VARIoT IoT vulnerabilities database

The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via vectors involving an IFRAME element. Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800, versions 3.6.x to 3.8.3, contain multiple vulnerabilities. The appliance provides features such as a dedicated encrypted traffic management platform, easy-to-use policy enforcement points, and an adaptive security solution. The program failed to execute the same-origin policy in the X-Frame-Options HTTP header. Successfully exploiting these vulnerabilities will allow attackers to perform certain unauthorized actions, hijack an arbitrary session, gain access to the sensitive information or compromise the affected application. Other attacks are also possible

Session fixation vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack web sessions by providing a session ID. Supplementary information : CWE Vulnerability type by CWE-384: Session Fixation ( Session fixation ) Has been identified. http://cwe.mitre.org/data/definitions/384.htmlSession by a third party ID Provided Web Sessions may be hijacked. It is the core of encrypted traffic management, providing visibility into SSL traffic and supporting the addition of SSL checking to advanced threat protection solutions. The solution and the existing network security architecture. Successfully exploiting these vulnerabilities will allow attackers to perform certain unauthorized actions, hijack an arbitrary session, gain access to the sensitive information or compromise the affected application. Other attacks are also possible

Apple Mac EFI before 2015-002, as used in OS X before 10.11.1 and other products, mishandles arguments, which allows attackers to reach "unused" functions via unspecified vectors. Supplementary information : CWE Vulnerability type by CWE-17: Code ( code ) Has been identified. http://cwe.mitre.org/data/definitions/17.htmlBy the attacker, " not being used " Function may be reached. of the United States for Mac computers. An attacker could use this vulnerability to perform unauthorized operations in the context of an affected system. Apple Mac EFI is one of the firmware upgrade interfaces. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2015-10-21-6 Mac EFI Security Update 2015-002 Mac EFI Security Update 2015-002 is now available and addresses the following: EFI Available for: OS X Mavericks v10.9.5 Impact: An attacker can exercise unused EFI functions Description: An issue existed with EFI argument handling. This was addressed by removing the affected functions. CVE-ID CVE-2015-7035 : Corey Kallenberg, Xeno Kovah, John Butterworth, and Sam Cornwell of The MITRE Corporation, coordinated via CERT Installation note: Mac EFI Security Update 2015-002 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJWJ9rpAAoJEBcWfLTuOo7tYI4QAKGoNIBxSQDwnZZU2PcR82yu KvLVgrowQqNMRzxygIK6yyxXPEAI3V+W4ZMWVBh60ZvHfB/AS9c8cUntbpgtvtKO ttO6ngmpH6bKRfCtoT99vbEowdlq4GmduCOmRBH5P4fmKbLxJGyLZIgStmMagYqa /bL8w8c+a7xbGwdsVGLQDFcLCplCGyhJxDRDRo1e8HZOdBVpxhKZ0boQYX7T8oat rS7daZIEZekwVqloI+5PHEmGeZo5C5sMTYA3qiCbyPvg2MSeVsQeY/t3YCP7iP7p eShq03cwzZ7UqVys6f1EPUMRg7fz6qOYP7n7rTrdKUJQ3+6N0ktSuKB3ApetzSzN 7BjtyEQnUYmwMAyI51jxsi+lir7pKJcG3X7Wtc4Vf6XKsySQH5LI7GES1O39SOpD bq0lavypGewF9ipMO9nrizc/OXnaUlXKACgJ43OcLuYYfnIOD+c3qaWsQPxfyBZ/ ks4AjbJRp/kt2E7RP7OhvTY116yXsDRjsf/ndd56ZktRiwrLtFG5EsbSlO2QnQ49 +ZaqU9rRW7rUUyRFwCjxSjQxDiWvYuufsLtqZCr1QlHsPG7+XztnFy4FOiEDvCzy 8tUPSVNrm4VGLRooBIoPsh8rmx1AHnKPdjFYl9CS3/lVk0pvkrctbSHekaIu6E1x fppz1h8xtXHMHIROMi76 =Hb9X -----END PGP SIGNATURE-----

PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. Supplementary information : CWE Vulnerability type by CWE-19: Data Handling ( Data processing ) Has been identified. PHP is prone to multiple security-bypass vulnerabilities. An attacker can leverage these issues to bypass security restrictions and perform unauthorized actions. This may aid in further attacks. PHP (PHP: Hypertext Preprocessor, PHP: Hypertext Preprocessor) is an open source general-purpose computer scripting language jointly maintained by the PHP Group and the open source community. The language supports multiple grammars, multiple databases and operating systems, and supports C and C++ for program expansion. A security vulnerability exists in PHP due to the program truncating pathnames when it encounters '\x00' bytes. The following versions are affected: PHP prior to 5.4.41, 5.5.x prior to 5.5.25, and 5.6.x prior to 5.6.9. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: php55-php security update Advisory ID: RHSA-2015:1186-01 Product: Red Hat Software Collections Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-1186.html Issue date: 2015-06-25 CVE Names: CVE-2015-2783 CVE-2015-3307 CVE-2015-3329 CVE-2015-3330 CVE-2015-3411 CVE-2015-3412 CVE-2015-4021 CVE-2015-4022 CVE-2015-4024 CVE-2015-4025 CVE-2015-4026 CVE-2015-4598 CVE-2015-4602 CVE-2015-4603 CVE-2015-4604 CVE-2015-4605 ===================================================================== 1. Summary: Updated php55-php packages that fix multiple security issues are now available for Red Hat Software Collections 2. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - x86_64 Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - x86_64 3. Description: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code. (CVE-2015-3330) A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-4022) Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-4602, CVE-2015-4603) It was found that certain PHP functions did not properly handle file names containing a NULL character. (CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598) Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened. (CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021) Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files. (CVE-2015-4604, CVE-2015-4605) All php55-php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd24-httpd service must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1213394 - CVE-2015-3330 php: pipelined request executed in deinitialized interpreter under httpd 2.4 1213407 - CVE-2015-3411 php: missing null byte checks for paths in various PHP extensions 1213442 - CVE-2015-4604 CVE-2015-4605 php: denial of service when processing a crafted file with Fileinfo 1213446 - CVE-2015-2783 php: buffer over-read in Phar metadata parsing 1213449 - CVE-2015-3329 php: buffer overflow in phar_set_inode() 1222485 - CVE-2015-4024 php: multipart/form-data request paring CPU usage DoS 1223408 - CVE-2015-4025 php: CVE-2006-7243 regressions in 5.4+ 1223412 - CVE-2015-4022 php: integer overflow leading to heap overflow when reading FTP file listing 1223422 - CVE-2015-4026 php: pcntl_exec() accepts paths with NUL character 1223425 - CVE-2015-4021 php: memory corruption in phar_parse_tarfile caused by empty entry file name 1223441 - CVE-2015-3307 php: invalid pointer free() in phar_tar_process_metadata() 1232823 - CVE-2015-3412 php: missing null byte checks for paths in various PHP extensions 1232897 - CVE-2015-4598 php: missing null byte checks for paths in DOM and GD extensions 1232918 - CVE-2015-4603 php: exception::getTraceAsString type confusion issue after unserialize 1232923 - CVE-2015-4602 php: Incomplete Class unserialization type confusion 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: php55-php-5.5.21-4.el6.src.rpm x86_64: php55-php-5.5.21-4.el6.x86_64.rpm php55-php-bcmath-5.5.21-4.el6.x86_64.rpm php55-php-cli-5.5.21-4.el6.x86_64.rpm php55-php-common-5.5.21-4.el6.x86_64.rpm php55-php-dba-5.5.21-4.el6.x86_64.rpm php55-php-debuginfo-5.5.21-4.el6.x86_64.rpm php55-php-devel-5.5.21-4.el6.x86_64.rpm php55-php-enchant-5.5.21-4.el6.x86_64.rpm php55-php-fpm-5.5.21-4.el6.x86_64.rpm php55-php-gd-5.5.21-4.el6.x86_64.rpm php55-php-gmp-5.5.21-4.el6.x86_64.rpm php55-php-imap-5.5.21-4.el6.x86_64.rpm php55-php-intl-5.5.21-4.el6.x86_64.rpm php55-php-ldap-5.5.21-4.el6.x86_64.rpm php55-php-mbstring-5.5.21-4.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el6.x86_64.rpm php55-php-odbc-5.5.21-4.el6.x86_64.rpm php55-php-opcache-5.5.21-4.el6.x86_64.rpm php55-php-pdo-5.5.21-4.el6.x86_64.rpm php55-php-pgsql-5.5.21-4.el6.x86_64.rpm php55-php-process-5.5.21-4.el6.x86_64.rpm php55-php-pspell-5.5.21-4.el6.x86_64.rpm php55-php-recode-5.5.21-4.el6.x86_64.rpm php55-php-snmp-5.5.21-4.el6.x86_64.rpm php55-php-soap-5.5.21-4.el6.x86_64.rpm php55-php-tidy-5.5.21-4.el6.x86_64.rpm php55-php-xml-5.5.21-4.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.5): Source: php55-php-5.5.21-4.el6.src.rpm x86_64: php55-php-5.5.21-4.el6.x86_64.rpm php55-php-bcmath-5.5.21-4.el6.x86_64.rpm php55-php-cli-5.5.21-4.el6.x86_64.rpm php55-php-common-5.5.21-4.el6.x86_64.rpm php55-php-dba-5.5.21-4.el6.x86_64.rpm php55-php-debuginfo-5.5.21-4.el6.x86_64.rpm php55-php-devel-5.5.21-4.el6.x86_64.rpm php55-php-enchant-5.5.21-4.el6.x86_64.rpm php55-php-fpm-5.5.21-4.el6.x86_64.rpm php55-php-gd-5.5.21-4.el6.x86_64.rpm php55-php-gmp-5.5.21-4.el6.x86_64.rpm php55-php-imap-5.5.21-4.el6.x86_64.rpm php55-php-intl-5.5.21-4.el6.x86_64.rpm php55-php-ldap-5.5.21-4.el6.x86_64.rpm php55-php-mbstring-5.5.21-4.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el6.x86_64.rpm php55-php-odbc-5.5.21-4.el6.x86_64.rpm php55-php-opcache-5.5.21-4.el6.x86_64.rpm php55-php-pdo-5.5.21-4.el6.x86_64.rpm php55-php-pgsql-5.5.21-4.el6.x86_64.rpm php55-php-process-5.5.21-4.el6.x86_64.rpm php55-php-pspell-5.5.21-4.el6.x86_64.rpm php55-php-recode-5.5.21-4.el6.x86_64.rpm php55-php-snmp-5.5.21-4.el6.x86_64.rpm php55-php-soap-5.5.21-4.el6.x86_64.rpm php55-php-tidy-5.5.21-4.el6.x86_64.rpm php55-php-xml-5.5.21-4.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: php55-php-5.5.21-4.el6.src.rpm x86_64: php55-php-5.5.21-4.el6.x86_64.rpm php55-php-bcmath-5.5.21-4.el6.x86_64.rpm php55-php-cli-5.5.21-4.el6.x86_64.rpm php55-php-common-5.5.21-4.el6.x86_64.rpm php55-php-dba-5.5.21-4.el6.x86_64.rpm php55-php-debuginfo-5.5.21-4.el6.x86_64.rpm php55-php-devel-5.5.21-4.el6.x86_64.rpm php55-php-enchant-5.5.21-4.el6.x86_64.rpm php55-php-fpm-5.5.21-4.el6.x86_64.rpm php55-php-gd-5.5.21-4.el6.x86_64.rpm php55-php-gmp-5.5.21-4.el6.x86_64.rpm php55-php-imap-5.5.21-4.el6.x86_64.rpm php55-php-intl-5.5.21-4.el6.x86_64.rpm php55-php-ldap-5.5.21-4.el6.x86_64.rpm php55-php-mbstring-5.5.21-4.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el6.x86_64.rpm php55-php-odbc-5.5.21-4.el6.x86_64.rpm php55-php-opcache-5.5.21-4.el6.x86_64.rpm php55-php-pdo-5.5.21-4.el6.x86_64.rpm php55-php-pgsql-5.5.21-4.el6.x86_64.rpm php55-php-process-5.5.21-4.el6.x86_64.rpm php55-php-pspell-5.5.21-4.el6.x86_64.rpm php55-php-recode-5.5.21-4.el6.x86_64.rpm php55-php-snmp-5.5.21-4.el6.x86_64.rpm php55-php-soap-5.5.21-4.el6.x86_64.rpm php55-php-tidy-5.5.21-4.el6.x86_64.rpm php55-php-xml-5.5.21-4.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: php55-php-5.5.21-4.el6.src.rpm x86_64: php55-php-5.5.21-4.el6.x86_64.rpm php55-php-bcmath-5.5.21-4.el6.x86_64.rpm php55-php-cli-5.5.21-4.el6.x86_64.rpm php55-php-common-5.5.21-4.el6.x86_64.rpm php55-php-dba-5.5.21-4.el6.x86_64.rpm php55-php-debuginfo-5.5.21-4.el6.x86_64.rpm php55-php-devel-5.5.21-4.el6.x86_64.rpm php55-php-enchant-5.5.21-4.el6.x86_64.rpm php55-php-fpm-5.5.21-4.el6.x86_64.rpm php55-php-gd-5.5.21-4.el6.x86_64.rpm php55-php-gmp-5.5.21-4.el6.x86_64.rpm php55-php-imap-5.5.21-4.el6.x86_64.rpm php55-php-intl-5.5.21-4.el6.x86_64.rpm php55-php-ldap-5.5.21-4.el6.x86_64.rpm php55-php-mbstring-5.5.21-4.el6.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el6.x86_64.rpm php55-php-odbc-5.5.21-4.el6.x86_64.rpm php55-php-opcache-5.5.21-4.el6.x86_64.rpm php55-php-pdo-5.5.21-4.el6.x86_64.rpm php55-php-pgsql-5.5.21-4.el6.x86_64.rpm php55-php-process-5.5.21-4.el6.x86_64.rpm php55-php-pspell-5.5.21-4.el6.x86_64.rpm php55-php-recode-5.5.21-4.el6.x86_64.rpm php55-php-snmp-5.5.21-4.el6.x86_64.rpm php55-php-soap-5.5.21-4.el6.x86_64.rpm php55-php-tidy-5.5.21-4.el6.x86_64.rpm php55-php-xml-5.5.21-4.el6.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el6.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: php55-php-5.5.21-4.el7.src.rpm x86_64: php55-php-5.5.21-4.el7.x86_64.rpm php55-php-bcmath-5.5.21-4.el7.x86_64.rpm php55-php-cli-5.5.21-4.el7.x86_64.rpm php55-php-common-5.5.21-4.el7.x86_64.rpm php55-php-dba-5.5.21-4.el7.x86_64.rpm php55-php-debuginfo-5.5.21-4.el7.x86_64.rpm php55-php-devel-5.5.21-4.el7.x86_64.rpm php55-php-enchant-5.5.21-4.el7.x86_64.rpm php55-php-fpm-5.5.21-4.el7.x86_64.rpm php55-php-gd-5.5.21-4.el7.x86_64.rpm php55-php-gmp-5.5.21-4.el7.x86_64.rpm php55-php-intl-5.5.21-4.el7.x86_64.rpm php55-php-ldap-5.5.21-4.el7.x86_64.rpm php55-php-mbstring-5.5.21-4.el7.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el7.x86_64.rpm php55-php-odbc-5.5.21-4.el7.x86_64.rpm php55-php-opcache-5.5.21-4.el7.x86_64.rpm php55-php-pdo-5.5.21-4.el7.x86_64.rpm php55-php-pgsql-5.5.21-4.el7.x86_64.rpm php55-php-process-5.5.21-4.el7.x86_64.rpm php55-php-pspell-5.5.21-4.el7.x86_64.rpm php55-php-recode-5.5.21-4.el7.x86_64.rpm php55-php-snmp-5.5.21-4.el7.x86_64.rpm php55-php-soap-5.5.21-4.el7.x86_64.rpm php55-php-xml-5.5.21-4.el7.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1): Source: php55-php-5.5.21-4.el7.src.rpm x86_64: php55-php-5.5.21-4.el7.x86_64.rpm php55-php-bcmath-5.5.21-4.el7.x86_64.rpm php55-php-cli-5.5.21-4.el7.x86_64.rpm php55-php-common-5.5.21-4.el7.x86_64.rpm php55-php-dba-5.5.21-4.el7.x86_64.rpm php55-php-debuginfo-5.5.21-4.el7.x86_64.rpm php55-php-devel-5.5.21-4.el7.x86_64.rpm php55-php-enchant-5.5.21-4.el7.x86_64.rpm php55-php-fpm-5.5.21-4.el7.x86_64.rpm php55-php-gd-5.5.21-4.el7.x86_64.rpm php55-php-gmp-5.5.21-4.el7.x86_64.rpm php55-php-intl-5.5.21-4.el7.x86_64.rpm php55-php-ldap-5.5.21-4.el7.x86_64.rpm php55-php-mbstring-5.5.21-4.el7.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el7.x86_64.rpm php55-php-odbc-5.5.21-4.el7.x86_64.rpm php55-php-opcache-5.5.21-4.el7.x86_64.rpm php55-php-pdo-5.5.21-4.el7.x86_64.rpm php55-php-pgsql-5.5.21-4.el7.x86_64.rpm php55-php-process-5.5.21-4.el7.x86_64.rpm php55-php-pspell-5.5.21-4.el7.x86_64.rpm php55-php-recode-5.5.21-4.el7.x86_64.rpm php55-php-snmp-5.5.21-4.el7.x86_64.rpm php55-php-soap-5.5.21-4.el7.x86_64.rpm php55-php-xml-5.5.21-4.el7.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el7.x86_64.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: php55-php-5.5.21-4.el7.src.rpm x86_64: php55-php-5.5.21-4.el7.x86_64.rpm php55-php-bcmath-5.5.21-4.el7.x86_64.rpm php55-php-cli-5.5.21-4.el7.x86_64.rpm php55-php-common-5.5.21-4.el7.x86_64.rpm php55-php-dba-5.5.21-4.el7.x86_64.rpm php55-php-debuginfo-5.5.21-4.el7.x86_64.rpm php55-php-devel-5.5.21-4.el7.x86_64.rpm php55-php-enchant-5.5.21-4.el7.x86_64.rpm php55-php-fpm-5.5.21-4.el7.x86_64.rpm php55-php-gd-5.5.21-4.el7.x86_64.rpm php55-php-gmp-5.5.21-4.el7.x86_64.rpm php55-php-intl-5.5.21-4.el7.x86_64.rpm php55-php-ldap-5.5.21-4.el7.x86_64.rpm php55-php-mbstring-5.5.21-4.el7.x86_64.rpm php55-php-mysqlnd-5.5.21-4.el7.x86_64.rpm php55-php-odbc-5.5.21-4.el7.x86_64.rpm php55-php-opcache-5.5.21-4.el7.x86_64.rpm php55-php-pdo-5.5.21-4.el7.x86_64.rpm php55-php-pgsql-5.5.21-4.el7.x86_64.rpm php55-php-process-5.5.21-4.el7.x86_64.rpm php55-php-pspell-5.5.21-4.el7.x86_64.rpm php55-php-recode-5.5.21-4.el7.x86_64.rpm php55-php-snmp-5.5.21-4.el7.x86_64.rpm php55-php-soap-5.5.21-4.el7.x86_64.rpm php55-php-xml-5.5.21-4.el7.x86_64.rpm php55-php-xmlrpc-5.5.21-4.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-2783 https://access.redhat.com/security/cve/CVE-2015-3307 https://access.redhat.com/security/cve/CVE-2015-3329 https://access.redhat.com/security/cve/CVE-2015-3330 https://access.redhat.com/security/cve/CVE-2015-3411 https://access.redhat.com/security/cve/CVE-2015-3412 https://access.redhat.com/security/cve/CVE-2015-4021 https://access.redhat.com/security/cve/CVE-2015-4022 https://access.redhat.com/security/cve/CVE-2015-4024 https://access.redhat.com/security/cve/CVE-2015-4025 https://access.redhat.com/security/cve/CVE-2015-4026 https://access.redhat.com/security/cve/CVE-2015-4598 https://access.redhat.com/security/cve/CVE-2015-4602 https://access.redhat.com/security/cve/CVE-2015-4603 https://access.redhat.com/security/cve/CVE-2015-4604 https://access.redhat.com/security/cve/CVE-2015-4605 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFVi8HYXlSAg2UNWIIRAiyPAJ99IZMPIkUJWe8WmApDpEGV6ff98wCgxBYL TtBX6SWqx78H/4bsQXtRlo4= =EuyB -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ============================================================================ Ubuntu Security Notice USN-2658-1 July 06, 2015 php5 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.04 - Ubuntu 14.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in PHP. Software Description: - php5: HTML-embedded scripting language interpreter Details: Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026, CVE-2015-4598) Emmanuel Law discovered that the PHP phar extension incorrectly handled filenames starting with a NULL byte. (CVE-2015-4021) Max Spelsberg discovered that PHP incorrectly handled the LIST command when connecting to remote FTP servers. (CVE-2015-4022, CVE-2015-4643) Shusheng Liu discovered that PHP incorrectly handled certain malformed form data. (CVE-2015-4024) Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. (CVE-2015-4147) Andrea Palazzo discovered that the PHP Soap client incorrectly validated that the uri property is a string. A remote attacker could possibly use these issues to obtain sensitive information or cause a denial of service. This issue only affected Ubuntu 15.04. (CVE-2015-4644) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.04: libapache2-mod-php5 5.6.4+dfsg-4ubuntu6.2 php5-cgi 5.6.4+dfsg-4ubuntu6.2 php5-cli 5.6.4+dfsg-4ubuntu6.2 php5-fpm 5.6.4+dfsg-4ubuntu6.2 Ubuntu 14.10: libapache2-mod-php5 5.5.12+dfsg-2ubuntu4.6 php5-cgi 5.5.12+dfsg-2ubuntu4.6 php5-cli 5.5.12+dfsg-2ubuntu4.6 php5-fpm 5.5.12+dfsg-2ubuntu4.6 Ubuntu 14.04 LTS: libapache2-mod-php5 5.5.9+dfsg-1ubuntu4.11 php5-cgi 5.5.9+dfsg-1ubuntu4.11 php5-cli 5.5.9+dfsg-1ubuntu4.11 php5-fpm 5.5.9+dfsg-1ubuntu4.11 Ubuntu 12.04 LTS: libapache2-mod-php5 5.3.10-1ubuntu3.19 php5-cgi 5.3.10-1ubuntu3.19 php5-cli 5.3.10-1ubuntu3.19 php5-fpm 5.3.10-1ubuntu3.19 In general, a standard system update will make all the necessary changes. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/php-5.4.41-i486-1_slack14.1.txz: Upgraded. This update fixes some bugs and security issues. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7243 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2325 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2326 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4021 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4022 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4024 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4025 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4026 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you. Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/php-5.4.41-i486-1_slack14.0.txz Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/php-5.4.41-x86_64-1_slack14.0.txz Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/php-5.4.41-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/php-5.4.41-x86_64-1_slack14.1.txz Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/php-5.6.9-i586-1.txz Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/php-5.6.9-x86_64-1.txz MD5 signatures: +-------------+ Slackware 14.0 package: 5e8d107dba11f8c87693edfdc32f56b7 php-5.4.41-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 24d6895fe6b0e9c88b04ceaccc35383d php-5.4.41-x86_64-1_slack14.0.txz Slackware 14.1 package: 52011eec3a256a365789562b63e8ba84 php-5.4.41-i486-1_slack14.1.txz Slackware x86_64 14.1 package: 82b75af6253121cab6cc84dd714f554c php-5.4.41-x86_64-1_slack14.1.txz Slackware -current package: e1c64f133f44b0abac21e0846e39d3c8 n/php-5.6.9-i586-1.txz Slackware x86_64 -current package: ae51c99af34a4bd8721e7140c38a8c1a n/php-5.6.9-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg php-5.4.41-i486-1_slack14.1.txz Then, restart Apache httpd: # /etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com +------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address. CVE-2015-4024 Denial of service when processing multipart/form-data requests. CVE-2015-4022 Integer overflow in the ftp_genlist() function may result in denial of service or potentially the execution of arbitrary code. For the oldstable distribution (wheezy), these problems have been fixed in version 5.4.41-0+deb7u1. For the stable distribution (jessie), these problems have been fixed in version 5.6.9+dfsg-0+deb8u1. For the testing distribution (stretch), these problems have been fixed in version 5.6.9+dfsg-1. For the unstable distribution (sid), these problems have been fixed in version 5.6.9+dfsg-1. We recommend that you upgrade your php5 packages

Stack-based buffer overflow in login_mgr.cgi in D-Link firmware DNR-320L and DNS-320LW before 1.04b08, DNR-322L before 2.10 build 03, DNR-326 before 2.10 build 03, and DNS-327L before 1.04b01 allows remote attackers to execute arbitrary code by crafting malformed "Host" and "Referer" header values. plural D-Link The product firmware contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-link specializes in the design and development of wireless network and Ethernet road hardware products. A buffer overflow vulnerability exists in multiple D-Link products. Perform a boundary check before failing to copy the user-supplied data to a memory buffer of sufficient size. Allows an attacker to exploit a vulnerability to execute arbitrary code in the context of an application or to initiate a denial of service attack. Failed exploits may result in denial-of-service conditions. D-Link DNR-320L and others are network storage devices of D-Link. The following products and versions are affected: D-Link DNR-320L prior to 1.04b08; DNS-320LW prior to 1.04b08; DNR-322L prior to 2.10 build 03; DNR-326 prior to 2.10 build 03; Versions prior to 327L 1.04b01. Overwiew -------- SEARCH-LAB performed an independent security assessment on four different D-Link devices. The assessment has identified altogether 53 unique vulnerabilities in the latest firmware (dated 30-07-2014). We list below several of the problematic areas, where the most critical findings were discovered: - Authentication can be bypassed in several ways, allowing an attacker to take full control over the device without the need to exploit any programming or design bugs. - We found a few half-baked security workarounds to fix earlier vulnerabilities that introduced even more serious problems, leading to command injection and the possibility to take full control over the device. - Even though there were several security patches and workarounds in the session management part of the code, where we still found serious problems. It was still possible to perform unauthenticated file upload to an arbitrarily chosen location, which also lead to the possibility for an attacker to take full control over the device. - Default users (root, nobody) can be used during authentication, and the administrator cannot change the default (empty) password of these users from the user interface. Details and CVEs ---------------- For the specific details see our full report in [SL-ADV]. We suppose that some of the vulnerabilities were discovered by other researchers too, but we saw it reasonable and useful to publish our findings in such a comprehensive study. Naturally in the report we tried to find and reference all of the previous publications that may have found the same problems. We obtained the following CVE numbers for the above described vulnerabilities: - CVE-2014-7858: Check_login bypass vulnerability in DNR-326 - CVE-2014-7859: Buffer overflow in login_mgr.cgi and in file_sharing.cgi - CVE-2014-7860: Unauthenticated photo publish We also reported two other authentication bypass vulnerabilities (CVE-2014-7857) to D-Link; but since these problems have not been addressed correctly yet, we will only publish them after 22/06/2015. Affected devices ---------------- Main targeted devices during the assessment: - DNS-320, Revision A: 2.03, 13/05/2013 - DNS-320L, 1.03b04, 11/11/2013 - DNS-327L, 1.02, 02/07/2014 - DNR-326, 1.40b03, 7/19/2013 Other devices were influenced by one or more vulnerabilities: - DNS-320B, 1,02b01, 23/04/2014 - DNS-345, 1.03b06, 30/07/2014 - DNS-325, 1.05b03, 30/12/2013 - DNS-322L, 2.00b07 See [SL-ADV] for the complete vulnerability matrix at the time of the assessment. We note that other devices may also be vulnerable. Solution -------- Most of the vulnerabilities were fixed in: - DNS-320L 1.04.B12 - DNS-327L 1.03.B04 Some of the vulnerabilities were fixed in: - DNR-326 2.10.B03 - DNR-322L 2.10.B03 Besides installing the patches, where available, we highly recommend not to expose the web interface of the DNS and DNR devices to the internet. Since the devices use the UPnP feature, you should disable it in the router. Credits ------- These vulnerabilities were discovered and researched by Gergely Eberhardt (@ebux25) from SEARCH-LAB Ltd. (www.search-lab.hu) References ---------- [SL-ADV] Security Advisory, MULTIPLE VULNERABILITIES IN D-LINK DNS-320, 320L, 327L AND DNR-326 DEVICES, http://www.search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdf [DNS-320] http://support.dlink.com/ProductInfo.aspx?m=DNS-320 [DNS-320L] http://support.dlink.com/ProductInfo.aspx?m=DNS-320L [DNS-327L] http://support.dlink.com/ProductInfo.aspx?m=DNS-327L [DNS-345] http://support.dlink.com/ProductInfo.aspx?m=DNS-345 [DNS-325] http://support.dlink.com/ProductInfo.aspx?m=DNS-325 [DNR-326] http://support.dlink.com/ProductInfo.aspx?m=DNR-326 [DNR-322L] http://support.dlink.com/ProductInfo.aspx?m=DNR-322L

The web/web_file/fb_publish.php script in D-Link DNS-320L before 1.04b12 and DNS-327L before 1.03b04 Build0119 does not authenticate requests, which allows remote attackers to obtain arbitrary photos and publish them to an arbitrary Facebook profile via a target album_id and access_token. D-Link DNS-320L and DNS-327L Firmware contains information disclosure vulnerabilities and authentication vulnerabilities.Information may be obtained. D-link specializes in the design and development of wireless network and Ethernet road hardware products. Multiple authentication bypass vulnerabilities exist in multiple D-Link products. Allows an attacker to exploit the vulnerability to bypass the authentication mechanism and perform unauthorized operations on the affected device. This may aid in further attacks. D-Link DNS-320L and DNS-327L are D-Link company's cloud-enabled network storage. D-Link DNS-320L versions prior to 1.04b12 and DNS-327L versions prior to 1.03b04 Build0119 have a security vulnerability in the web/web_file/fb_publish.php script, which is caused by the program not authenticating the request. Overwiew -------- SEARCH-LAB performed an independent security assessment on four different D-Link devices. The assessment has identified altogether 53 unique vulnerabilities in the latest firmware (dated 30-07-2014). Several vulnerabilities can be abused by a remote attacker to execute arbitrary code and gain full control over the devices. We list below several of the problematic areas, where the most critical findings were discovered: - Authentication can be bypassed in several ways, allowing an attacker to take full control over the device without the need to exploit any programming or design bugs. - We found a few half-baked security workarounds to fix earlier vulnerabilities that introduced even more serious problems, leading to command injection and the possibility to take full control over the device. - Even though there were several security patches and workarounds in the session management part of the code, where we still found serious problems. It was still possible to perform unauthenticated file upload to an arbitrarily chosen location, which also lead to the possibility for an attacker to take full control over the device. - Default users (root, nobody) can be used during authentication, and the administrator cannot change the default (empty) password of these users from the user interface. Details and CVEs ---------------- For the specific details see our full report in [SL-ADV]. We suppose that some of the vulnerabilities were discovered by other researchers too, but we saw it reasonable and useful to publish our findings in such a comprehensive study. Naturally in the report we tried to find and reference all of the previous publications that may have found the same problems. We obtained the following CVE numbers for the above described vulnerabilities: - CVE-2014-7858: Check_login bypass vulnerability in DNR-326 - CVE-2014-7859: Buffer overflow in login_mgr.cgi and in file_sharing.cgi - CVE-2014-7860: Unauthenticated photo publish We also reported two other authentication bypass vulnerabilities (CVE-2014-7857) to D-Link; but since these problems have not been addressed correctly yet, we will only publish them after 22/06/2015. Affected devices ---------------- Main targeted devices during the assessment: - DNS-320, Revision A: 2.03, 13/05/2013 - DNS-320L, 1.03b04, 11/11/2013 - DNS-327L, 1.02, 02/07/2014 - DNR-326, 1.40b03, 7/19/2013 Other devices were influenced by one or more vulnerabilities: - DNS-320B, 1,02b01, 23/04/2014 - DNS-345, 1.03b06, 30/07/2014 - DNS-325, 1.05b03, 30/12/2013 - DNS-322L, 2.00b07 See [SL-ADV] for the complete vulnerability matrix at the time of the assessment. We note that other devices may also be vulnerable. Solution -------- Most of the vulnerabilities were fixed in: - DNS-320L 1.04.B12 - DNS-327L 1.03.B04 Some of the vulnerabilities were fixed in: - DNR-326 2.10.B03 - DNR-322L 2.10.B03 Besides installing the patches, where available, we highly recommend not to expose the web interface of the DNS and DNR devices to the internet. Since the devices use the UPnP feature, you should disable it in the router. Credits ------- These vulnerabilities were discovered and researched by Gergely Eberhardt (@ebux25) from SEARCH-LAB Ltd

CRLF injection vulnerability in IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switch firmware before 3.4.1110 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and resulting web cache poisoning or cross-site scripting (XSS) attacks, or obtain sensitive information via multiple unspecified parameters. IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband The switch firmware includes CRLF An injection vulnerability exists.Information may be obtained and information may be altered. IBM Flex System EN6131 40Gb Ethernet and IB6131 40Gb Infiniband Switches are products of IBM Corporation of the United States. The former is an Ethernet adapter product; the latter is a switch product

Directory traversal vulnerability in the NC854 and NC856 modules for IDS RTU 850C devices allows remote authenticated users to read arbitrary files via unspecified vectors involving an internal web server, as demonstrated by reading a TELNET credentials file. NC854 and NC856 modules for IDS RTU 850C devices are communication modules used by German IDS for automation and remote control equipment. A directory traversal vulnerability exists in the NC854 and NC856 modules of the IDS RTU 850C device. A remote attacker can read arbitrary files with the help of an intranet server. IDS RTU 850 series is prone to a directory-traversal vulnerability. Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to overwrite arbitrary files in the context of the application. This may aid in further attacks

The check_login function in D-Link DNR-326 before 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie parameter to an arbitrary string. D-Link DNR-326 There are authentication vulnerabilities in the firmware.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-Link DNR-326 is a NAS network storage product from D-Link. D-Link DNR-326 has an authentication bypass vulnerability. An attacker could exploit the vulnerability to bypass the authentication mechanism and gain unauthorized access. D-Link DNR-326 is prone to an authentication-bypass vulnerability. This may aid in further attacks. D-Link DNR-326 Versions prior to 2.10 build 03 have a security vulnerability in the 'check_login' function. Overwiew -------- SEARCH-LAB performed an independent security assessment on four different D-Link devices. The assessment has identified altogether 53 unique vulnerabilities in the latest firmware (dated 30-07-2014). Several vulnerabilities can be abused by a remote attacker to execute arbitrary code and gain full control over the devices. We list below several of the problematic areas, where the most critical findings were discovered: - Authentication can be bypassed in several ways, allowing an attacker to take full control over the device without the need to exploit any programming or design bugs. - We found a few half-baked security workarounds to fix earlier vulnerabilities that introduced even more serious problems, leading to command injection and the possibility to take full control over the device. - Even though there were several security patches and workarounds in the session management part of the code, where we still found serious problems. It was still possible to perform unauthenticated file upload to an arbitrarily chosen location, which also lead to the possibility for an attacker to take full control over the device. - Default users (root, nobody) can be used during authentication, and the administrator cannot change the default (empty) password of these users from the user interface. Details and CVEs ---------------- For the specific details see our full report in [SL-ADV]. We suppose that some of the vulnerabilities were discovered by other researchers too, but we saw it reasonable and useful to publish our findings in such a comprehensive study. Naturally in the report we tried to find and reference all of the previous publications that may have found the same problems. We obtained the following CVE numbers for the above described vulnerabilities: - CVE-2014-7858: Check_login bypass vulnerability in DNR-326 - CVE-2014-7859: Buffer overflow in login_mgr.cgi and in file_sharing.cgi - CVE-2014-7860: Unauthenticated photo publish We also reported two other authentication bypass vulnerabilities (CVE-2014-7857) to D-Link; but since these problems have not been addressed correctly yet, we will only publish them after 22/06/2015. Affected devices ---------------- Main targeted devices during the assessment: - DNS-320, Revision A: 2.03, 13/05/2013 - DNS-320L, 1.03b04, 11/11/2013 - DNS-327L, 1.02, 02/07/2014 - DNR-326, 1.40b03, 7/19/2013 Other devices were influenced by one or more vulnerabilities: - DNS-320B, 1,02b01, 23/04/2014 - DNS-345, 1.03b06, 30/07/2014 - DNS-325, 1.05b03, 30/12/2013 - DNS-322L, 2.00b07 See [SL-ADV] for the complete vulnerability matrix at the time of the assessment. We note that other devices may also be vulnerable. Solution -------- Most of the vulnerabilities were fixed in: - DNS-320L 1.04.B12 - DNS-327L 1.03.B04 Some of the vulnerabilities were fixed in: - DNR-326 2.10.B03 - DNR-322L 2.10.B03 Besides installing the patches, where available, we highly recommend not to expose the web interface of the DNS and DNR devices to the internet. Since the devices use the UPnP feature, you should disable it in the router. Credits ------- These vulnerabilities were discovered and researched by Gergely Eberhardt (@ebux25) from SEARCH-LAB Ltd. (www.search-lab.hu) References ---------- [SL-ADV] Security Advisory, MULTIPLE VULNERABILITIES IN D-LINK DNS-320, 320L, 327L AND DNR-326 DEVICES, http://www.search-lab.hu/media/D-Link_Security_advisory_3_0_public.pdf [DNS-320] http://support.dlink.com/ProductInfo.aspx?m=DNS-320 [DNS-320L] http://support.dlink.com/ProductInfo.aspx?m=DNS-320L [DNS-327L] http://support.dlink.com/ProductInfo.aspx?m=DNS-327L [DNS-345] http://support.dlink.com/ProductInfo.aspx?m=DNS-345 [DNS-325] http://support.dlink.com/ProductInfo.aspx?m=DNS-325 [DNR-326] http://support.dlink.com/ProductInfo.aspx?m=DNR-326 [DNR-322L] http://support.dlink.com/ProductInfo.aspx?m=DNR-322L

D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgi_set_wto command in the cmd parameter, and setting the spawned session's cookie to username=admin. plural D-Link There are authentication vulnerabilities in the product firmware.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. D-link specializes in the design and development of wireless network and Ethernet road hardware products. Multiple D-link products have security vulnerabilities that allow an attacker to exploit the vulnerability to bypass the authentication mechanism and gain unauthorized access. Multiple D-Link Products are prone to multiple authentication-bypass vulnerabilities. This may aid in further attacks. D-Link DNS-320L and others are network storage devices of D-Link. A security vulnerability exists in several D-Link products. The following products and versions are affected: D-Link DNS-320L with firmware version prior to 1.04b12; DNS-327L with firmware version prior to 1.03b04 Build0119; DNR-326 with firmware version 1.40b03; DNS with firmware version 1.02b01 -320B; DNS-345 with firmware version 1.03b06; DNS-325 with firmware version 1.05b03; DNS-322L with firmware version 2.00b07. Overwiew -------- SEARCH-LAB performed an independent security assessment on four different D-Link devices. The assessment has identified altogether 53 unique vulnerabilities in the latest firmware (dated 30-07-2014). Several vulnerabilities can be abused by a remote attacker to execute arbitrary code and gain full control over the devices. We list below several of the problematic areas, where the most critical findings were discovered: - Authentication can be bypassed in several ways, allowing an attacker to take full control over the device without the need to exploit any programming or design bugs. - We found a few half-baked security workarounds to fix earlier vulnerabilities that introduced even more serious problems, leading to command injection and the possibility to take full control over the device. - Even though there were several security patches and workarounds in the session management part of the code, where we still found serious problems. It was still possible to perform unauthenticated file upload to an arbitrarily chosen location, which also lead to the possibility for an attacker to take full control over the device. - Default users (root, nobody) can be used during authentication, and the administrator cannot change the default (empty) password of these users from the user interface. Details and CVEs ---------------- For the specific details see our full report in [SL-ADV]. We suppose that some of the vulnerabilities were discovered by other researchers too, but we saw it reasonable and useful to publish our findings in such a comprehensive study. Naturally in the report we tried to find and reference all of the previous publications that may have found the same problems. We obtained the following CVE numbers for the above described vulnerabilities: - CVE-2014-7858: Check_login bypass vulnerability in DNR-326 - CVE-2014-7859: Buffer overflow in login_mgr.cgi and in file_sharing.cgi - CVE-2014-7860: Unauthenticated photo publish We also reported two other authentication bypass vulnerabilities (CVE-2014-7857) to D-Link; but since these problems have not been addressed correctly yet, we will only publish them after 22/06/2015. Affected devices ---------------- Main targeted devices during the assessment: - DNS-320, Revision A: 2.03, 13/05/2013 - DNS-320L, 1.03b04, 11/11/2013 - DNS-327L, 1.02, 02/07/2014 - DNR-326, 1.40b03, 7/19/2013 Other devices were influenced by one or more vulnerabilities: - DNS-320B, 1,02b01, 23/04/2014 - DNS-345, 1.03b06, 30/07/2014 - DNS-325, 1.05b03, 30/12/2013 - DNS-322L, 2.00b07 See [SL-ADV] for the complete vulnerability matrix at the time of the assessment. We note that other devices may also be vulnerable. Solution -------- Most of the vulnerabilities were fixed in: - DNS-320L 1.04.B12 - DNS-327L 1.03.B04 Some of the vulnerabilities were fixed in: - DNR-326 2.10.B03 - DNR-322L 2.10.B03 Besides installing the patches, where available, we highly recommend not to expose the web interface of the DNS and DNR devices to the internet. Since the devices use the UPnP feature, you should disable it in the router. Credits ------- These vulnerabilities were discovered and researched by Gergely Eberhardt (@ebux25) from SEARCH-LAB Ltd

CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message. Apple iOS of CoreText There is a service disruption ( Reboot and interrupt messages ) There are vulnerabilities that are put into a state. Supplementary information : CWE Vulnerability type by CWE-17: Code ( code ) Has been identified. Apple Mac OS X and iOS are prone to the following security vulnerabilities: 1. Multiple memory-corruption vulnerabilities 2. Multiple information-disclosure vulnerabilities 3. A security vulnerability 4. Multiple buffer-overflow vulnerabilities An attacker can leverage these issues to obtain sensitive information, and execute arbitrary code with system privileges. Failed exploit attempts will likely result in denial-of-service conditions. CVE-ID CVE-2015-1152 : Apple CVE-2015-1153 : Apple CVE-2015-3730 : Apple CVE-2015-3731 : Apple CVE-2015-3733 : Apple CVE-2015-3734 : Apple CVE-2015-3735 : Apple CVE-2015-3736 : Apple CVE-2015-3737 : Apple CVE-2015-3738 : Apple CVE-2015-3739 : Apple CVE-2015-3740 : Apple CVE-2015-3741 : Apple CVE-2015-3742 : Apple CVE-2015-3743 : Apple CVE-2015-3744 : Apple CVE-2015-3745 : Apple CVE-2015-3746 : Apple CVE-2015-3747 : Apple CVE-2015-3748 : Apple CVE-2015-3749 : Apple CVE-2015-5789 : Apple CVE-2015-5790 : Apple CVE-2015-5791 : Apple CVE-2015-5792 : Apple CVE-2015-5793 : Apple CVE-2015-5794 : Apple CVE-2015-5795 : Apple CVE-2015-5796 : Apple CVE-2015-5797 : Apple CVE-2015-5798 : Apple CVE-2015-5799 : Apple CVE-2015-5800 : Apple CVE-2015-5801 : Apple CVE-2015-5802 : Apple CVE-2015-5803 : Apple CVE-2015-5804 : Apple CVE-2015-5805 CVE-2015-5806 : Apple CVE-2015-5807 : Apple CVE-2015-5808 : Joe Vennix CVE-2015-5809 : Apple CVE-2015-5810 : Apple CVE-2015-5811 : Apple CVE-2015-5812 : Apple CVE-2015-5813 : Apple CVE-2015-5814 : Apple CVE-2015-5815 : Apple CVE-2015-5816 : Apple CVE-2015-5817 : Apple CVE-2015-5818 : Apple CVE-2015-5819 : Apple CVE-2015-5821 : Apple CVE-2015-5822 : Mark S. Miller of Google CVE-2015-5823 : Apple Software Update Impact: An attacker in a privileged network position may be able to obtain encrypted SMB credentials Description: A redirection issue existed in the handling of certain network connections. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-06-30-1 iOS 8.4 iOS 8.4 is now available and addresses the following: Application Store Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious universal provisioning profile app may prevent apps from launching Description: An issue existed in the install logic for universal provisioning profile apps, which allowed a collision to occur with existing bundle IDs. CVE-ID CVE-2015-3722 : Zhaofeng Chen, Hui Xue, and Tao (Lenx) Wei from FireEye, Inc. CVE-ID CVE-2015-3710 : Aaron Sigel of vtty.com, Jan Soucek MobileInstallation Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious universal provisioning profile app can prevent a Watch app from launching Description: An issue existed in the install logic for universal provisioning profile apps on the Watch which allowed a collision to occur with existing bundle IDs. CVE-ID CVE-2015-3725 : Zhaofeng Chen, Hui Xue, and Tao (Lenx) Wei from FireEye, Inc. Safari Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may compromise user information on the filesystem Description: A state management issue existed in Safari that allowed unprivileged origins to access contents on the filesystem. CVE-ID CVE-2015-1155 : Joe Vennix of Rapid7 Inc. CVE-ID CVE-2015-3726 : Matt Spisak of Endgame WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a malicious website by clicking a link may lead to user interface spoofing Description: An issue existed in the handling of the rel attribute in anchor elements. Target objects could get unauthorized access to link objects. CVE-ID CVE-2015-3659 : Peter Rutenbar working with HP's Zero Day Initiative WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A maliciously crafted website can access the WebSQL databases of other websites Description: An issue existed in the authorization checks for renaming WebSQL tables which could have allowed a maliciously crafted website to access databases belonging to other websites. CVE-ID CVE-2015-3728 : Brian W. Gray of Carnegie Mellon University, Craig Young from TripWire Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-06-30-2 OS X Yosemite v10.10.4 and Security Update 2015-005 OS X Yosemite v10.10.4 and Security Update 2015-005 are now available and address the following: Admin Framework Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A process may gain admin privileges without proper authentication Description: An issue existed when checking XPC entitlements. This issue was addressed through improved entitlement checking. CVE-ID CVE-2015-3671 : Emil Kvarnhammar at TrueSec Admin Framework Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A non-admin user may obtain admin rights Description: An issue existed in the handling of user authentication. This issue was addressed through improved error checking. CVE-ID CVE-2015-3672 : Emil Kvarnhammar at TrueSec Admin Framework Available for: OS X Yosemite v10.10 to v10.10.3 Impact: An attacker may abuse Directory Utility to gain root privileges Description: Directory Utility was able to be moved and modified to achieve code execution within an entitled process. This issue was addressed by limiting the disk location that writeconfig clients may be executed from. CVE-ID CVE-2015-3673 : Patrick Wardle of Synack, Emil Kvarnhammar at TrueSec afpserver Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the AFP server. This issue was addressed through improved memory handling. CVE-ID CVE-2015-3674 : Dean Jerkovich of NCC Group apache Available for: OS X Yosemite v10.10 to v10.10.3 Impact: An attacker may be able to access directories that are protected with HTTP authentication without knowing the correct credentials Description: The default Apache configuration did not include mod_hfs_apple. If Apache was manually enabled and the configuration was not changed, some files that should not be accessible might have been accessible using a specially crafted URL. This issue was addressed by enabling mod_hfs_apple. CVE-ID CVE-2015-3675 : Apple apache Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: Multiple vulnerabilities exist in PHP, the most serious of which may lead to arbitrary code execution Description: Multiple vulnerabilities existed in PHP versions prior to 5.5.24 and 5.4.40. These were addressed by updating PHP to versions 5.5.24 and 5.4.40. CVE-ID CVE-2015-0235 CVE-2015-0273 AppleGraphicsControl Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to determine kernel memory layout Description: An issue existed in AppleGraphicsControl which could have led to the disclosure of kernel memory layout. This issue was addressed through improved bounds checking. CVE-ID CVE-2015-3676 : Chen Liang of KEEN Team AppleFSCompression Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to determine kernel memory layout Description: An issue existed in LZVN compression that could have led to the disclosure of kernel memory content. This issue was addressed through improved memory handling. CVE-ID CVE-2015-3677 : an anonymous researcher working with HP's Zero Day Initiative AppleThunderboltEDMService Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A memory corruption issue existed in the handling of certain Thunderbolt commands from local processes. This issue was addressed through improved memory handling. CVE-ID CVE-2015-3678 : Apple ATS Available for: OS X Yosemite v10.10 to v10.10.3 Impact: Processing a maliciously crafted font file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in handling of certain fonts. These issues were addressed through improved memory handling. CVE-ID CVE-2015-3679 : Pawel Wylecial working with HP's Zero Day Initiative CVE-2015-3680 : Pawel Wylecial working with HP's Zero Day Initiative CVE-2015-3681 : John Villamil (@day6reak), Yahoo Pentest Team CVE-2015-3682 : Nuode Wei Bluetooth Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A memory corruption issue existed in the Bluetooth HCI interface. This issue was addressed through improved memory handling. CVE-ID CVE-2015-3683 : Roberto Paleari and Aristide Fattori of Emaze Networks Certificate Trust Policy Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: An attacker with a privileged network position may be able to intercept network traffic Description: An intermediate certificate was incorrectly issued by the certificate authority CNNIC. This issue was addressed through the addition of a mechanism to trust only a subset of certificates issued prior to the mis-issuance of the intermediate. Further details are available at https://support.apple.com/en-us/HT204938 Certificate Trust Policy Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Description: The certificate trust policy was updated. The complete list of certificates may be viewed at https://support.apple.com/en- us/HT202858. CFNetwork HTTPAuthentication Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: Following a maliciously crafted URL may lead to arbitrary code execution Description: A memory corruption issue existed in handling of certain URL credentials. This issue was addressed through improved memory handling. CVE-ID CVE-2015-3684 : Apple CoreText Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: Processing a maliciously crafted text file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in the processing of text files. These issues were addressed through improved bounds checking. CVE-ID CVE-2015-1157 CVE-2015-3685 : Apple CVE-2015-3686 : John Villamil (@day6reak), Yahoo Pentest Team CVE-2015-3687 : John Villamil (@day6reak), Yahoo Pentest Team CVE-2015-3688 : John Villamil (@day6reak), Yahoo Pentest Team CVE-2015-3689 : Apple coreTLS Available for: OS X Yosemite v10.10 to v10.10.3 Impact: An attacker with a privileged network position may intercept SSL/TLS connections Description: coreTLS accepted short ephemeral Diffie-Hellman (DH) keys, as used in export-strength ephemeral DH cipher suites. This issue, also known as Logjam, allowed an attacker with a privileged network position to downgrade security to 512-bit DH if the server supported an export-strength ephemeral DH cipher suite. The issue was addressed by increasing the default minimum size allowed for DH ephemeral keys to 768 bits. CVE-ID CVE-2015-4000 : The weakdh team at weakdh.org, Hanno Boeck DiskImages Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to determine kernel memory layout Description: An information disclosure issue existed in the processing of disk images. This issue was addressed through improved memory management. CVE-ID CVE-2015-3690 : Peter Rutenbar working with HP's Zero Day Initiative Display Drivers Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: An issue existed in the Monitor Control Command Set kernel extension by which a userland process could control the value of a function pointer within the kernel. The issue was addressed by removing the affected interface. CVE-ID CVE-2015-3691 : Roberto Paleari and Aristide Fattori of Emaze Networks EFI Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application with root privileges may be able to modify EFI flash memory Description: An insufficient locking issue existed with EFI flash when resuming from sleep states. This issue was addressed through improved locking. CVE-ID CVE-2015-3692 : Trammell Hudson of Two Sigma Investments, Xeno Kovah and Corey Kallenberg of LegbaCore LLC, Pedro Vilaca EFI Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may induce memory corruption to escalate privileges Description: A disturbance error, also known as Rowhammer, exists with some DDR3 RAM that could have led to memory corruption. This issue was mitigated by increasing memory refresh rates. CVE-ID CVE-2015-3693 : Mark Seaborn and Thomas Dullien of Google, working from original research by Yoongu Kim et al (2014) FontParser Available for: OS X Yosemite v10.10 to v10.10.3 Impact: Processing a maliciously crafted font file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation. CVE-ID CVE-2015-3694 : John Villamil (@day6reak), Yahoo Pentest Team Graphics Driver Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: An out of bounds write issue existed in NVIDIA graphics driver. This issue was addressed through improved bounds checking. CVE-ID CVE-2015-3712 : Ian Beer of Google Project Zero Intel Graphics Driver Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: Multiple buffer overflow issues exist in the Intel graphics driver, the most serious of which may lead to arbitrary code execution with system privileges Description: Multiple buffer overflow issues existed in the Intel graphics driver. These were addressed through additional bounds checks. CVE-ID CVE-2015-3695 : Ian Beer of Google Project Zero CVE-2015-3696 : Ian Beer of Google Project Zero CVE-2015-3697 : Ian Beer of Google Project Zero CVE-2015-3698 : Ian Beer of Google Project Zero CVE-2015-3699 : Ian Beer of Google Project Zero CVE-2015-3700 : Ian Beer of Google Project Zero CVE-2015-3701 : Ian Beer of Google Project Zero CVE-2015-3702 : KEEN Team ImageIO Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: Multiple vulnerabilities existed in libtiff, the most serious of which may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libtiff versions prior to 4.0.4. They were addressed by updating libtiff to version 4.0.4. CVE-ID CVE-2014-8127 CVE-2014-8128 CVE-2014-8129 CVE-2014-8130 ImageIO Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: Processing a maliciously crafted .tiff file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the processing of .tiff files. This issue was addressed through improved bounds checking. CVE-ID CVE-2015-3703 : Apple Install Framework Legacy Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: Several issues existed in how Install.framework's 'runner' setuid binary dropped privileges. This was addressed by properly dropping privileges. CVE-ID CVE-2015-3704 : Ian Beer of Google Project Zero IOAcceleratorFamily Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: Multiple memory corruption issues existed in IOAcceleratorFamily. These issues were addressed through improved memory handling. CVE-ID CVE-2015-3705 : KEEN Team CVE-2015-3706 : KEEN Team IOFireWireFamily Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to execute arbitrary code with system privileges Description: Multiple null pointer dereference issues existed in the FireWire driver. These issues were addressed through improved error checking. CVE-ID CVE-2015-3707 : Roberto Paleari and Aristide Fattori of Emaze Networks Kernel Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to determine kernel memory layout Description: A memory management issue existed in the handling of APIs related to kernel extensions which could have led to the disclosure of kernel memory layout. This issue was addressed through improved memory management. CVE-ID CVE-2015-3720 : Stefan Esser Kernel Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to determine kernel memory layout Description: A memory management issue existed in the handling of HFS parameters which could have led to the disclosure of kernel memory layout. This issue was addressed through improved memory management. CVE-ID CVE-2015-3721 : Ian Beer of Google Project Zero kext tools Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to overwrite arbitrary files Description: kextd followed symbolic links while creating a new file. This issue was addressed through improved handling of symbolic links. CVE-ID CVE-2015-3708 : Ian Beer of Google Project Zero kext tools Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A local user may be able to load unsigned kernel extensions Description: A time-of-check time-of-use (TOCTOU) race condition condition existed while validating the paths of kernel extensions. This issue was addressed through improved checks to validate the path of the kernel extensions. CVE-ID CVE-2015-3709 : Ian Beer of Google Project Zero Mail Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A maliciously crafted email can replace the message content with an arbitrary webpage when the message is viewed Description: An issue existed in the support for HTML email which allowed message content to be refreshed with an arbitrary webpage. The issue was addressed through restricted support for HTML content. CVE-ID CVE-2015-3710 : Aaron Sigel of vtty.com, Jan Soucek ntfs Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to determine kernel memory layout Description: An issue existed in NTFS that could have led to the disclosure of kernel memory content. This issue was addressed through improved memory handling. CVE-ID CVE-2015-3711 : Peter Rutenbar working with HP's Zero Day Initiative ntp Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: An attacker in a privileged position may be able to perform a denial of service attack against two ntp clients Description: Multiple issues existed in the authentication of ntp packets being received by configured end-points. These issues were addressed through improved connection state management. CVE-ID CVE-2015-1798 CVE-2015-1799 OpenSSL Available for: OS X Yosemite v10.10 to v10.10.3 Impact: Multiple issues exist in OpenSSL, including one that may allow an attacker to intercept connections to a server that supports export-grade ciphers Description: Multiple issues existed in OpenSSL 0.9.8zd which were addressed by updating OpenSSL to version 0.9.8zf. CVE-ID CVE-2015-0209 CVE-2015-0286 CVE-2015-0287 CVE-2015-0288 CVE-2015-0289 CVE-2015-0293 QuickTime Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: Processing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in QuickTime. These issues were addressed through improved memory handling. CVE-ID CVE-2015-3661 : G. Geshev working with HP's Zero Day Initiative CVE-2015-3662 : kdot working with HP's Zero Day Initiative CVE-2015-3663 : kdot working with HP's Zero Day Initiative CVE-2015-3666 : Steven Seeley of Source Incite working with HP's Zero Day Initiative CVE-2015-3667 : Ryan Pentney, Richard Johnson of Cisco Talos and Kai Lu of Fortinet's FortiGuard Labs, Ryan Pentney, and Richard Johnson of Cisco Talos and Kai Lu of Fortinet's FortiGuard Labs CVE-2015-3668 : Kai Lu of Fortinet's FortiGuard Labs CVE-2015-3713 : Apple Security Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A remote attacker may cause an unexpected application termination or arbitrary code execution Description: An integer overflow existed in the Security framework code for parsing S/MIME e-mail and some other signed or encrypted objects. This issue was addressed through improved validity checking. CVE-ID CVE-2013-1741 Security Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: Tampered applications may not be prevented from launching Description: Apps using custom resource rules may have been susceptible to tampering that would not have invalidated the signature. This issue was addressed with improved resource validation. CVE-ID CVE-2015-3714 : Joshua Pitts of Leviathan Security Group Security Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: A malicious application may be able to bypass code signing checks Description: An issue existed where code signing did not verify libraries loaded outside the application bundle. This issue was addressed with improved bundle verification. CVE-ID CVE-2015-3715 : Patrick Wardle of Synack Spotlight Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 to v10.10.3 Impact: Searching for a malicious file with Spotlight may lead to command injection Description: A command injection vulnerability existed in the handling of filenames of photos added to the local photo library. This issue was addressed through improved input validation. CVE-ID CVE-2015-3716 : Apple SQLite Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A remote attacker may cause an unexpected application termination or arbitrary code execution Description: Multiple buffer overflows existed in SQLite's printf implementation. These issues were addressed through improved bounds checking. CVE-ID CVE-2015-3717 : Peter Rutenbar working with HP's Zero Day Initiative System Stats Available for: OS X Yosemite v10.10 to v10.10.3 Impact: A malicious app may be able to compromise systemstatsd Description: A type confusion issue existed in systemstatsd's handling of interprocess communication. By sending a maliciously formatted message to systemstatsd, it may have been possible to execute arbitrary code as the systemstatsd process. The issue was addressed through additional type checking. CVE-ID CVE-2015-3718 : Roberto Paleari and Aristide Fattori of Emaze Networks TrueTypeScaler Available for: OS X Yosemite v10.10 to v10.10.3 Impact: Processing a maliciously crafted font file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation. CVE-ID CVE-2015-3719 : John Villamil (@day6reak), Yahoo Pentest Team zip Available for: OS X Yosemite v10.10 to v10.10.3 Impact: Extracting a maliciously crafted zip file using the unzip tool may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in the handling of zip files. These issues were addressed through improved memory handling. CVE-ID CVE-2014-8139 CVE-2014-8140 CVE-2014-8141 OS X Yosemite 10.10.4 includes the security content of Safari 8.0.7. https://support.apple.com/en-us/HT204950 OS X Yosemite 10.10.4 and Security Update 2015-005 may be obtained from the Mac App Store or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2 Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJVksFmAAoJEBcWfLTuOo7tV1AQAIYpkOMpHp181b+70sgyZ/Ue mFM527FFGDfLLuIW6LTcBsEFe9cfZxumB8eOFPirTNRK7krsVMo1W+faHXyWOnx7 kbWylHdhaoxnX+A6Gj0vP71V6TNNsTi9+2dmdmHUnwxZ7Ws5QCNKebumUG3MMXXo EKxE5SNSNKyMSSYmliS26cdl8fWrmg9qTxiZQnxjOCrg/CNAolgVIRRfdMUL7i4w aGAyrlJXOxFOuNkqdHX2luccuHFV7aW/dIXQ4MyjiRNl/bWrBQmQlneLLpPdFZlH cMfGa2/baaNaCbU/GqhNKbO4fKYVaqQWzfUrtqX0+bRv2wmOq33ARy9KE23bYTvL U4E9x9z87LsLXGAdjUi6MDe5g87DcmwIEigfF6/EHbDYa/2VvSdIa74XRv/JCN1+ aftHLotin76h4qV/dCAPf5J/Fr/1KFCM0IphhG7p+7fVTfyy7YDXNBiKCEZzLf8U TUWLUCgQhobtakqwzQJ5qyF8u63xzVXj8oeTOw6iiY/BLlj9def5LMm/z6ZKGTyC 3c4+Sy5XvBHZoeiwdcndTVpnFbmmjZRdeqtdW/zX5mHnxXPa3lZiGoBDhHQgIg6J 1tTVtnO1JSLXVYDR6Evx1EH10Vgkt2wAGTLjljSLwtckoEqc78qMAT1G5U4nFffI +gGm5FbAxjxElgA/gbaq =KLda -----END PGP SIGNATURE-----

Cross-site scripting (XSS) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27635. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue being tracked by Cisco Bug ID CSCut27635

SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028. Vendors have confirmed this vulnerability Bug ID CSCuu30028 It is released as.By any third party SQL The command may be executed. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This issue being tracked by Cisco Bug ID CSCuu30028. Cisco Unified E-mail Interaction Manager is a product used to manage a large number of customer emails submitted to corporate mailboxes or websites; Unified Web Interaction Manager can help call center business representatives use websites and text chat or real-time Web collaboration to answer customer questions product. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands

Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document, aka Bug ID CSCut95810. Cisco Finesse is prone to a remote denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition or gain access to potentially sensitive information. This issue is being tracked by Cisco Bug ID CSCut95810. Cisco Finesse is a set of call center management software developed by Cisco. The software improves call center service quality, improves customer experience, and increases agent satisfaction

The Posture module for Cisco Identity Services Engine (ISE), as distributed in Cisco AnyConnect Secure Mobility Client 4.0(64), allows local users to gain privileges via unspecified commands, aka Bug ID CSCut05797. Vendors report this vulnerability Bug ID CSCut05797 Published as. Supplementary information : CWE Vulnerability types by CWE-284: Improper Access Control ( Improper access control ) Has been identified. http://cwe.mitre.org/data/definitions/284.htmlLocal users may gain privileges via unspecified commands. An attacker can exploit this issue to gain elevated privileges on an affected device. Cisco AnyConnect Secure Mobility Client is a next-generation VPN client. This client enables remote users to securely connect to Cisco ASA 5500 devices through SSL VPN

Cisco Wireless LAN Controller (WLC) devices with software 7.4(1.1) allow remote attackers to cause a denial of service (wireless-networking outage) via crafted TCP traffic on the local network, aka Bug ID CSCug67104. The Cisco WLC is responsible for system-wide wireless LAN functions such as security policy, intrusion protection, RF management, quality of service, and mobility. Attackers can exploit this issue to cause denial-of-service condition. Attackers can exploit this issue to cause denial-of-service condition on an affected device as well as any wireless access points associated with the device, denying services to legitimate users. A security vulnerability exists in Cisco WLC devices using version 7.4(1.1) software

The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140. Vendors have confirmed this vulnerability Bug ID CSCuq23140 It is released as.By a third party Web By reading the page, important information may be obtained. Cisco Identity Services Engine Software is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information stored on an affected device. This may lead to further attacks. This issue being tracked by Cisco Bug ID CSCuq23140. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies

Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800. Vendors have confirmed this vulnerability Bug ID CSCus81800 It is released as.Denial of service operation via a packet crafted by a third party (DoS) There is a possibility of being put into a state. The Cisco IP Phone 7861 is an IP phone that can communicate with wideband audio and video. Allowing an unauthenticated remote attacker to exploit this vulnerability could cause the device to reboot, resulting in a denial of service. This issue is tracked by Cisco Bug ID CSCus81800

The PeakHMI HMI is a Human Machine Interface (HMI) application. The PeakHMI HMI has an unspecified security vulnerability that allows a remote attacker to exploit a vulnerability to submit a special request to crash an application

Kessler-Ellis is a well-known instrument manufacturer. The Infilink HMI is the Human Machine Interface (HMI) for Kessler-Ellis products. Infilink HMI has an unspecified security vulnerability that allows remote attackers to exploit a vulnerability to submit a special request to crash an application. Infilink HMI Yes Kessler-Ellis HMI of the product (HMI)