9Cqgg7UX2MEmxVV86Oxqcb2PW5XrwUZ9PtgByP
ks8UNaOXYKaRo+OIhaAPn1qfSSlhp086LfGPuCm5lP0c5hZ9TfyErWPG+1nhD6Vd
l48RQOYcAAE//wMLuSf38CbvS0RVcfzKA6DfUAlEAv0Aw4GOZRNCmtLVZo2QS8kc
nUItEluM+03NkqrGROZiyoC+FIrXunr47JzdP5kawB6C1zsJrP2vFr1au9gbwUZ3
nb7PSAEOmpjCwkMbzdvm
=l25N
-----END PGP SIGNATURE-----
| VAR-201607-0374 | CVE-2016-4637 | plural Apple Product CoreGraphics Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
CoreGraphics in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted BMP image. Apple Mac OS X, watchOS, iOS, and tvOS are prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code or bypass security restrictions. Failed exploit attempts may result in a denial-of-service condition.
Versions prior to iOS 9.3.3, watchOS 2.2.2, OS X 10.11.6, and tvOS 9.2.2 are vulnerable. Apple iOS is an operating system developed for mobile devices; OS X is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system; watchOS is a smart watch operating system. CoreGraphics is an iOS built-in drawing framework. A security vulnerability exists in CoreGraphics in several Apple products. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2016-07-18-3 watchOS 2.2.2
watchOS 2.2.2 is now available and addresses the following:
CoreGraphics
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to execute arbitrary code
Description: A memory corruption issue was addressed through
improved memory handling.
CVE-2016-4637 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4631 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2016-4632 : Evgeny Sidorov of Yandex
IOAcceleratorFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved validation.
CVE-2016-4627 : Ju Zhu of Trend Micro
IOAcceleratorFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2016-4628 : Ju Zhu of Trend Micro
IOHIDFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-4626 : Stefan Esser of SektionEins
Kernel
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to cause a system denial of service
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-1865 : CESG, Marco Grassi (@marcograss) of KeenLab
(@keen_lab), Tencent
Kernel
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1863 : Ian Beer of Google Project Zero
CVE-2016-1864 : Ju Zhu of Trend Micro
CVE-2016-4582 : Shrek_wzw and Proteas of Qihoo 360 Nirvan Team
libxml2
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Multiple vulnerabilities in libxml2
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4447 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4448 : Apple
CVE-2016-4483 : Gustavo Grieco
CVE-2016-4614 : Nick Wellnhofe
CVE-2016-4615 : Nick Wellnhofer
CVE-2016-4616 : Michael Paddon
CVE-2016-4619 : Hanno Boeck
libxml2
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Parsing a maliciously crafted XML document may lead to
disclosure of user information
Description: An access issue existed in the parsing of maliciously
crafted XML files. This issue was addressed through improved input
validation.
CVE-2016-4449 : Kostya Serebryany
libxslt
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Multiple vulnerabilities in libxslt
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1684 : Nicolas GrA(c)goire
CVE-2016-4607 : Nick Wellnhofer
CVE-2016-4608 : Nicolas GrA(c)goire
CVE-2016-4609 : Nick Wellnhofer
CVE-2016-4610 : Nick Wellnhofer
CVE-2016-4612 : Nicolas GrA(c)goire
Sandbox Profiles
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local application may be able to access the process list
Description: An access issue existed with privileged API calls. This
issue was addressed through additional restrictions.
CVE-2016-4594 : Stefan Esser of SektionEins
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/en-us/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJXjXA7AAoJEIOj74w0bLRGEXgP+weQFMlAuBOyZg11jFauawDt
r+LmaHifpMysV13r6cLkKP6cVqV4G6EEOGp9hSqC2lsHKQYDN5vdyLwLl5sE3kSg
PyQgp5iE3Eihe9ArswPbsrm/c1aIMZbKNnAVQkHOQX7STTmYDfp5ATxxFp7yueld
0QVCEbr4QCpqpQCJhqRO7RHWnlOCmTKdYxsD6rYqOEALnZzfB9A5bZPyeM1LNnJL
ntom0d1GzuBjowrEIFPyZBE+oZP1wEfUBsYnr5sD5jkAHphMCyI0/MPAwH3181aZ
T9jHgJMc/0xlitBHwCT7nv7AE3YpxPYpM8lM1a+cLOfHNaUiX7bfX2w+6PVEDFiP
5X0raq+QYnqKdNXanG2nMhQjIYJEIWbOBKanM7hMWM6C2kd4YAc4eLACX3vObWNS
m1Fbj1/Qxqtng0sqw66HhyFEcz9Cqgg7UX2MEmxVV86Oxqcb2PW5XrwUZ9PtgByP
ks8UNaOXYKaRo+OIhaAPn1qfSSlhp086LfGPuCm5lP0c5hZ9TfyErWPG+1nhD6Vd
l48RQOYcAAE//wMLuSf38CbvS0RVcfzKA6DfUAlEAv0Aw4GOZRNCmtLVZo2QS8kc
nUItEluM+03NkqrGROZiyoC+FIrXunr47JzdP5kawB6C1zsJrP2vFr1au9gbwUZ3
nb7PSAEOmpjCwkMbzdvm
=l25N
-----END PGP SIGNATURE-----
| VAR-201607-0363 | CVE-2016-4625 | Apple OS X of IOSurface Vulnerability gained in |
CVSS V2: 7.2 CVSS V3: 7.8 Severity: HIGH |
Use-after-free vulnerability in IOSurface in Apple OS X before 10.11.6 allows local users to gain privileges via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-416: Use After Free ( Use of freed memory ) Has been identified. http://cwe.mitre.org/data/definitions/416.htmlAuthority may be obtained by local users.
Attackers can exploit these issues to execute arbitrary code, gain sensitive information, cause denial-of-service conditions, bypass security restrictions, and perform unauthorized actions. This may aid in other attacks.
Apple Mac OS X 10.9.5, 10.10.5 and 10.11 through 10.11.5 are vulnerable
| VAR-201607-0369 | CVE-2016-4631 | plural Apple Product ImageIO Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
ImageIO in Apple iOS before 9.3.3, OS X before 10.11.6, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF file. Apple Mac OS X, watchOS, iOS, and tvOS are prone to multiple security vulnerabilities.
Attackers can exploit these issues to execute arbitrary code or bypass security restrictions. Failed exploit attempts may result in a denial-of-service condition.
Versions prior to iOS 9.3.3, watchOS 2.2.2, OS X 10.11.6, and tvOS 9.2.2 are vulnerable. Apple iOS is an operating system developed for mobile devices; OS X is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system; watchOS is a smart watch operating system. ImageIO is one of the static methods used to perform common image I/O operations. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2016-07-18-3 watchOS 2.2.2
watchOS 2.2.2 is now available and addresses the following:
CoreGraphics
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to execute arbitrary code
Description: A memory corruption issue was addressed through
improved memory handling.
CVE-2016-4637 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4631 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2016-4632 : Evgeny Sidorov of Yandex
IOAcceleratorFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved validation.
CVE-2016-4627 : Ju Zhu of Trend Micro
IOAcceleratorFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2016-4628 : Ju Zhu of Trend Micro
IOHIDFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-4626 : Stefan Esser of SektionEins
Kernel
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to cause a system denial of service
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-1865 : CESG, Marco Grassi (@marcograss) of KeenLab
(@keen_lab), Tencent
Kernel
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1863 : Ian Beer of Google Project Zero
CVE-2016-1864 : Ju Zhu of Trend Micro
CVE-2016-4582 : Shrek_wzw and Proteas of Qihoo 360 Nirvan Team
libxml2
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Multiple vulnerabilities in libxml2
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4447 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4448 : Apple
CVE-2016-4483 : Gustavo Grieco
CVE-2016-4614 : Nick Wellnhofe
CVE-2016-4615 : Nick Wellnhofer
CVE-2016-4616 : Michael Paddon
CVE-2016-4619 : Hanno Boeck
libxml2
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Parsing a maliciously crafted XML document may lead to
disclosure of user information
Description: An access issue existed in the parsing of maliciously
crafted XML files. This issue was addressed through improved input
validation.
CVE-2016-4449 : Kostya Serebryany
libxslt
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Multiple vulnerabilities in libxslt
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1684 : Nicolas GrA(c)goire
CVE-2016-4607 : Nick Wellnhofer
CVE-2016-4608 : Nicolas GrA(c)goire
CVE-2016-4609 : Nick Wellnhofer
CVE-2016-4610 : Nick Wellnhofer
CVE-2016-4612 : Nicolas GrA(c)goire
Sandbox Profiles
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local application may be able to access the process list
Description: An access issue existed with privileged API calls. This
issue was addressed through additional restrictions.
CVE-2016-4594 : Stefan Esser of SektionEins
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/en-us/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJXjXA7AAoJEIOj74w0bLRGEXgP+weQFMlAuBOyZg11jFauawDt
r+LmaHifpMysV13r6cLkKP6cVqV4G6EEOGp9hSqC2lsHKQYDN5vdyLwLl5sE3kSg
PyQgp5iE3Eihe9ArswPbsrm/c1aIMZbKNnAVQkHOQX7STTmYDfp5ATxxFp7yueld
0QVCEbr4QCpqpQCJhqRO7RHWnlOCmTKdYxsD6rYqOEALnZzfB9A5bZPyeM1LNnJL
ntom0d1GzuBjowrEIFPyZBE+oZP1wEfUBsYnr5sD5jkAHphMCyI0/MPAwH3181aZ
T9jHgJMc/0xlitBHwCT7nv7AE3YpxPYpM8lM1a+cLOfHNaUiX7bfX2w+6PVEDFiP
5X0raq+QYnqKdNXanG2nMhQjIYJEIWbOBKanM7hMWM6C2kd4YAc4eLACX3vObWNS
m1Fbj1/Qxqtng0sqw66HhyFEcz9Cqgg7UX2MEmxVV86Oxqcb2PW5XrwUZ9PtgByP
ks8UNaOXYKaRo+OIhaAPn1qfSSlhp086LfGPuCm5lP0c5hZ9TfyErWPG+1nhD6Vd
l48RQOYcAAE//wMLuSf38CbvS0RVcfzKA6DfUAlEAv0Aw4GOZRNCmtLVZo2QS8kc
nUItEluM+03NkqrGROZiyoC+FIrXunr47JzdP5kawB6C1zsJrP2vFr1au9gbwUZ3
nb7PSAEOmpjCwkMbzdvm
=l25N
-----END PGP SIGNATURE-----
| VAR-201607-0366 | CVE-2016-4628 | Apple iOS and watchOS of IOAcceleratorFamily Vulnerabilities in which important information is obtained from kernel memory |
CVSS V2: 4.9 CVSS V3: 5.5 Severity: MEDIUM |
IOAcceleratorFamily in Apple iOS before 9.3.3 and watchOS before 2.2.2 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-125: Out-of-bounds Read ( Read out of bounds ) Has been identified. Apple iOS and watchOS are prone to a local information-disclosure vulnerability.
Local attackers can exploit this issue to gain access to sensitive information. Apple iOS is an operating system developed for mobile devices; Apple watchOS is an operating system for smart watches. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2016-07-18-3 watchOS 2.2.2
watchOS 2.2.2 is now available and addresses the following:
CoreGraphics
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to execute arbitrary code
Description: A memory corruption issue was addressed through
improved memory handling.
CVE-2016-4637 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to execute arbitrary code
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-4631 : Tyler Bohan of Cisco Talos (talosintel.com
/vulnerability-reports)
ImageIO
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A remote attacker may be able to cause a denial of service
Description: A memory consumption issue was addressed through
improved memory handling.
CVE-2016-4632 : Evgeny Sidorov of Yandex
IOAcceleratorFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved validation.
CVE-2016-4627 : Ju Zhu of Trend Micro
IOAcceleratorFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read was addressed through improved
bounds checking.
CVE-2016-4628 : Ju Zhu of Trend Micro
IOHIDFamily
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-4626 : Stefan Esser of SektionEins
Kernel
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to cause a system denial of service
Description: A null pointer dereference was addressed through
improved input validation.
CVE-2016-1865 : CESG, Marco Grassi (@marcograss) of KeenLab
(@keen_lab), Tencent
Kernel
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local user may be able to execute arbitrary code with
kernel privileges
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1863 : Ian Beer of Google Project Zero
CVE-2016-1864 : Ju Zhu of Trend Micro
CVE-2016-4582 : Shrek_wzw and Proteas of Qihoo 360 Nirvan Team
libxml2
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Multiple vulnerabilities in libxml2
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1836 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4447 : Wei Lei and Liu Yang of Nanyang Technological
University
CVE-2016-4448 : Apple
CVE-2016-4483 : Gustavo Grieco
CVE-2016-4614 : Nick Wellnhofe
CVE-2016-4615 : Nick Wellnhofer
CVE-2016-4616 : Michael Paddon
CVE-2016-4619 : Hanno Boeck
libxml2
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Parsing a maliciously crafted XML document may lead to
disclosure of user information
Description: An access issue existed in the parsing of maliciously
crafted XML files. This issue was addressed through improved input
validation.
CVE-2016-4449 : Kostya Serebryany
libxslt
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: Multiple vulnerabilities in libxslt
Description: Multiple memory corruption issues were addressed
through improved memory handling.
CVE-2016-1684 : Nicolas GrA(c)goire
CVE-2016-4607 : Nick Wellnhofer
CVE-2016-4608 : Nicolas GrA(c)goire
CVE-2016-4609 : Nick Wellnhofer
CVE-2016-4610 : Nick Wellnhofer
CVE-2016-4612 : Nicolas GrA(c)goire
Sandbox Profiles
Available for: Apple Watch Sport, Apple Watch, Apple Watch Edition,
and Apple Watch Hermes
Impact: A local application may be able to access the process list
Description: An access issue existed with privileged API calls. This
issue was addressed through additional restrictions.
CVE-2016-4594 : Stefan Esser of SektionEins
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/en-us/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQIcBAEBCgAGBQJXjXA7AAoJEIOj74w0bLRGEXgP+weQFMlAuBOyZg11jFauawDt
r+LmaHifpMysV13r6cLkKP6cVqV4G6EEOGp9hSqC2lsHKQYDN5vdyLwLl5sE3kSg
PyQgp5iE3Eihe9ArswPbsrm/c1aIMZbKNnAVQkHOQX7STTmYDfp5ATxxFp7yueld
0QVCEbr4QCpqpQCJhqRO7RHWnlOCmTKdYxsD6rYqOEALnZzfB9A5bZPyeM1LNnJL
ntom0d1GzuBjowrEIFPyZBE+oZP1wEfUBsYnr5sD5jkAHphMCyI0/MPAwH3181aZ
T9jHgJMc/0xlitBHwCT7nv7AE3YpxPYpM8lM1a+cLOfHNaUiX7bfX2w+6PVEDFiP
5X0raq+QYnqKdNXanG2nMhQjIYJEIWbOBKanM7hMWM6C2kd4YAc4eLACX3vObWNS
m1Fbj1/Qxqtng0sqw66HhyFEcz9Cqgg7UX2MEmxVV86Oxqcb2PW5XrwUZ9PtgByP
ks8UNaOXYKaRo+OIhaAPn1qfSSlhp086LfGPuCm5lP0c5hZ9TfyErWPG+1nhD6Vd
l48RQOYcAAE//wMLuSf38CbvS0RVcfzKA6DfUAlEAv0Aw4GOZRNCmtLVZo2QS8kc
nUItEluM+03NkqrGROZiyoC+FIrXunr47JzdP5kawB6C1zsJrP2vFr1au9gbwUZ3
nb7PSAEOmpjCwkMbzdvm
=l25N
-----END PGP SIGNATURE-----