VARIoT IoT vulnerabilities database

Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbitrary web script or HTML via the display name in the FROM field of an SIP INVITE message. AVM FRITZ!OS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. Versions prior to AVM FRITZ!OS 6.30 are vulnerable

dcoep in BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AAM 11.4.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP AFM and PEM 11.3.0 through 11.6.0 and 12.0.0 before 12.0.0 HF1, BIG-IP DNS 12.0.0 before 12.0.0 HF1, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.2.0 through 11.3.0, BIG-IP GTM 11.2.0 through 11.6.0, BIG-IP PSM 11.2.0 through 11.4.1, Enterprise Manager 3.0.0 through 3.1.1, BIG-IQ Cloud 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, BIG-IQ Security 4.0.0 through 4.5.0, BIG-IQ ADC 4.5.0, BIG-IQ Centralized Management 4.6.0, and BIG-IQ Cloud and Orchestration 1.0.0 allows local users with advanced shell (bash) access to gain privileges via unspecified vectors. plural F5 Product dcoep Contains a privileged vulnerability.Advanced Shell (bash) The privilege may be obtained by a local user with access rights. F5BIG-IP is a device product for application delivery services manufactured by F5Network, which is mainly used for load balancing, business acceleration optimization and other purposes. A security vulnerability exists in the dcoep of several F5BIG-IP products, which can be exploited by local attackers to gain access to \342\200\230advancedshell(bash)\342\200\231 access. Multiple F5 BIG-IP products are prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. F5 BIG-IP LTM, etc. LTM is a local traffic manager; APM is a solution that provides secure unified access to business-critical applications and networks. 0 to 11.4.1, WebAccelerator and WOM 11.2.0 to 11.3.0, Enterprise Manager 3.0.0 to 3.1.1, BIG-IQ Cloud, Security 4.0.0 to 4.5.0, Device Version 4.2.0 to 4.5.0, ADC version 4.5.0, Centralized Management version 4.6.0, Cloud and Orchestration version 1.0.0

BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, and PEM 12.0.0 before HF1, when the TCP profile for a virtual server is configured with Congestion Metrics Cache enabled, allow remote attackers to cause a denial of service (Traffic Management Microkernel (TMM) restart) via crafted ICMP packets, related to Path MTU (PMTU) discovery. F5BIG-IP is a device product for application delivery services manufactured by F5Network, which is mainly used for load balancing, business acceleration optimization and other purposes. A number of F5BIG-IP products have security vulnerabilities. Multiple F5 BIG-IP products are prone to a denial-of-service vulnerability. Attackers can exploit this issue to cause a denial-of-service condition. F5 BIG-IP LTM, etc. are all products of F5 Company in the United States. LTM is a local traffic manager; APM is a solution that provides secure unified access to business-critical applications and networks. The following products and versions are affected: F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, Link Controller, PEM version 12.0.0

F5 BIG-IP APM 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 allow remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile, aka an "Out-of-bounds memory vulnerability.". F5 BIG-IP APM There is a service disruption (DoS) Vulnerabilities exist that could be put into a state or execute arbitrary code. F5 BIG-IP APM is prone to a memory-corruption vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in a denial-of-service condition. F5 BIG-IP Access Policy Manager (APM) is a set of access and security solutions from F5 Corporation of the United States. The solution provides unified access to business-critical applications and networks. The following versions are affected: F5 BIG-IP APM 11.4.1 prior to HF9, 11.4.1 prior to 11.5.3, 11.6.0 prior to 11.6.0 HF4

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, and CVE-2015-7092. Apple QuickTime is prone to multiple memory-corruption vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial of service conditions. Versions prior to Apple QuickTime 7.7.9 are vulnerable. The software is capable of handling multiple sources such as digital video, media segments, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in QuickTime. These issues were addressed through improved memory handling. CVE-ID CVE-2015-7085 : an anonymous researcher CVE-2015-7086 : an anonymous researcher CVE-2015-7087 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7088 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7089 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7090 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7091 : Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security CVE-2015-7092 : Jaanus Kp Clarified Security working with HP's Zero Day Initiative CVE-2015-7117 : Ryan Pentney and Richard Johnson of Cisco Talos -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWjxMiAAoJEBcWfLTuOo7t16wP/RNhjITSBZmBDZP61IOjKARD 5v69y+LkXLDNPlUkpB15Qjq3HDvZnFDwl3RSlZgAlQDO/GSqqWBnhsAEdO+5AAR1 LZqlVdERGHeeyfpuQ85waxf18O1dbg+R6SwM74SYRBXPujGQk9yT326I0X/EdXON 8upmGfzv8HvPsg712ei5YK8bumxsCh/LqM6TpA6oMF/bltaIbZ/OO3LNovZn9GQc 9taWVwP707FIjnJ7yKHzHnp6fH+79tqi5Dl0uZ7D446c7+B5ehPE7aUd29XqFrpE tgJzSDu2ZuVIz9RpC8Np+Bn8CSKqD6Kao7M5x4CVLWmpIYUpGKTIItUhvtXJ1jFY CyXXgse54w2ZG6hWE2gTmIvyn4/qVaSi8vlguEuk6IvA6kZeLdrc097OMPMPHlN/ I8T2A04Oj6rUsllf2uZih42nwve6CYpC9mh9/HLz0O+m0ue/L9HwIoto87OCmfi3 2RwyAoBLjMZUoOMLr9DjlQglQnTnNY8LjjZKRr9ug5V/tN8F051NeILDDj2vSf0q PI5JHoBD2LnJcxU+XI1JM/9amCYwBHjd94fcSp7H9BkdIzYshW4Deooc58EnjxVv 5hlwMIqqk2m911TsOjNpkVuysABoIB8hX3el3py4V+3sLoM5cVYa+FNS7+FGzG47 UJ/4c68fdMRAbGx4KfoW =ERtQ -----END PGP SIGNATURE-----

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted TXXX frame within an ID3 tag in MP3 data in a movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, and CVE-2015-7117. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of ID3 version tags in MP3 files. By providing a malformed TXXX frame, an attacker can cause data to be written past the end of an allocated heap buffer. An attacker could leverage this to execute arbitrary code under the context of the current user. Failed exploit attempts will likely result in denial of service conditions. Versions prior to QuickTime 7.7.9 are vulnerable. NOTE: This issue was previously discussed in BID 80020 (Apple QuickTime APPLE-SA-2016-01-07-1 Multiple Memory Corruption Vulnerabilities), but has been given its own record to better document it. Apple QuickTime is a multimedia playback software developed by Apple (Apple). The software is capable of handling multiple sources such as digital video, media segments, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in QuickTime. These issues were addressed through improved memory handling. CVE-ID CVE-2015-7085 : an anonymous researcher CVE-2015-7086 : an anonymous researcher CVE-2015-7087 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7088 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7089 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7090 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7091 : Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security CVE-2015-7092 : Jaanus Kp Clarified Security working with HP's Zero Day Initiative CVE-2015-7117 : Ryan Pentney and Richard Johnson of Cisco Talos -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWjxMiAAoJEBcWfLTuOo7t16wP/RNhjITSBZmBDZP61IOjKARD 5v69y+LkXLDNPlUkpB15Qjq3HDvZnFDwl3RSlZgAlQDO/GSqqWBnhsAEdO+5AAR1 LZqlVdERGHeeyfpuQ85waxf18O1dbg+R6SwM74SYRBXPujGQk9yT326I0X/EdXON 8upmGfzv8HvPsg712ei5YK8bumxsCh/LqM6TpA6oMF/bltaIbZ/OO3LNovZn9GQc 9taWVwP707FIjnJ7yKHzHnp6fH+79tqi5Dl0uZ7D446c7+B5ehPE7aUd29XqFrpE tgJzSDu2ZuVIz9RpC8Np+Bn8CSKqD6Kao7M5x4CVLWmpIYUpGKTIItUhvtXJ1jFY CyXXgse54w2ZG6hWE2gTmIvyn4/qVaSi8vlguEuk6IvA6kZeLdrc097OMPMPHlN/ I8T2A04Oj6rUsllf2uZih42nwve6CYpC9mh9/HLz0O+m0ue/L9HwIoto87OCmfi3 2RwyAoBLjMZUoOMLr9DjlQglQnTnNY8LjjZKRr9ug5V/tN8F051NeILDDj2vSf0q PI5JHoBD2LnJcxU+XI1JM/9amCYwBHjd94fcSp7H9BkdIzYshW4Deooc58EnjxVv 5hlwMIqqk2m911TsOjNpkVuysABoIB8hX3el3py4V+3sLoM5cVYa+FNS7+FGzG47 UJ/4c68fdMRAbGx4KfoW =ERtQ -----END PGP SIGNATURE-----

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7092, and CVE-2015-7117. Apple QuickTime is prone to multiple memory-corruption vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial of service conditions. Versions prior to Apple QuickTime 7.7.9 are vulnerable. The software is capable of handling multiple sources such as digital video, media segments, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in QuickTime. These issues were addressed through improved memory handling. CVE-ID CVE-2015-7085 : an anonymous researcher CVE-2015-7086 : an anonymous researcher CVE-2015-7087 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7088 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7089 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7090 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7091 : Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security CVE-2015-7092 : Jaanus Kp Clarified Security working with HP's Zero Day Initiative CVE-2015-7117 : Ryan Pentney and Richard Johnson of Cisco Talos -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWjxMiAAoJEBcWfLTuOo7t16wP/RNhjITSBZmBDZP61IOjKARD 5v69y+LkXLDNPlUkpB15Qjq3HDvZnFDwl3RSlZgAlQDO/GSqqWBnhsAEdO+5AAR1 LZqlVdERGHeeyfpuQ85waxf18O1dbg+R6SwM74SYRBXPujGQk9yT326I0X/EdXON 8upmGfzv8HvPsg712ei5YK8bumxsCh/LqM6TpA6oMF/bltaIbZ/OO3LNovZn9GQc 9taWVwP707FIjnJ7yKHzHnp6fH+79tqi5Dl0uZ7D446c7+B5ehPE7aUd29XqFrpE tgJzSDu2ZuVIz9RpC8Np+Bn8CSKqD6Kao7M5x4CVLWmpIYUpGKTIItUhvtXJ1jFY CyXXgse54w2ZG6hWE2gTmIvyn4/qVaSi8vlguEuk6IvA6kZeLdrc097OMPMPHlN/ I8T2A04Oj6rUsllf2uZih42nwve6CYpC9mh9/HLz0O+m0ue/L9HwIoto87OCmfi3 2RwyAoBLjMZUoOMLr9DjlQglQnTnNY8LjjZKRr9ug5V/tN8F051NeILDDj2vSf0q PI5JHoBD2LnJcxU+XI1JM/9amCYwBHjd94fcSp7H9BkdIzYshW4Deooc58EnjxVv 5hlwMIqqk2m911TsOjNpkVuysABoIB8hX3el3py4V+3sLoM5cVYa+FNS7+FGzG47 UJ/4c68fdMRAbGx4KfoW =ERtQ -----END PGP SIGNATURE-----

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117. Apple QuickTime is prone to multiple memory-corruption vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial of service conditions. Versions prior to Apple QuickTime 7.7.9 are vulnerable. The software is capable of handling multiple sources such as digital video, media segments, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in QuickTime. These issues were addressed through improved memory handling. CVE-ID CVE-2015-7085 : an anonymous researcher CVE-2015-7086 : an anonymous researcher CVE-2015-7087 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7088 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7089 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7090 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7091 : Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security CVE-2015-7092 : Jaanus Kp Clarified Security working with HP's Zero Day Initiative CVE-2015-7117 : Ryan Pentney and Richard Johnson of Cisco Talos -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWjxMiAAoJEBcWfLTuOo7t16wP/RNhjITSBZmBDZP61IOjKARD 5v69y+LkXLDNPlUkpB15Qjq3HDvZnFDwl3RSlZgAlQDO/GSqqWBnhsAEdO+5AAR1 LZqlVdERGHeeyfpuQ85waxf18O1dbg+R6SwM74SYRBXPujGQk9yT326I0X/EdXON 8upmGfzv8HvPsg712ei5YK8bumxsCh/LqM6TpA6oMF/bltaIbZ/OO3LNovZn9GQc 9taWVwP707FIjnJ7yKHzHnp6fH+79tqi5Dl0uZ7D446c7+B5ehPE7aUd29XqFrpE tgJzSDu2ZuVIz9RpC8Np+Bn8CSKqD6Kao7M5x4CVLWmpIYUpGKTIItUhvtXJ1jFY CyXXgse54w2ZG6hWE2gTmIvyn4/qVaSi8vlguEuk6IvA6kZeLdrc097OMPMPHlN/ I8T2A04Oj6rUsllf2uZih42nwve6CYpC9mh9/HLz0O+m0ue/L9HwIoto87OCmfi3 2RwyAoBLjMZUoOMLr9DjlQglQnTnNY8LjjZKRr9ug5V/tN8F051NeILDDj2vSf0q PI5JHoBD2LnJcxU+XI1JM/9amCYwBHjd94fcSp7H9BkdIzYshW4Deooc58EnjxVv 5hlwMIqqk2m911TsOjNpkVuysABoIB8hX3el3py4V+3sLoM5cVYa+FNS7+FGzG47 UJ/4c68fdMRAbGx4KfoW =ERtQ -----END PGP SIGNATURE-----

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117. Apple QuickTime is prone to multiple memory-corruption vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial of service conditions. Versions prior to Apple QuickTime 7.7.9 are vulnerable. The software is capable of handling multiple sources such as digital video, media segments, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in QuickTime. These issues were addressed through improved memory handling. CVE-ID CVE-2015-7085 : an anonymous researcher CVE-2015-7086 : an anonymous researcher CVE-2015-7087 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7088 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7089 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7090 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7091 : Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security CVE-2015-7092 : Jaanus Kp Clarified Security working with HP's Zero Day Initiative CVE-2015-7117 : Ryan Pentney and Richard Johnson of Cisco Talos -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWjxMiAAoJEBcWfLTuOo7t16wP/RNhjITSBZmBDZP61IOjKARD 5v69y+LkXLDNPlUkpB15Qjq3HDvZnFDwl3RSlZgAlQDO/GSqqWBnhsAEdO+5AAR1 LZqlVdERGHeeyfpuQ85waxf18O1dbg+R6SwM74SYRBXPujGQk9yT326I0X/EdXON 8upmGfzv8HvPsg712ei5YK8bumxsCh/LqM6TpA6oMF/bltaIbZ/OO3LNovZn9GQc 9taWVwP707FIjnJ7yKHzHnp6fH+79tqi5Dl0uZ7D446c7+B5ehPE7aUd29XqFrpE tgJzSDu2ZuVIz9RpC8Np+Bn8CSKqD6Kao7M5x4CVLWmpIYUpGKTIItUhvtXJ1jFY CyXXgse54w2ZG6hWE2gTmIvyn4/qVaSi8vlguEuk6IvA6kZeLdrc097OMPMPHlN/ I8T2A04Oj6rUsllf2uZih42nwve6CYpC9mh9/HLz0O+m0ue/L9HwIoto87OCmfi3 2RwyAoBLjMZUoOMLr9DjlQglQnTnNY8LjjZKRr9ug5V/tN8F051NeILDDj2vSf0q PI5JHoBD2LnJcxU+XI1JM/9amCYwBHjd94fcSp7H9BkdIzYshW4Deooc58EnjxVv 5hlwMIqqk2m911TsOjNpkVuysABoIB8hX3el3py4V+3sLoM5cVYa+FNS7+FGzG47 UJ/4c68fdMRAbGx4KfoW =ERtQ -----END PGP SIGNATURE-----

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117. Apple QuickTime is prone to multiple memory-corruption vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial of service conditions. Versions prior to Apple QuickTime 7.7.9 are vulnerable. The software is capable of handling multiple sources such as digital video, media segments, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in QuickTime. These issues were addressed through improved memory handling. CVE-ID CVE-2015-7085 : an anonymous researcher CVE-2015-7086 : an anonymous researcher CVE-2015-7087 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7088 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7089 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7090 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7091 : Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security CVE-2015-7092 : Jaanus Kp Clarified Security working with HP's Zero Day Initiative CVE-2015-7117 : Ryan Pentney and Richard Johnson of Cisco Talos -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWjxMiAAoJEBcWfLTuOo7t16wP/RNhjITSBZmBDZP61IOjKARD 5v69y+LkXLDNPlUkpB15Qjq3HDvZnFDwl3RSlZgAlQDO/GSqqWBnhsAEdO+5AAR1 LZqlVdERGHeeyfpuQ85waxf18O1dbg+R6SwM74SYRBXPujGQk9yT326I0X/EdXON 8upmGfzv8HvPsg712ei5YK8bumxsCh/LqM6TpA6oMF/bltaIbZ/OO3LNovZn9GQc 9taWVwP707FIjnJ7yKHzHnp6fH+79tqi5Dl0uZ7D446c7+B5ehPE7aUd29XqFrpE tgJzSDu2ZuVIz9RpC8Np+Bn8CSKqD6Kao7M5x4CVLWmpIYUpGKTIItUhvtXJ1jFY CyXXgse54w2ZG6hWE2gTmIvyn4/qVaSi8vlguEuk6IvA6kZeLdrc097OMPMPHlN/ I8T2A04Oj6rUsllf2uZih42nwve6CYpC9mh9/HLz0O+m0ue/L9HwIoto87OCmfi3 2RwyAoBLjMZUoOMLr9DjlQglQnTnNY8LjjZKRr9ug5V/tN8F051NeILDDj2vSf0q PI5JHoBD2LnJcxU+XI1JM/9amCYwBHjd94fcSp7H9BkdIzYshW4Deooc58EnjxVv 5hlwMIqqk2m911TsOjNpkVuysABoIB8hX3el3py4V+3sLoM5cVYa+FNS7+FGzG47 UJ/4c68fdMRAbGx4KfoW =ERtQ -----END PGP SIGNATURE-----

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117. Apple QuickTime is prone to multiple memory-corruption vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial of service conditions. Versions prior to Apple QuickTime 7.7.9 are vulnerable. The software is capable of handling multiple sources such as digital video, media segments, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in QuickTime. These issues were addressed through improved memory handling. CVE-ID CVE-2015-7085 : an anonymous researcher CVE-2015-7086 : an anonymous researcher CVE-2015-7087 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7088 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7089 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7090 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7091 : Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security CVE-2015-7092 : Jaanus Kp Clarified Security working with HP's Zero Day Initiative CVE-2015-7117 : Ryan Pentney and Richard Johnson of Cisco Talos -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWjxMiAAoJEBcWfLTuOo7t16wP/RNhjITSBZmBDZP61IOjKARD 5v69y+LkXLDNPlUkpB15Qjq3HDvZnFDwl3RSlZgAlQDO/GSqqWBnhsAEdO+5AAR1 LZqlVdERGHeeyfpuQ85waxf18O1dbg+R6SwM74SYRBXPujGQk9yT326I0X/EdXON 8upmGfzv8HvPsg712ei5YK8bumxsCh/LqM6TpA6oMF/bltaIbZ/OO3LNovZn9GQc 9taWVwP707FIjnJ7yKHzHnp6fH+79tqi5Dl0uZ7D446c7+B5ehPE7aUd29XqFrpE tgJzSDu2ZuVIz9RpC8Np+Bn8CSKqD6Kao7M5x4CVLWmpIYUpGKTIItUhvtXJ1jFY CyXXgse54w2ZG6hWE2gTmIvyn4/qVaSi8vlguEuk6IvA6kZeLdrc097OMPMPHlN/ I8T2A04Oj6rUsllf2uZih42nwve6CYpC9mh9/HLz0O+m0ue/L9HwIoto87OCmfi3 2RwyAoBLjMZUoOMLr9DjlQglQnTnNY8LjjZKRr9ug5V/tN8F051NeILDDj2vSf0q PI5JHoBD2LnJcxU+XI1JM/9amCYwBHjd94fcSp7H9BkdIzYshW4Deooc58EnjxVv 5hlwMIqqk2m911TsOjNpkVuysABoIB8hX3el3py4V+3sLoM5cVYa+FNS7+FGzG47 UJ/4c68fdMRAbGx4KfoW =ERtQ -----END PGP SIGNATURE-----

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117. Apple QuickTime is prone to multiple memory-corruption vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial of service conditions. Versions prior to Apple QuickTime 7.7.9 are vulnerable. The software is capable of handling multiple sources such as digital video, media segments, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in QuickTime. These issues were addressed through improved memory handling. CVE-ID CVE-2015-7085 : an anonymous researcher CVE-2015-7086 : an anonymous researcher CVE-2015-7087 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7088 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7089 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7090 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7091 : Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security CVE-2015-7092 : Jaanus Kp Clarified Security working with HP's Zero Day Initiative CVE-2015-7117 : Ryan Pentney and Richard Johnson of Cisco Talos -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWjxMiAAoJEBcWfLTuOo7t16wP/RNhjITSBZmBDZP61IOjKARD 5v69y+LkXLDNPlUkpB15Qjq3HDvZnFDwl3RSlZgAlQDO/GSqqWBnhsAEdO+5AAR1 LZqlVdERGHeeyfpuQ85waxf18O1dbg+R6SwM74SYRBXPujGQk9yT326I0X/EdXON 8upmGfzv8HvPsg712ei5YK8bumxsCh/LqM6TpA6oMF/bltaIbZ/OO3LNovZn9GQc 9taWVwP707FIjnJ7yKHzHnp6fH+79tqi5Dl0uZ7D446c7+B5ehPE7aUd29XqFrpE tgJzSDu2ZuVIz9RpC8Np+Bn8CSKqD6Kao7M5x4CVLWmpIYUpGKTIItUhvtXJ1jFY CyXXgse54w2ZG6hWE2gTmIvyn4/qVaSi8vlguEuk6IvA6kZeLdrc097OMPMPHlN/ I8T2A04Oj6rUsllf2uZih42nwve6CYpC9mh9/HLz0O+m0ue/L9HwIoto87OCmfi3 2RwyAoBLjMZUoOMLr9DjlQglQnTnNY8LjjZKRr9ug5V/tN8F051NeILDDj2vSf0q PI5JHoBD2LnJcxU+XI1JM/9amCYwBHjd94fcSp7H9BkdIzYshW4Deooc58EnjxVv 5hlwMIqqk2m911TsOjNpkVuysABoIB8hX3el3py4V+3sLoM5cVYa+FNS7+FGzG47 UJ/4c68fdMRAbGx4KfoW =ERtQ -----END PGP SIGNATURE-----

Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117. Apple QuickTime is prone to multiple memory-corruption vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial of service conditions. Versions prior to Apple QuickTime 7.7.9 are vulnerable. The software is capable of handling multiple sources such as digital video, media segments, and more. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-01-07-1 QuickTime 7.7.9 [Re-sending with a valid signature] QuickTime 7.7.9 is now available and addresses the following: QuickTime Available for: Windows 7 and Windows Vista Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in QuickTime. These issues were addressed through improved memory handling. CVE-ID CVE-2015-7085 : an anonymous researcher CVE-2015-7086 : an anonymous researcher CVE-2015-7087 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7088 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7089 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7090 : Ryan Pentney and Richard Johnson of Cisco Talos CVE-2015-7091 : Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security CVE-2015-7092 : Jaanus Kp Clarified Security working with HP's Zero Day Initiative CVE-2015-7117 : Ryan Pentney and Richard Johnson of Cisco Talos -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWjxMiAAoJEBcWfLTuOo7t16wP/RNhjITSBZmBDZP61IOjKARD 5v69y+LkXLDNPlUkpB15Qjq3HDvZnFDwl3RSlZgAlQDO/GSqqWBnhsAEdO+5AAR1 LZqlVdERGHeeyfpuQ85waxf18O1dbg+R6SwM74SYRBXPujGQk9yT326I0X/EdXON 8upmGfzv8HvPsg712ei5YK8bumxsCh/LqM6TpA6oMF/bltaIbZ/OO3LNovZn9GQc 9taWVwP707FIjnJ7yKHzHnp6fH+79tqi5Dl0uZ7D446c7+B5ehPE7aUd29XqFrpE tgJzSDu2ZuVIz9RpC8Np+Bn8CSKqD6Kao7M5x4CVLWmpIYUpGKTIItUhvtXJ1jFY CyXXgse54w2ZG6hWE2gTmIvyn4/qVaSi8vlguEuk6IvA6kZeLdrc097OMPMPHlN/ I8T2A04Oj6rUsllf2uZih42nwve6CYpC9mh9/HLz0O+m0ue/L9HwIoto87OCmfi3 2RwyAoBLjMZUoOMLr9DjlQglQnTnNY8LjjZKRr9ug5V/tN8F051NeILDDj2vSf0q PI5JHoBD2LnJcxU+XI1JM/9amCYwBHjd94fcSp7H9BkdIzYshW4Deooc58EnjxVv 5hlwMIqqk2m911TsOjNpkVuysABoIB8hX3el3py4V+3sLoM5cVYa+FNS7+FGzG47 UJ/4c68fdMRAbGx4KfoW =ERtQ -----END PGP SIGNATURE-----

The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug. This vulnerability is called a bug in using free heap memory.An attacker may be able to affect you unspecified. Little is known about this issue or its effects at this time. We will update this BID as more information emerges. Nghttp2 is a C library for implementing HTTP/2. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. CVE-ID CVE-2016-1722 : Joshua J. CVE-ID CVE-2016-1781 : Devdatta Akhawe of Dropbox, Inc. WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A website may be able to track sensitive user information Description: A hidden web page may be able to access device- orientation and device-motion data. This issue was addressed by suspending the availability of this data when the web view is hidden. CVE-ID CVE-2016-1780 : Maryam Mehrnezhad, Ehsan Toreini, Siamak F. Shahandashti, and Feng Hao of the School of Computing Science, Newcastle University, UK WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may reveal a user's current location Description: An issue existed in the parsing of geolocation requests. CVE-ID CVE-2016-1779 : xisigr of Tencent's Xuanwu Lab (http://www.tencent.com) WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious website may be able to access restricted ports on arbitrary servers Description: A port redirection issue was addressed through additional port validation. CVE-ID CVE-2016-1782 : Muneaki Nishimura (nishimunea) of Recruit Technologies Co.,Ltd. CVE-ID CVE-2016-1784 : Moony Li and Jack Tang of TrendMicro and 李普君 of 无声信息技术PKAV Team (PKAV.net) WebKit Page Loading Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a malicious website may lead to user interface spoofing Description: Redirect responses may have allowed a malicious website to display an arbitrary URL and read cached contents of the destination origin. CVE-ID CVE-2016-1786 : ma.la of LINE Corporation WebKit Page Loading Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious website may exfiltrate data cross-origin Description: A caching issue existed with character encoding. CVE-ID CVE-2016-0801 : an anonymous researcher CVE-2016-0802 : an anonymous researcher Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201612-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: nghttp2: Heap-use-after-free Date: December 04, 2016 Bugs: #569518 ID: 201612-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Nghttp2 is vulnerable to a heap-use-after-free flaw in idle stream handling code. Background ========== Nghttp2 is an implementation of HTTP/2 and its header compression algorithm HPACK in C. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/nghttp2 < 1.6.0 >= 1.6.0 Description =========== A heap-use-after-free vulnerability has been discovered in nghttp2. Please review the CVE identifier referenced below for details. Impact ====== The impact of the vulnerability is still unknown. Resolution ========== All nghttp2 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/nghttp2-1.6.0" References ========== [ 1 ] CVE-2015-8659 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-8659 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201612-06 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002 OS X El Capitan 10.11.4 and Security Update 2016-002 is now available and addresses the following: apache_mod_php Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by updating libpng to version 1.6.20. CVE-ID CVE-2015-8126 : Adam Mariš CVE-2015-8472 : Adam Mariš AppleRAID Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1733 : Proteas of Qihoo 360 Nirvan Team AppleRAID Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-ID CVE-2016-1732 : Proteas of Qihoo 360 Nirvan Team AppleUSBNetworking Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue existed in the parsing of data from USB devices. This issue was addressed through improved input validation. CVE-ID CVE-2016-1734 : Andrea Barisani and Andrej Rosano of Inverse Path Bluetooth Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1735 : Jeonghoon Shin@A.D.D CVE-2016-1736 : beist and ABH of BoB Carbon Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .dfont file may lead to arbitrary code execution Description: Multiple memory corruption issues existed in the handling of font files. These issues were addressed through improved bounds checking. CVE-ID CVE-2016-1737 : an anonymous researcher dyld Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker may tamper with code-signed applications to execute arbitrary code in the application's context Description: A code signing verification issue existed in dyld. This issue was addressed with improved validation. CVE-ID CVE-2016-1738 : beist and ABH of BoB FontParser Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1740 : HappilyCoded (ant4g0nist and r3dsm0k3) working with Trend Micro's Zero Day Initiative (ZDI) HTTPProtocol Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A remote attacker may be able to execute arbitrary code Description: Multiple vulnerabilities existed in nghttp2 versions prior to 1.6.0, the most serious of which may have led to remote code execution. These were addressed by updating nghttp2 to version 1.6.0. CVE-ID CVE-2015-8659 Intel Graphics Driver Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1743 : Piotr Bania of Cisco Talos CVE-2016-1744 : Ian Beer of Google Project Zero IOFireWireFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to cause a denial of service Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1745 : sweetchip of Grayhash IOGraphics Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1746 : Peter Pi of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) CVE-2016-1747 : Juwei Lin of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) IOHIDFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to determine kernel memory layout Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1748 : Brandon Azad IOUSBFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1749 : Ian Beer of Google Project Zero and Juwei Lin of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. CVE-ID CVE-2016-1750 : CESG Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition existed during the creation of new processes. This was addressed through improved state handling. CVE-ID CVE-2016-1757 : Ian Beer of Google Project Zero and Pedro Vilaca Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved input validation. CVE-ID CVE-2016-1756 : Lufeng Li of Qihoo 360 Vulcan Team Kernel Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1754 : Lufeng Li of Qihoo 360 Vulcan Team CVE-2016-1755 : Ian Beer of Google Project Zero CVE-2016-1759 : lokihardt Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-ID CVE-2016-1758 : Brandon Azad Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple integer overflows were addressed through improved input validation. CVE-ID CVE-2016-1753 : Juwei Lin Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to cause a denial of service Description: A denial of service issue was addressed through improved validation. CVE-ID CVE-2016-1752 : CESG libxml2 Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing maliciously crafted XML may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2015-1819 CVE-2015-5312 : David Drysdale of Google CVE-2015-7499 CVE-2015-7500 : Kostya Serebryany of Google CVE-2015-7942 : Kostya Serebryany of Google CVE-2015-8035 : gustavo.grieco CVE-2015-8242 : Hugh Davenport CVE-2016-1761 : wol0xff working with Trend Micro's Zero Day Initiative (ZDI) CVE-2016-1762 Messages Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker who is able to bypass Apple's certificate pinning, intercept TLS connections, inject messages, and record encrypted attachment-type messages may be able to read attachments Description: A cryptographic issue was addressed by rejecting duplicate messages on the client. CVE-ID CVE-2016-1788 : Christina Garman, Matthew Green, Gabriel Kaptchuk, Ian Miers, and Michael Rushanan of Johns Hopkins University Messages Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Clicking a JavaScript link can reveal sensitive user information Description: An issue existed in the processing of JavaScript links. This issue was addressed through improved content security policy checks. CVE-ID CVE-2016-1764 : Matthew Bryan of the Uber Security Team (formerly of Bishop Fox), Joe DeMesy and Shubham Shah of Bishop Fox NVIDIA Graphics Drivers Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1741 : Ian Beer of Google Project Zero OpenSSH Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Connecting to a server may leak sensitive user information, such as a client's private keys Description: Roaming, which was on by default in the OpenSSH client, exposed an information leak and a buffer overflow. These issues were addressed by disabling roaming in the client. CVE-ID CVE-2016-0777 : Qualys CVE-2016-0778 : Qualys OpenSSH Available for: OS X Mavericks v10.9.5 and OS X Yosemite v10.10.5 Impact: Multiple vulnerabilities in LibreSSL Description: Multiple vulnerabilities existed in LibreSSL versions prior to 2.1.8. These were addressed by updating LibreSSL to version 2.1.8. CVE-ID CVE-2015-5333 : Qualys CVE-2015-5334 : Qualys OpenSSL Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A remote attacker may be able to cause a denial of service Description: A memory leak existed in OpenSSL versions prior to 0.9.8zh. This issue was addressed by updating OpenSSL to version 0.9.8zh. CVE-ID CVE-2015-3195 Python Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by updating libpng to version 1.6.20. CVE-ID CVE-2014-9495 CVE-2015-0973 CVE-2015-8126 : Adam Mariš CVE-2015-8472 : Adam Mariš QuickTime Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted FlashPix Bitmap Image may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1767 : Francis Provencher from COSIG CVE-2016-1768 : Francis Provencher from COSIG QuickTime Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted Photoshop document may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1769 : Francis Provencher from COSIG Reminders Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Clicking a tel link can make a call without prompting the user Description: A user was not prompted before invoking a call. This was addressed through improved entitlement checks. CVE-ID CVE-2016-1770 : Guillaume Ross of Rapid7 and Laurent Chouinard of Laurent.ca Ruby Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local attacker may be able to cause unexpected application termination or arbitrary code execution Description: An unsafe tainted string usage vulnerability existed in versions prior to 2.0.0-p648. This issue was addressed by updating to version 2.0.0-p648. CVE-ID CVE-2015-7551 Security Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to check for the existence of arbitrary files Description: A permissions issue existed in code signing tools. This was addressed though additional ownership checks. CVE-ID CVE-2016-1773 : Mark Mentovai of Google Inc. Security Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted certificate may lead to arbitrary code execution Description: A memory corruption issue existed in the ASN.1 decoder. This issue was addressed through improved input validation. CVE-ID CVE-2016-1950 : Francis Gabriel of Quarkslab Tcl Available for: OS X Yosemite v10.10.5 and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by removing libpng. CVE-ID CVE-2015-8126 : Adam Mariš TrueTypeScaler Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation. CVE-ID CVE-2016-1775 : 0x1byte working with Trend Micro's Zero Day Initiative (ZDI) Wi-Fi Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker with a privileged network position may be able to execute arbitrary code Description: A frame validation and memory corruption issue existed for a given ethertype. This issue was addressed through additional ethertype validation and improved memory handling. CVE-ID CVE-2016-0801 : an anonymous researcher CVE-2016-0802 : an anonymous researcher OS X El Capitan 10.11.4 includes the security content of Safari 9.1. https://support.apple.com/kb/HT206171 OS X El Capitan v10.11.4 and Security Update 2016-002 may be obtained from the Mac App Store or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJW8JQFAAoJEBcWfLTuOo7tZSYP/1bHFA1qemkD37uu7nYpk/q6 ARVsPgME1I1+5tOxX0TQJgzMBmdQsKYdsTiLpDk5HTuv+dAMsFfasaUItGk8Sz1w HiYjSfVsxL+Pjz3vK8/4/fsi2lX6472MElRw8gudITOhXtniGcKo/vuA5dB+vM3l Jy1NLHHhZ6BD2t0bBmlz41mZMG3AMxal2wfqE+5LkjUwASzcvC/3B1sh7Fntwyau /71vIgMQ5AaETdgQJAuQivxPyTlFduBRgLjqvPiB9eSK4Ctu5t/hErFIrP2NiDCi UhfZC48XbiRjJfkUsUD/5TIKnI+jkZxOnch9ny32dw2kUIkbIAbqufTkzsMXOpng O+rI93Ni7nfzgI3EkI2bq+C+arOoRiveWuJvc3SMPD5RQHo4NCQVs0ekQJKNHF78 juPnY29n8WMjwLS6Zfm+bH+n8ELIXrmmEscRztK2efa9S7vJe+AgIxx7JE/f8OHF i9K7UQBXFXcpMjXi1aTby/IUnpL5Ny4NVwYwIhctj0Mf6wTH7uf/FMWYIQOXcIfP Izo+GXxNeLd4H2ypZ+UpkZg/Sn2mtCd88wLc96+owlZPBlSqWl3X1wTlp8i5FP2X qlQ7RcTHJDv8jPT/MOfzxEK1n/azp45ahHA0o6nohUdxlA7PLci9vPiJxqKPo/0q VZmOKa8qMxB1L/JmdCqy =mZR+ -----END PGP SIGNATURE-----

SilentCircleBlackphone is a smartphone with privacy protection. SilentCircleBlackphone has a security vulnerability that allows an attacker to exploit the vulnerability to bypass security restrictions and perform unauthorized operations. Silent Circle Blackphone is prone to a security-bypass vulnerability. Successful exploits may lead to other attacks

Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within parsing of vlp files. A specially crafted vlp will overrun a heap buffer and inject values past the end of the heap allocation. An attacker can leverage this vulnerability to execute arbitrary code under the context of local Administrator. Unitronics VisiLogic OPLC IDE is a set of human machine interface (HMI) and PLC application programming environments for Vision and SAMBA series controllers from Unitronics, Israel. Failed exploit attempts will likely result in denial-of-service conditions. Unitronics VisiLogic OPLC IDE 9.8.0.00 and prior versions are vulnerable

Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to defeat sensor functionality by interfering with ZigBee 2.4 GHz transmissions. Comcast XFINITY Home Security does not fail securely, which may be leveraged to avoid triggering alarm events. Comcast XFINITY Home Security The system has a problem in handling when the wireless connection between the sensor and the base station is broken, which may intentionally interfere with alarm generation. CWE-636: Not Failing Securely ('Failing Open') Comcast XFINITY Home Security Then, the frequency between the sensors and base stations that make up the system 2.4GHz , ZigBee We are communicating by protocol. Comcast XFINITY Home Security May not be alerted when wireless communication is interrupted, and it may take several minutes to several hours for communication to recover. Alerts will not occur while communication is interrupted. Therefore, by interfering with the wireless connection, Home Security It is possible to suppress the occurrence of alerts from. CWE-636: Not Failing Securely ('Failing Open') https://cwe.mitre.org/data/definitions/636.html For more information, Rapid7 See the blog post. Rapid7 Blog posts https://community.rapid7.com/community/infosec/blog/2016/01/05/r7-2015-23-comcast-xfinity-home-security-system-insecure-fail-open In addition, National Vulnerability Database (NVD) CVE-2016-2398 Then CWE-254 It is published as CWE-254: Security Features ( Security function ) http://cwe.mitre.org/data/definitions/254.htmlAlert operation may be interrupted. The ComcastXfinity Home Security System is Comcast's smart home monitoring system solution that provides residential alarms and services such as cable, internet and telephone services. Comcast XFINITY Home Security is a complete home security system from Comcast. The system provides functions such as online access security monitoring. A denial of service vulnerability exists in Comcast XFINITY Home Security. An attacker could use this vulnerability to cause a denial of service

SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCut66767. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This issue being tracked by Cisco Bug IDs CSCut66767. This component provides a scalable, distributed and highly available enterprise IP telephony call processing solution

Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCux64856. Cisco Prime Infrastructure is prone to a frame-injection vulnerability. An attacker can exploit this issue to conduct phishing attacks. Successful exploits will allow the attacker to gain unauthorized access or obtain sensitive information. This issue is being tracked by Cisco Bug ID CSCux64856

The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows remote attackers to cause a denial of service (crash) via a crafted application. HuaweiSmartPhones is a smart phone from China Huawei. Huawei SmartPhones7 has a security vulnerability that allows an attacker to exploit the vulnerability to crash an application for a denial of service attack. Huawei Smart Phones are prone to multiple local denial-of-service vulnerabilities. The Huawei P8 is a smartphone from the Chinese company Huawei. ION driver is one of the graphics card drivers. A denial of service vulnerability exists in the ION driver in the Huawei P8. The following versions are affected: Huawei P8 GRA-TL00C01B220 and earlier, GRA-CL00C92B220 and earlier, GRA-CL10C92B220 and earlier, GRA-UL00C00B220 and earlier, GRA-UL10C00B220 and earlier