VARIoT IoT vulnerabilities database
| VAR-201410-0978 | CVE-2014-8755 | Panasonic Network Camera View WebVideoCam ActiveX Remote code execution vulnerability |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Panasonic Network Camera View 3 and 4 allows remote attackers to execute arbitrary code via a crafted page, which triggers an invalid pointer dereference, related to "the ability to nullify an arbitrary address in memory.". User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the GetImageDataPrint method of the WebVideoCam ActiveX control. The issue lies in the ability to nullify an arbitrary address in memory. An attacker can leverage this vulnerability to execute code under the context of the current process. Panasonic Network Camera View is a webcam viewing app. Failed exploit attempts will likely result in denial-of-service conditions
| VAR-201410-1415 | CVE-2014-8756 | Panasonic Network Camera Recorder Remote code execution vulnerability |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
The NcrCtl4.NcrNet.1 control in Panasonic Network Camera Recorder before 4.04R03 allows remote attackers to execute arbitrary code via a crafted GetVOLHeader method call, which writes null bytes to an arbitrary address. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within then NcrCtl4.NcrNet.1 control. An attacker can leverage this to execute arbitrary code in the context of the browser. Panasonic Network Camera is a Panasonic network camera. Failed exploit attempts will likely result in denial-of-service conditions
| VAR-201410-0066 | CVE-2014-3406 | Cisco Intrusion Prevention System Software IP Service operation interruption in logging function (DoS) Vulnerabilities |
CVSS V2: 7.1 CVSS V3: - Severity: HIGH |
Race condition in the IP logging feature in Cisco Intrusion Prevention System (IPS) Software 7.1(7)E4 and earlier allows remote attackers to cause a denial of service (device reload) via crafted IP traffic that matches a problematic rule, aka Bug ID CSCud82085. ( Device reload ) There are vulnerabilities that are put into a state. Cisco Intrusion Prevention System is prone to a remote denial-of-service vulnerability.
Attackers can exploit this issue to cause denial-of-service conditions.
This issue is being tracked by Cisco Bug ID CSCud82085. The system can immediately interrupt, adjust or isolate some abnormal or harmful network data transmission behaviors
| VAR-201410-1419 | No CVE | SAP BusinessObjects Explorer XML External Entity Injection Vulnerability (CNVD-2014-06710) |
CVSS V2: 9.0 CVSS V3: - Severity: HIGH |
Business Objects is the world's leading business intelligence (BI) software company. SAP BusinessObjects Explorer is a browser that it launched. An external XML material injection vulnerability exists in SAP BusinessObjects Explorer. An information disclosure vulnerability exists because the program failed to properly authenticate the user's input
| VAR-201410-1417 | CVE-2014-0564 | Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0558. This vulnerability CVE-2014-0558 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition. Security flaws exist in several Adobe products.
Background
==========
The Adobe Flash Player is a renderer for the SWF file format, which is
commonly used to provide interactive websites.
Please review the CVE identifiers referenced below for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Flash Player users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.418"
References
==========
[ 1 ] CVE-2014-0558
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0558
[ 2 ] CVE-2014-0564
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0564
[ 3 ] CVE-2014-0569
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0569
[ 4 ] CVE-2014-0573
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0573
[ 5 ] CVE-2014-0574
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0574
[ 6 ] CVE-2014-0576
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0576
[ 7 ] CVE-2014-0577
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0577
[ 8 ] CVE-2014-0581
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0581
[ 9 ] CVE-2014-0582
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0582
[ 10 ] CVE-2014-0583
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0583
[ 11 ] CVE-2014-0584
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0584
[ 12 ] CVE-2014-0585
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0585
[ 13 ] CVE-2014-0586
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0586
[ 14 ] CVE-2014-0588
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0588
[ 15 ] CVE-2014-0589
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0589
[ 16 ] CVE-2014-0590
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0590
[ 17 ] CVE-2014-8437
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8437
[ 18 ] CVE-2014-8438
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8438
[ 19 ] CVE-2014-8440
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8440
[ 20 ] CVE-2014-8441
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8441
[ 21 ] CVE-2014-8442
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8442
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201411-06.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2014:1648-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1648.html
Issue date: 2014-10-15
CVE Names: CVE-2014-0558 CVE-2014-0564 CVE-2014-0569
=====================================================================
1. Summary:
An updated Adobe Flash Player package that fixes multiple security issues
is now available for Red Hat Enterprise Linux 5 and 6 Supplementary.
Red Hat Product Security has rated this update as having Critical security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3. Description:
The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in. These
vulnerabilities are detailed in the Adobe Security Bulletin APSB14-22,
listed in the References section.
Multiple flaws were found in the way flash-plugin displayed certain SWF
content. An attacker could use these flaws to create a specially crafted
SWF file that would cause flash-plugin to crash or, potentially, execute
arbitrary code when the victim loaded a page containing the malicious SWF
content.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1152775 - CVE-2014-0564 CVE-2014-0558 CVE-2014-0569 flash-plugin: multiple code execution flaws (APSB14-22)
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.411-1.el5.i386.rpm
x86_64:
flash-plugin-11.2.202.411-1.el5.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.411-1.el5.i386.rpm
x86_64:
flash-plugin-11.2.202.411-1.el5.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.411-1.el6.i686.rpm
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.411-1.el6.i686.rpm
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.411-1.el6.i686.rpm
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2014-0558.html
https://www.redhat.com/security/data/cve/CVE-2014-0564.html
https://www.redhat.com/security/data/cve/CVE-2014-0569.html
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb14-22.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFUPuDGXlSAg2UNWIIRAsobAJ9vnW0PysUhlqb4KDFHcw8Q7+rzqgCePtuZ
Wum8dH3c44zrI0LJNv9/khY=
=kNs5
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
| VAR-201410-1416 | CVE-2014-0569 | Adobe Flash Player and Adobe AIR Integer overflow vulnerability |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allows attackers to execute arbitrary code via unspecified vectors. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the implementation of casi32. The issue lies in the failure to properly sanitize a user-supplied length value with a specific array implementation. An attacker can leverage this vulnerability to execute code within the context of the current process. Failed exploit attempts will likely cause a denial-of-service condition.
Background
==========
The Adobe Flash Player is a renderer for the SWF file format, which is
commonly used to provide interactive websites.
Please review the CVE identifiers referenced below for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Flash Player users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.418"
References
==========
[ 1 ] CVE-2014-0558
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0558
[ 2 ] CVE-2014-0564
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0564
[ 3 ] CVE-2014-0569
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0569
[ 4 ] CVE-2014-0573
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0573
[ 5 ] CVE-2014-0574
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0574
[ 6 ] CVE-2014-0576
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0576
[ 7 ] CVE-2014-0577
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0577
[ 8 ] CVE-2014-0581
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0581
[ 9 ] CVE-2014-0582
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0582
[ 10 ] CVE-2014-0583
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0583
[ 11 ] CVE-2014-0584
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0584
[ 12 ] CVE-2014-0585
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0585
[ 13 ] CVE-2014-0586
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0586
[ 14 ] CVE-2014-0588
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0588
[ 15 ] CVE-2014-0589
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0589
[ 16 ] CVE-2014-0590
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0590
[ 17 ] CVE-2014-8437
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8437
[ 18 ] CVE-2014-8438
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8438
[ 19 ] CVE-2014-8440
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8440
[ 20 ] CVE-2014-8441
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8441
[ 21 ] CVE-2014-8442
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8442
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201411-06.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2014:1648-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1648.html
Issue date: 2014-10-15
CVE Names: CVE-2014-0558 CVE-2014-0564 CVE-2014-0569
=====================================================================
1. Summary:
An updated Adobe Flash Player package that fixes multiple security issues
is now available for Red Hat Enterprise Linux 5 and 6 Supplementary.
Red Hat Product Security has rated this update as having Critical security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3. These
vulnerabilities are detailed in the Adobe Security Bulletin APSB14-22,
listed in the References section.
Multiple flaws were found in the way flash-plugin displayed certain SWF
content. An attacker could use these flaws to create a specially crafted
SWF file that would cause flash-plugin to crash or, potentially, execute
arbitrary code when the victim loaded a page containing the malicious SWF
content.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1152775 - CVE-2014-0564 CVE-2014-0558 CVE-2014-0569 flash-plugin: multiple code execution flaws (APSB14-22)
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.411-1.el5.i386.rpm
x86_64:
flash-plugin-11.2.202.411-1.el5.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.411-1.el5.i386.rpm
x86_64:
flash-plugin-11.2.202.411-1.el5.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.411-1.el6.i686.rpm
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.411-1.el6.i686.rpm
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.411-1.el6.i686.rpm
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2014-0558.html
https://www.redhat.com/security/data/cve/CVE-2014-0564.html
https://www.redhat.com/security/data/cve/CVE-2014-0569.html
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb14-22.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFUPuDGXlSAg2UNWIIRAsobAJ9vnW0PysUhlqb4KDFHcw8Q7+rzqgCePtuZ
Wum8dH3c44zrI0LJNv9/khY=
=kNs5
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
| VAR-201410-1044 | CVE-2014-0558 | Adobe Flash Player and Adobe AIR Vulnerable to arbitrary code execution |
CVSS V2: 10.0 CVSS V3: - Severity: HIGH |
Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0564. This vulnerability CVE-2014-0564 Is a different vulnerability.An attacker could execute arbitrary code or cause a denial of service ( Memory corruption ) There is a possibility of being put into a state.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition. Security flaws exist in several Adobe products.
Background
==========
The Adobe Flash Player is a renderer for the SWF file format, which is
commonly used to provide interactive websites.
Please review the CVE identifiers referenced below for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Flash Player users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=www-plugins/adobe-flash-11.2.202.418"
References
==========
[ 1 ] CVE-2014-0558
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0558
[ 2 ] CVE-2014-0564
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0564
[ 3 ] CVE-2014-0569
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0569
[ 4 ] CVE-2014-0573
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0573
[ 5 ] CVE-2014-0574
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0574
[ 6 ] CVE-2014-0576
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0576
[ 7 ] CVE-2014-0577
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0577
[ 8 ] CVE-2014-0581
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0581
[ 9 ] CVE-2014-0582
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0582
[ 10 ] CVE-2014-0583
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0583
[ 11 ] CVE-2014-0584
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0584
[ 12 ] CVE-2014-0585
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0585
[ 13 ] CVE-2014-0586
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0586
[ 14 ] CVE-2014-0588
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0588
[ 15 ] CVE-2014-0589
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0589
[ 16 ] CVE-2014-0590
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0590
[ 17 ] CVE-2014-8437
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8437
[ 18 ] CVE-2014-8438
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8438
[ 19 ] CVE-2014-8440
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8440
[ 20 ] CVE-2014-8441
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8441
[ 21 ] CVE-2014-8442
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8442
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201411-06.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: flash-plugin security update
Advisory ID: RHSA-2014:1648-01
Product: Red Hat Enterprise Linux Supplementary
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1648.html
Issue date: 2014-10-15
CVE Names: CVE-2014-0558 CVE-2014-0564 CVE-2014-0569
=====================================================================
1. Summary:
An updated Adobe Flash Player package that fixes multiple security issues
is now available for Red Hat Enterprise Linux 5 and 6 Supplementary.
Red Hat Product Security has rated this update as having Critical security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Desktop Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux HPC Node Supplementary (v. 6) - x86_64
Red Hat Enterprise Linux Server Supplementary (v. 5) - i386, x86_64
Red Hat Enterprise Linux Server Supplementary (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Supplementary (v. 6) - i386, x86_64
3. Description:
The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash
Player web browser plug-in. These
vulnerabilities are detailed in the Adobe Security Bulletin APSB14-22,
listed in the References section.
Multiple flaws were found in the way flash-plugin displayed certain SWF
content. An attacker could use these flaws to create a specially crafted
SWF file that would cause flash-plugin to crash or, potentially, execute
arbitrary code when the victim loaded a page containing the malicious SWF
content.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1152775 - CVE-2014-0564 CVE-2014-0558 CVE-2014-0569 flash-plugin: multiple code execution flaws (APSB14-22)
6. Package List:
Red Hat Enterprise Linux Desktop Supplementary (v. 5):
i386:
flash-plugin-11.2.202.411-1.el5.i386.rpm
x86_64:
flash-plugin-11.2.202.411-1.el5.i386.rpm
Red Hat Enterprise Linux Server Supplementary (v. 5):
i386:
flash-plugin-11.2.202.411-1.el5.i386.rpm
x86_64:
flash-plugin-11.2.202.411-1.el5.i386.rpm
Red Hat Enterprise Linux Desktop Supplementary (v. 6):
i386:
flash-plugin-11.2.202.411-1.el6.i686.rpm
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
Red Hat Enterprise Linux HPC Node Supplementary (v. 6):
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
Red Hat Enterprise Linux Server Supplementary (v. 6):
i386:
flash-plugin-11.2.202.411-1.el6.i686.rpm
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
Red Hat Enterprise Linux Workstation Supplementary (v. 6):
i386:
flash-plugin-11.2.202.411-1.el6.i686.rpm
x86_64:
flash-plugin-11.2.202.411-1.el6.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2014-0558.html
https://www.redhat.com/security/data/cve/CVE-2014-0564.html
https://www.redhat.com/security/data/cve/CVE-2014-0569.html
https://access.redhat.com/security/updates/classification/#critical
https://helpx.adobe.com/security/products/flash-player/apsb14-22.html
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFUPuDGXlSAg2UNWIIRAsobAJ9vnW0PysUhlqb4KDFHcw8Q7+rzqgCePtuZ
Wum8dH3c44zrI0LJNv9/khY=
=kNs5
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
| VAR-201410-0965 | CVE-2014-6478 | Oracle MySQL of MySQL Server In SERVER:SSL:yaSSL Vulnerabilities |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect integrity via vectors related to SERVER:SSL:yaSSL.
The vulnerability can be exploited over the 'MySQL Protocol' protocol. The 'SERVER:SSL:yaSSL' sub component is affected.
This vulnerability affects the following supported versions:
5.5.39 and earlier, 5.6.20 and earlier. The database system has the characteristics of high performance, low cost and good reliability. A remote attacker could exploit this vulnerability to update, insert, and delete data, affecting data integrity. ============================================================================
Ubuntu Security Notice USN-2384-1
October 15, 2014
mysql-5.5 vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-5.5: MySQL database
Details:
Multiple security issues were discovered in MySQL and this update includes
a new upstream MySQL version to fix these issues. MySQL has been updated to
5.5.40.
In addition to security fixes, the updated packages contain bug fixes,
new features, and possibly incompatible changes.
Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.12.04.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2384-1
CVE-2012-5615, CVE-2014-4274, CVE-2014-4287, CVE-2014-6463,
CVE-2014-6464, CVE-2014-6469, CVE-2014-6478, CVE-2014-6484,
CVE-2014-6491, CVE-2014-6494, CVE-2014-6495, CVE-2014-6496,
CVE-2014-6500, CVE-2014-6505, CVE-2014-6507, CVE-2014-6520,
CVE-2014-6530, CVE-2014-6551, CVE-2014-6555, CVE-2014-6559
Package Information:
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.12.04.1
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3054-1 security@debian.org
http://www.debian.org/security/ Salvatore Bonaccorso
October 20, 2014 http://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : mysql-5.5
CVE ID : CVE-2012-5615 CVE-2014-4274 CVE-2014-4287 CVE-2014-6463
CVE-2014-6464 CVE-2014-6469 CVE-2014-6478 CVE-2014-6484
CVE-2014-6491 CVE-2014-6494 CVE-2014-6495 CVE-2014-6496
CVE-2014-6500 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520
CVE-2014-6530 CVE-2014-6551 CVE-2014-6555 CVE-2014-6559
Debian Bug : 765663
Several issues have been discovered in the MySQL database server. Please see the MySQL 5.5 Release Notes and Oracle's
Critical Patch Update advisory for further details:
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
For the stable distribution (wheezy), these problems have been fixed in
version 5.5.40-0+wheezy1.
For the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your mysql-5.5 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJURSC7AAoJEAVMuPMTQ89EasQP/RxXHja/33Mofs2nZY2T0c++
BblmAs1D8t1csPTPjPGC2UFrBNWvvKSintqHid1W34ulFQahR+Uw0t6vuNOKoVnh
oBnayvOkAl2R6EcMS3DrdEPCgmj6NGC6QNG2Qt43a5tYdR3YCBTCMhPcHoIM6m3J
eQH/3UetTKrxvqM0nXNjTcVppdHUzKP3b2W/DRP90X0qtD5DdkqEqh12rCZVBvnO
b3AegaZ/PoEnmzqXkLIpRs2Dtx9P/dWeL9vCDZN0X6h+NSJzXYd0YfjfEIYldSXI
vKHIXFyno69pelQ7YoUA/+XKyVbvZzPL1STgV9dJtHWUi4TMR9VgIFuJMVaBoNDR
YTcfN61CfOkhUI45PhEp+mprlKVwwrLXrR/R5g4dHr28EmdQmvIJOOtxbUJAUd0m
y7q5PUuXWuVC54Kjm51m249dNY8IMgBAiIdrvlQyQiOL28Wgc0z2+IWFZnSL8eSH
5l8jKi20x6BYNIKQHWBqt2s4yej39dNaiNnCGqnUUOCzrbpfY1xzP25GPtQo+jVc
+1IygdKN8SG3S5FTQcHsND4C2cb3A9Tgf2gwffVrQq0TyQvXQbGjWN+xh4FAhU/D
ysAYdd2zPQGd+9OAE/Ja1uMZ2NY/CTzn9y5Or6eTCLpDmNFN28MsvQ9SAkAWVKe8
SgOwAiXo3xRUsGy6UiHm
=j4S6
-----END PGP SIGNATURE-----
| VAR-201410-0834 | CVE-2014-6500 | Oracle MySQL of MySQL Server In SERVER:SSL:yaSSL Vulnerabilities |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6491. This vulnerability CVE-2014-6491 Is a different vulnerability.Information is obtained by a third party, information is altered, and service operation is interrupted. (DoS) An attack may be carried out.
The vulnerability can be exploited over the 'MySQL Protocol' protocol. The 'SERVER:SSL:yaSSL' sub component is affected.
This vulnerability affects the following supported versions:
5.5.39 and earlier, 5.6.20 and earlier. The database system has the characteristics of high performance, low cost and good reliability. ============================================================================
Ubuntu Security Notice USN-2384-1
October 15, 2014
mysql-5.5 vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-5.5: MySQL database
Details:
Multiple security issues were discovered in MySQL and this update includes
a new upstream MySQL version to fix these issues. MySQL has been updated to
5.5.40.
Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.12.04.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2384-1
CVE-2012-5615, CVE-2014-4274, CVE-2014-4287, CVE-2014-6463,
CVE-2014-6464, CVE-2014-6469, CVE-2014-6478, CVE-2014-6484,
CVE-2014-6491, CVE-2014-6494, CVE-2014-6495, CVE-2014-6496,
CVE-2014-6500, CVE-2014-6505, CVE-2014-6507, CVE-2014-6520,
CVE-2014-6530, CVE-2014-6551, CVE-2014-6555, CVE-2014-6559
Package Information:
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.12.04.1
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] mariadb (SSA:2014-307-01)
New mariadb packages are available for Slackware 14.1 and -current to
fix security issues.
Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/mariadb-5.5.40-i486-1_slack14.1.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6507
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6500
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6469
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6559
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6496
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6464
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mariadb-5.5.40-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mariadb-5.5.40-x86_64-1_slack14.1.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/mariadb-5.5.40-i486-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ap/mariadb-5.5.40-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 14.1 package:
da0aff5bebbbdc0621359c0fea027ae6 mariadb-5.5.40-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
dbb7d695a22ae538b5ad9c024823b190 mariadb-5.5.40-x86_64-1_slack14.1.txz
Slackware -current package:
f9ca4cf6015ddbb73dfba16c535caffc ap/mariadb-5.5.40-i486-1.txz
Slackware x86_64 -current package:
6924f64b6c147556a58a2c6f1929ab5e ap/mariadb-5.5.40-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg mariadb-5.5.40-i486-1_slack14.1.txz
Then, restart the database server:
# sh /etc/rc.d/rc.mysqld restart
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlRYJz0ACgkQakRjwEAQIjPqygCeN1AAAJQbjyTDPKmJlNj5+1Qw
3IkAn3kpZO670aM3MoWqkCEfyHX4gXXu
=11Km
-----END PGP SIGNATURE-----
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: MySQL, MariaDB: Multiple vulnerabilities
Date: November 05, 2014
Bugs: #525504
ID: 201411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in the MySQL and MariaDB,
possibly allowing attackers to cause unspecified impact.
Background
==========
MySQL is a popular multi-threaded, multi-user SQL server. MariaDB is an
enhanced, drop-in replacement for MySQL.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-db/mysql < 5.5.40 >= 5.5.40
2 dev-db/mariadb < 5.5.40-r1 >= 5.5.40-r1
-------------------------------------------------------------------
2 affected packages
Description
===========
Multiple unspecified vulnerabilities have been discovered in MySQL.
Please review the CVE identifiers referenced below for details.
Impact
======
A remote attacker could exploit these vulnerabilities to cause
unspecified impact, possibly including remote execution of arbitrary
code, Denial of Service, or disclosure of sensitive information.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All MySQL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mysql-5.5.40"
All MariaDB users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mariadb-5.5.40-r1"
References
==========
[ 1 ] CVE-2014-6464
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6464
[ 2 ] CVE-2014-6469
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6469
[ 3 ] CVE-2014-6491
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6491
[ 4 ] CVE-2014-6494
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6494
[ 5 ] CVE-2014-6496
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6496
[ 6 ] CVE-2014-6500
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6500
[ 7 ] CVE-2014-6507
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6507
[ 8 ] CVE-2014-6555
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6555
[ 9 ] CVE-2014-6559
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6559
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201411-02.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. Please see the MySQL 5.5 Release Notes and Oracle's
Critical Patch Update advisory for further details:
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
For the stable distribution (wheezy), these problems have been fixed in
version 5.5.40-0+wheezy1.
For the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your mysql-5.5 packages
| VAR-201410-0829 | CVE-2014-6495 | Oracle MySQL of MySQL Server In SERVER:SSL:yaSSL Vulnerabilities |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote attackers to affect availability via vectors related to SERVER:SSL:yaSSL.
The vulnerability can be exploited over the 'MySQL Protocol' protocol. The 'SERVER:SSL:yaSSL' sub component is affected.
This vulnerability affects the following supported versions:
5.5.39 and earlier, 5.6.20 and earlier. The database system has the characteristics of high performance, low cost and good reliability. ============================================================================
Ubuntu Security Notice USN-2384-1
October 15, 2014
mysql-5.5 vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-5.5: MySQL database
Details:
Multiple security issues were discovered in MySQL and this update includes
a new upstream MySQL version to fix these issues. MySQL has been updated to
5.5.40.
In addition to security fixes, the updated packages contain bug fixes,
new features, and possibly incompatible changes.
Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.12.04.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2384-1
CVE-2012-5615, CVE-2014-4274, CVE-2014-4287, CVE-2014-6463,
CVE-2014-6464, CVE-2014-6469, CVE-2014-6478, CVE-2014-6484,
CVE-2014-6491, CVE-2014-6494, CVE-2014-6495, CVE-2014-6496,
CVE-2014-6500, CVE-2014-6505, CVE-2014-6507, CVE-2014-6520,
CVE-2014-6530, CVE-2014-6551, CVE-2014-6555, CVE-2014-6559
Package Information:
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.12.04.1
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3054-1 security@debian.org
http://www.debian.org/security/ Salvatore Bonaccorso
October 20, 2014 http://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : mysql-5.5
CVE ID : CVE-2012-5615 CVE-2014-4274 CVE-2014-4287 CVE-2014-6463
CVE-2014-6464 CVE-2014-6469 CVE-2014-6478 CVE-2014-6484
CVE-2014-6491 CVE-2014-6494 CVE-2014-6495 CVE-2014-6496
CVE-2014-6500 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520
CVE-2014-6530 CVE-2014-6551 CVE-2014-6555 CVE-2014-6559
Debian Bug : 765663
Several issues have been discovered in the MySQL database server. Please see the MySQL 5.5 Release Notes and Oracle's
Critical Patch Update advisory for further details:
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
For the stable distribution (wheezy), these problems have been fixed in
version 5.5.40-0+wheezy1.
For the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your mysql-5.5 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJURSC7AAoJEAVMuPMTQ89EasQP/RxXHja/33Mofs2nZY2T0c++
BblmAs1D8t1csPTPjPGC2UFrBNWvvKSintqHid1W34ulFQahR+Uw0t6vuNOKoVnh
oBnayvOkAl2R6EcMS3DrdEPCgmj6NGC6QNG2Qt43a5tYdR3YCBTCMhPcHoIM6m3J
eQH/3UetTKrxvqM0nXNjTcVppdHUzKP3b2W/DRP90X0qtD5DdkqEqh12rCZVBvnO
b3AegaZ/PoEnmzqXkLIpRs2Dtx9P/dWeL9vCDZN0X6h+NSJzXYd0YfjfEIYldSXI
vKHIXFyno69pelQ7YoUA/+XKyVbvZzPL1STgV9dJtHWUi4TMR9VgIFuJMVaBoNDR
YTcfN61CfOkhUI45PhEp+mprlKVwwrLXrR/R5g4dHr28EmdQmvIJOOtxbUJAUd0m
y7q5PUuXWuVC54Kjm51m249dNY8IMgBAiIdrvlQyQiOL28Wgc0z2+IWFZnSL8eSH
5l8jKi20x6BYNIKQHWBqt2s4yej39dNaiNnCGqnUUOCzrbpfY1xzP25GPtQo+jVc
+1IygdKN8SG3S5FTQcHsND4C2cb3A9Tgf2gwffVrQq0TyQvXQbGjWN+xh4FAhU/D
ysAYdd2zPQGd+9OAE/Ja1uMZ2NY/CTzn9y5Or6eTCLpDmNFN28MsvQ9SAkAWVKe8
SgOwAiXo3xRUsGy6UiHm
=j4S6
-----END PGP SIGNATURE-----
| VAR-201410-0830 | CVE-2014-6496 | Oracle MySQL of MySQL Server In CLIENT:SSL:yaSSL Vulnerabilities |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6494. This vulnerability CVE-2014-6494 Is a different vulnerability.Service disruption by a third party (DoS) An attack may be carried out.
The vulnerability can be exploited over the 'MySQL Protocol' protocol. The 'CLIENT:SSL:yaSSL' sub component is affected.
This vulnerability affects the following supported versions:
5.5.39 and earlier, 5.6.20 and earlier. The database system has the characteristics of high performance, low cost and good reliability. ============================================================================
Ubuntu Security Notice USN-2384-1
October 15, 2014
mysql-5.5 vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-5.5: MySQL database
Details:
Multiple security issues were discovered in MySQL and this update includes
a new upstream MySQL version to fix these issues. MySQL has been updated to
5.5.40.
Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.12.04.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2384-1
CVE-2012-5615, CVE-2014-4274, CVE-2014-4287, CVE-2014-6463,
CVE-2014-6464, CVE-2014-6469, CVE-2014-6478, CVE-2014-6484,
CVE-2014-6491, CVE-2014-6494, CVE-2014-6495, CVE-2014-6496,
CVE-2014-6500, CVE-2014-6505, CVE-2014-6507, CVE-2014-6520,
CVE-2014-6530, CVE-2014-6551, CVE-2014-6555, CVE-2014-6559
Package Information:
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.12.04.1
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] mariadb (SSA:2014-307-01)
New mariadb packages are available for Slackware 14.1 and -current to
fix security issues.
Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/mariadb-5.5.40-i486-1_slack14.1.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6507
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6500
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6469
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6559
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6496
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6464
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mariadb-5.5.40-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mariadb-5.5.40-x86_64-1_slack14.1.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/mariadb-5.5.40-i486-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ap/mariadb-5.5.40-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 14.1 package:
da0aff5bebbbdc0621359c0fea027ae6 mariadb-5.5.40-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
dbb7d695a22ae538b5ad9c024823b190 mariadb-5.5.40-x86_64-1_slack14.1.txz
Slackware -current package:
f9ca4cf6015ddbb73dfba16c535caffc ap/mariadb-5.5.40-i486-1.txz
Slackware x86_64 -current package:
6924f64b6c147556a58a2c6f1929ab5e ap/mariadb-5.5.40-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg mariadb-5.5.40-i486-1_slack14.1.txz
Then, restart the database server:
# sh /etc/rc.d/rc.mysqld restart
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlRYJz0ACgkQakRjwEAQIjPqygCeN1AAAJQbjyTDPKmJlNj5+1Qw
3IkAn3kpZO670aM3MoWqkCEfyHX4gXXu
=11Km
-----END PGP SIGNATURE-----
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: MySQL, MariaDB: Multiple vulnerabilities
Date: November 05, 2014
Bugs: #525504
ID: 201411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in the MySQL and MariaDB,
possibly allowing attackers to cause unspecified impact.
Background
==========
MySQL is a popular multi-threaded, multi-user SQL server. MariaDB is an
enhanced, drop-in replacement for MySQL.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-db/mysql < 5.5.40 >= 5.5.40
2 dev-db/mariadb < 5.5.40-r1 >= 5.5.40-r1
-------------------------------------------------------------------
2 affected packages
Description
===========
Multiple unspecified vulnerabilities have been discovered in MySQL.
Please review the CVE identifiers referenced below for details.
Impact
======
A remote attacker could exploit these vulnerabilities to cause
unspecified impact, possibly including remote execution of arbitrary
code, Denial of Service, or disclosure of sensitive information.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All MySQL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mysql-5.5.40"
All MariaDB users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mariadb-5.5.40-r1"
References
==========
[ 1 ] CVE-2014-6464
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6464
[ 2 ] CVE-2014-6469
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6469
[ 3 ] CVE-2014-6491
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6491
[ 4 ] CVE-2014-6494
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6494
[ 5 ] CVE-2014-6496
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6496
[ 6 ] CVE-2014-6500
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6500
[ 7 ] CVE-2014-6507
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6507
[ 8 ] CVE-2014-6555
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6555
[ 9 ] CVE-2014-6559
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6559
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201411-02.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. Please see the MySQL 5.5 Release Notes and Oracle's
Critical Patch Update advisory for further details:
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
For the stable distribution (wheezy), these problems have been fixed in
version 5.5.40-0+wheezy1.
For the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your mysql-5.5 packages
| VAR-201410-0828 | CVE-2014-6494 | Oracle MySQL of MySQL Server In CLIENT:SSL:yaSSL Vulnerabilities |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect availability via vectors related to CLIENT:SSL:yaSSL, a different vulnerability than CVE-2014-6496. This vulnerability CVE-2014-6496 Is a different vulnerability.Service disruption by a third party (DoS) An attack may be carried out.
The vulnerability can be exploited over the 'MySQL Protocol' protocol. The 'CLIENT:SSL:yaSSL' sub component is affected.
This vulnerability affects the following supported versions:
5.5.39 and earlier, 5.6.20 and earlier. The database system has the characteristics of high performance, low cost and good reliability. ============================================================================
Ubuntu Security Notice USN-2384-1
October 15, 2014
mysql-5.5 vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-5.5: MySQL database
Details:
Multiple security issues were discovered in MySQL and this update includes
a new upstream MySQL version to fix these issues. MySQL has been updated to
5.5.40.
Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.12.04.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2384-1
CVE-2012-5615, CVE-2014-4274, CVE-2014-4287, CVE-2014-6463,
CVE-2014-6464, CVE-2014-6469, CVE-2014-6478, CVE-2014-6484,
CVE-2014-6491, CVE-2014-6494, CVE-2014-6495, CVE-2014-6496,
CVE-2014-6500, CVE-2014-6505, CVE-2014-6507, CVE-2014-6520,
CVE-2014-6530, CVE-2014-6551, CVE-2014-6555, CVE-2014-6559
Package Information:
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.12.04.1
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] mariadb (SSA:2014-307-01)
New mariadb packages are available for Slackware 14.1 and -current to
fix security issues.
Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/mariadb-5.5.40-i486-1_slack14.1.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6507
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6500
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6469
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6559
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6496
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6464
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mariadb-5.5.40-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mariadb-5.5.40-x86_64-1_slack14.1.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/mariadb-5.5.40-i486-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ap/mariadb-5.5.40-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 14.1 package:
da0aff5bebbbdc0621359c0fea027ae6 mariadb-5.5.40-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
dbb7d695a22ae538b5ad9c024823b190 mariadb-5.5.40-x86_64-1_slack14.1.txz
Slackware -current package:
f9ca4cf6015ddbb73dfba16c535caffc ap/mariadb-5.5.40-i486-1.txz
Slackware x86_64 -current package:
6924f64b6c147556a58a2c6f1929ab5e ap/mariadb-5.5.40-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg mariadb-5.5.40-i486-1_slack14.1.txz
Then, restart the database server:
# sh /etc/rc.d/rc.mysqld restart
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlRYJz0ACgkQakRjwEAQIjPqygCeN1AAAJQbjyTDPKmJlNj5+1Qw
3IkAn3kpZO670aM3MoWqkCEfyHX4gXXu
=11Km
-----END PGP SIGNATURE-----
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: MySQL, MariaDB: Multiple vulnerabilities
Date: November 05, 2014
Bugs: #525504
ID: 201411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in the MySQL and MariaDB,
possibly allowing attackers to cause unspecified impact.
Background
==========
MySQL is a popular multi-threaded, multi-user SQL server. MariaDB is an
enhanced, drop-in replacement for MySQL.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-db/mysql < 5.5.40 >= 5.5.40
2 dev-db/mariadb < 5.5.40-r1 >= 5.5.40-r1
-------------------------------------------------------------------
2 affected packages
Description
===========
Multiple unspecified vulnerabilities have been discovered in MySQL.
Please review the CVE identifiers referenced below for details.
Impact
======
A remote attacker could exploit these vulnerabilities to cause
unspecified impact, possibly including remote execution of arbitrary
code, Denial of Service, or disclosure of sensitive information.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All MySQL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mysql-5.5.40"
All MariaDB users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mariadb-5.5.40-r1"
References
==========
[ 1 ] CVE-2014-6464
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6464
[ 2 ] CVE-2014-6469
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6469
[ 3 ] CVE-2014-6491
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6491
[ 4 ] CVE-2014-6494
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6494
[ 5 ] CVE-2014-6496
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6496
[ 6 ] CVE-2014-6500
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6500
[ 7 ] CVE-2014-6507
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6507
[ 8 ] CVE-2014-6555
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6555
[ 9 ] CVE-2014-6559
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6559
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201411-02.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. Please see the MySQL 5.5 Release Notes and Oracle's
Critical Patch Update advisory for further details:
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
For the stable distribution (wheezy), these problems have been fixed in
version 5.5.40-0+wheezy1.
For the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your mysql-5.5 packages
| VAR-201410-0825 | CVE-2014-6491 | Oracle MySQL of MySQL Server In SERVER:SSL:yaSSL Vulnerabilities |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to SERVER:SSL:yaSSL, a different vulnerability than CVE-2014-6500. This vulnerability CVE-2014-6500 Is a different vulnerability.Information is obtained by a third party, information is altered, and service operation is interrupted. (DoS) An attack may be carried out.
The vulnerability can be exploited over the 'MySQL Protocol' protocol. The 'SERVER:SSL:yaSSL' sub component is affected.
This vulnerability affects the following supported versions:
5.5.39 and earlier, 5.6.20 and earlier. The database system has the characteristics of high performance, low cost and good reliability. ============================================================================
Ubuntu Security Notice USN-2384-1
October 15, 2014
mysql-5.5 vulnerabilities
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-5.5: MySQL database
Details:
Multiple security issues were discovered in MySQL and this update includes
a new upstream MySQL version to fix these issues. MySQL has been updated to
5.5.40.
Please see the following for more information:
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.14.04.1
Ubuntu 12.04 LTS:
mysql-server-5.5 5.5.40-0ubuntu0.12.04.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2384-1
CVE-2012-5615, CVE-2014-4274, CVE-2014-4287, CVE-2014-6463,
CVE-2014-6464, CVE-2014-6469, CVE-2014-6478, CVE-2014-6484,
CVE-2014-6491, CVE-2014-6494, CVE-2014-6495, CVE-2014-6496,
CVE-2014-6500, CVE-2014-6505, CVE-2014-6507, CVE-2014-6520,
CVE-2014-6530, CVE-2014-6551, CVE-2014-6555, CVE-2014-6559
Package Information:
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/mysql-5.5/5.5.40-0ubuntu0.12.04.1
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] mariadb (SSA:2014-307-01)
New mariadb packages are available for Slackware 14.1 and -current to
fix security issues.
Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/mariadb-5.5.40-i486-1_slack14.1.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6507
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6500
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6469
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6559
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6496
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6464
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mariadb-5.5.40-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mariadb-5.5.40-x86_64-1_slack14.1.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/mariadb-5.5.40-i486-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ap/mariadb-5.5.40-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 14.1 package:
da0aff5bebbbdc0621359c0fea027ae6 mariadb-5.5.40-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
dbb7d695a22ae538b5ad9c024823b190 mariadb-5.5.40-x86_64-1_slack14.1.txz
Slackware -current package:
f9ca4cf6015ddbb73dfba16c535caffc ap/mariadb-5.5.40-i486-1.txz
Slackware x86_64 -current package:
6924f64b6c147556a58a2c6f1929ab5e ap/mariadb-5.5.40-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg mariadb-5.5.40-i486-1_slack14.1.txz
Then, restart the database server:
# sh /etc/rc.d/rc.mysqld restart
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlRYJz0ACgkQakRjwEAQIjPqygCeN1AAAJQbjyTDPKmJlNj5+1Qw
3IkAn3kpZO670aM3MoWqkCEfyHX4gXXu
=11Km
-----END PGP SIGNATURE-----
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: MySQL, MariaDB: Multiple vulnerabilities
Date: November 05, 2014
Bugs: #525504
ID: 201411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in the MySQL and MariaDB,
possibly allowing attackers to cause unspecified impact.
Background
==========
MySQL is a popular multi-threaded, multi-user SQL server. MariaDB is an
enhanced, drop-in replacement for MySQL.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-db/mysql < 5.5.40 >= 5.5.40
2 dev-db/mariadb < 5.5.40-r1 >= 5.5.40-r1
-------------------------------------------------------------------
2 affected packages
Description
===========
Multiple unspecified vulnerabilities have been discovered in MySQL.
Please review the CVE identifiers referenced below for details.
Impact
======
A remote attacker could exploit these vulnerabilities to cause
unspecified impact, possibly including remote execution of arbitrary
code, Denial of Service, or disclosure of sensitive information.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All MySQL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mysql-5.5.40"
All MariaDB users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mariadb-5.5.40-r1"
References
==========
[ 1 ] CVE-2014-6464
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6464
[ 2 ] CVE-2014-6469
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6469
[ 3 ] CVE-2014-6491
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6491
[ 4 ] CVE-2014-6494
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6494
[ 5 ] CVE-2014-6496
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6496
[ 6 ] CVE-2014-6500
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6500
[ 7 ] CVE-2014-6507
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6507
[ 8 ] CVE-2014-6555
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6555
[ 9 ] CVE-2014-6559
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6559
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201411-02.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
. Please see the MySQL 5.5 Release Notes and Oracle's
Critical Patch Update advisory for further details:
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
https://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
For the stable distribution (wheezy), these problems have been fixed in
version 5.5.40-0+wheezy1.
For the unstable distribution (sid), these problems will be fixed soon.
We recommend that you upgrade your mysql-5.5 packages
| VAR-201410-0859 | CVE-2014-6559 | Oracle MySQL Server Security hole |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING. Oracle MySQL Server is prone to a remote security vulnerability.
The vulnerability can be exploited over the 'MySQL Protocol' protocol. The 'C API SSL CERTIFICATE HANDLING' sub component is affected.
This vulnerability affects the following supported versions:
5.5.39 and earlier, 5.6.20 and earlier. The database system has the characteristics of high performance, low cost and good reliability.
Additionally MariaDB 5.5.40 removed the bundled copy of jemalloc from
the source tarball and only builds with jemalloc if a system copy
of the jemalloc library is detecting during the build. The verification
of md5 checksums and GPG signatures is performed automatically for you. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFUT0QSmqjQ0CJFipgRAmnhAKCOd9QLoxRrlcA8U4XLA46+ZhjfFwCfQzhY
tRKQjAv7QAJqbwipIkIIC8Q=
=uyHd
-----END PGP SIGNATURE-----
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: mariadb security update
Advisory ID: RHSA-2014:1861-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2014-1861.html
Issue date: 2014-11-17
CVE Names: CVE-2014-2494 CVE-2014-4207 CVE-2014-4243
CVE-2014-4258 CVE-2014-4260 CVE-2014-4274
CVE-2014-4287 CVE-2014-6463 CVE-2014-6464
CVE-2014-6469 CVE-2014-6484 CVE-2014-6505
CVE-2014-6507 CVE-2014-6520 CVE-2014-6530
CVE-2014-6551 CVE-2014-6555 CVE-2014-6559
=====================================================================
1. Summary:
Updated mariadb packages that fix several security issues are now available
for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
3. Description:
MariaDB is a multi-user, multi-threaded SQL database server that is binary
compatible with MySQL.
This update fixes several vulnerabilities in the MariaDB database server.
Information about these flaws can be found on the Oracle Critical Patch
Update Advisory page, listed in the References section. (CVE-2014-2494,
CVE-2014-4207, CVE-2014-4243, CVE-2014-4258, CVE-2014-4260, CVE-2014-4287,
CVE-2014-4274, CVE-2014-6463, CVE-2014-6464, CVE-2014-6469, CVE-2014-6484,
CVE-2014-6505, CVE-2014-6507, CVE-2014-6520, CVE-2014-6530, CVE-2014-6551,
CVE-2014-6555, CVE-2014-6559)
These updated packages upgrade MariaDB to version 5.5.40. Refer to the
MariaDB Release Notes listed in the References section for a complete list
of changes.
All MariaDB users should upgrade to these updated packages, which correct
these issues. After installing this update, the MariaDB server daemon
(mysqld) will be restarted automatically.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1120382 - CVE-2014-2494 mysql: unspecified vulnerability related to ENARC (CPU July 2014)
1120383 - CVE-2014-4207 mysql: unspecified vulnerability related to SROPTZR (CPU July 2014)
1120385 - CVE-2014-4243 mysql: unspecified vulnerability related to ENFED (CPU July 2014)
1120387 - CVE-2014-4258 mysql: unspecified vulnerability related to SRINFOSC (CPU July 2014)
1120388 - CVE-2014-4260 mysql: unspecified vulnerability related to SRCHAR (CPU July 2014)
1126271 - CVE-2014-4274 mysql: unspecified MyISAM temporary file issue fixed in 5.5.39 and 5.6.20
1153461 - CVE-2014-4287 mysql: unspecified vulnerability related to SERVER:CHARACTER SETS (CPU October 2014)
1153462 - CVE-2014-6463 mysql: unspecified vulnerability related to SERVER:REPLICATION ROW FORMAT BINARY LOG DML (CPU October 2014)
1153463 - CVE-2014-6464 mysql: unspecified vulnerability related to SERVER:INNODB DML FOREIGN KEYS (CPU October 2014)
1153464 - CVE-2014-6469 mysql: unspecified vulnerability related to SERVER:OPTIMIZER (CPU October 2014)
1153467 - CVE-2014-6484 mysql: unspecified vulnerability related to SERVER:DML (CPU October 2014)
1153489 - CVE-2014-6505 mysql: unspecified vulnerability related to SERVER:MEMORY STORAGE ENGINE (CPU October 2014)
1153490 - CVE-2014-6507 mysql: unspecified vulnerability related to SERVER:DML (CPU October 2014)
1153491 - CVE-2014-6520 mysql: unspecified vulnerability related to SERVER:DDL (CPU October 2014)
1153493 - CVE-2014-6530 mysql: unspecified vulnerability related to CLIENT:MYSQLDUMP (CPU October 2014)
1153494 - CVE-2014-6551 mysql: unspecified vulnerability related to CLIENT:MYSQLADMIN (CPU October 2014)
1153495 - CVE-2014-6555 mysql: unspecified vulnerability related to SERVER:DML (CPU October 2014)
1153496 - CVE-2014-6559 mysql: unspecified vulnerability related to C API SSL CERTIFICATE HANDLING (CPU October 2014)
6. Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
mariadb-5.5.40-1.el7_0.src.rpm
x86_64:
mariadb-5.5.40-1.el7_0.x86_64.rpm
mariadb-debuginfo-5.5.40-1.el7_0.i686.rpm
mariadb-debuginfo-5.5.40-1.el7_0.x86_64.rpm
mariadb-libs-5.5.40-1.el7_0.i686.rpm
mariadb-libs-5.5.40-1.el7_0.x86_64.rpm
mariadb-server-5.5.40-1.el7_0.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64:
mariadb-bench-5.5.40-1.el7_0.x86_64.rpm
mariadb-debuginfo-5.5.40-1.el7_0.i686.rpm
mariadb-debuginfo-5.5.40-1.el7_0.x86_64.rpm
mariadb-devel-5.5.40-1.el7_0.i686.rpm
mariadb-devel-5.5.40-1.el7_0.x86_64.rpm
mariadb-embedded-5.5.40-1.el7_0.i686.rpm
mariadb-embedded-5.5.40-1.el7_0.x86_64.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.i686.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.x86_64.rpm
mariadb-test-5.5.40-1.el7_0.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
mariadb-5.5.40-1.el7_0.src.rpm
x86_64:
mariadb-5.5.40-1.el7_0.x86_64.rpm
mariadb-debuginfo-5.5.40-1.el7_0.i686.rpm
mariadb-debuginfo-5.5.40-1.el7_0.x86_64.rpm
mariadb-libs-5.5.40-1.el7_0.i686.rpm
mariadb-libs-5.5.40-1.el7_0.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64:
mariadb-bench-5.5.40-1.el7_0.x86_64.rpm
mariadb-debuginfo-5.5.40-1.el7_0.i686.rpm
mariadb-debuginfo-5.5.40-1.el7_0.x86_64.rpm
mariadb-devel-5.5.40-1.el7_0.i686.rpm
mariadb-devel-5.5.40-1.el7_0.x86_64.rpm
mariadb-embedded-5.5.40-1.el7_0.i686.rpm
mariadb-embedded-5.5.40-1.el7_0.x86_64.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.i686.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.x86_64.rpm
mariadb-server-5.5.40-1.el7_0.x86_64.rpm
mariadb-test-5.5.40-1.el7_0.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
mariadb-5.5.40-1.el7_0.src.rpm
ppc64:
mariadb-5.5.40-1.el7_0.ppc64.rpm
mariadb-bench-5.5.40-1.el7_0.ppc64.rpm
mariadb-debuginfo-5.5.40-1.el7_0.ppc.rpm
mariadb-debuginfo-5.5.40-1.el7_0.ppc64.rpm
mariadb-devel-5.5.40-1.el7_0.ppc.rpm
mariadb-devel-5.5.40-1.el7_0.ppc64.rpm
mariadb-libs-5.5.40-1.el7_0.ppc.rpm
mariadb-libs-5.5.40-1.el7_0.ppc64.rpm
mariadb-server-5.5.40-1.el7_0.ppc64.rpm
mariadb-test-5.5.40-1.el7_0.ppc64.rpm
s390x:
mariadb-5.5.40-1.el7_0.s390x.rpm
mariadb-bench-5.5.40-1.el7_0.s390x.rpm
mariadb-debuginfo-5.5.40-1.el7_0.s390.rpm
mariadb-debuginfo-5.5.40-1.el7_0.s390x.rpm
mariadb-devel-5.5.40-1.el7_0.s390.rpm
mariadb-devel-5.5.40-1.el7_0.s390x.rpm
mariadb-libs-5.5.40-1.el7_0.s390.rpm
mariadb-libs-5.5.40-1.el7_0.s390x.rpm
mariadb-server-5.5.40-1.el7_0.s390x.rpm
mariadb-test-5.5.40-1.el7_0.s390x.rpm
x86_64:
mariadb-5.5.40-1.el7_0.x86_64.rpm
mariadb-bench-5.5.40-1.el7_0.x86_64.rpm
mariadb-debuginfo-5.5.40-1.el7_0.i686.rpm
mariadb-debuginfo-5.5.40-1.el7_0.x86_64.rpm
mariadb-devel-5.5.40-1.el7_0.i686.rpm
mariadb-devel-5.5.40-1.el7_0.x86_64.rpm
mariadb-libs-5.5.40-1.el7_0.i686.rpm
mariadb-libs-5.5.40-1.el7_0.x86_64.rpm
mariadb-server-5.5.40-1.el7_0.x86_64.rpm
mariadb-test-5.5.40-1.el7_0.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64:
mariadb-debuginfo-5.5.40-1.el7_0.ppc.rpm
mariadb-debuginfo-5.5.40-1.el7_0.ppc64.rpm
mariadb-embedded-5.5.40-1.el7_0.ppc.rpm
mariadb-embedded-5.5.40-1.el7_0.ppc64.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.ppc.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.ppc64.rpm
s390x:
mariadb-debuginfo-5.5.40-1.el7_0.s390.rpm
mariadb-debuginfo-5.5.40-1.el7_0.s390x.rpm
mariadb-embedded-5.5.40-1.el7_0.s390.rpm
mariadb-embedded-5.5.40-1.el7_0.s390x.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.s390.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.s390x.rpm
x86_64:
mariadb-debuginfo-5.5.40-1.el7_0.i686.rpm
mariadb-debuginfo-5.5.40-1.el7_0.x86_64.rpm
mariadb-embedded-5.5.40-1.el7_0.i686.rpm
mariadb-embedded-5.5.40-1.el7_0.x86_64.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.i686.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
mariadb-5.5.40-1.el7_0.src.rpm
x86_64:
mariadb-5.5.40-1.el7_0.x86_64.rpm
mariadb-bench-5.5.40-1.el7_0.x86_64.rpm
mariadb-debuginfo-5.5.40-1.el7_0.i686.rpm
mariadb-debuginfo-5.5.40-1.el7_0.x86_64.rpm
mariadb-devel-5.5.40-1.el7_0.i686.rpm
mariadb-devel-5.5.40-1.el7_0.x86_64.rpm
mariadb-libs-5.5.40-1.el7_0.i686.rpm
mariadb-libs-5.5.40-1.el7_0.x86_64.rpm
mariadb-server-5.5.40-1.el7_0.x86_64.rpm
mariadb-test-5.5.40-1.el7_0.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64:
mariadb-debuginfo-5.5.40-1.el7_0.i686.rpm
mariadb-debuginfo-5.5.40-1.el7_0.x86_64.rpm
mariadb-embedded-5.5.40-1.el7_0.i686.rpm
mariadb-embedded-5.5.40-1.el7_0.x86_64.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.i686.rpm
mariadb-embedded-devel-5.5.40-1.el7_0.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2014-2494
https://access.redhat.com/security/cve/CVE-2014-4207
https://access.redhat.com/security/cve/CVE-2014-4243
https://access.redhat.com/security/cve/CVE-2014-4258
https://access.redhat.com/security/cve/CVE-2014-4260
https://access.redhat.com/security/cve/CVE-2014-4274
https://access.redhat.com/security/cve/CVE-2014-4287
https://access.redhat.com/security/cve/CVE-2014-6463
https://access.redhat.com/security/cve/CVE-2014-6464
https://access.redhat.com/security/cve/CVE-2014-6469
https://access.redhat.com/security/cve/CVE-2014-6484
https://access.redhat.com/security/cve/CVE-2014-6505
https://access.redhat.com/security/cve/CVE-2014-6507
https://access.redhat.com/security/cve/CVE-2014-6520
https://access.redhat.com/security/cve/CVE-2014-6530
https://access.redhat.com/security/cve/CVE-2014-6551
https://access.redhat.com/security/cve/CVE-2014-6555
https://access.redhat.com/security/cve/CVE-2014-6559
https://access.redhat.com/security/updates/classification/#important
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html#AppendixMSQL
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html#AppendixMSQL
https://mariadb.com/kb/en/mariadb/development/release-notes/mariadb-5540-release-notes/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFUadeuXlSAg2UNWIIRAq0FAKC2DOhAOg/q+zlOLLV3ztECJ+Gh0gCdEGtr
rmT+kQlZKObKWBl1L2CyGEU=
=yhRc
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
. Galera is a synchronous multi-master cluster for
MariaDB.
Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/mariadb-5.5.40-i486-1_slack14.1.txz: Upgraded.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6507
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6491
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6500
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6469
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6559
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6494
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6496
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6464
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mariadb-5.5.40-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mariadb-5.5.40-x86_64-1_slack14.1.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/ap/mariadb-5.5.40-i486-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ap/mariadb-5.5.40-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 14.1 package:
da0aff5bebbbdc0621359c0fea027ae6 mariadb-5.5.40-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
dbb7d695a22ae538b5ad9c024823b190 mariadb-5.5.40-x86_64-1_slack14.1.txz
Slackware -current package:
f9ca4cf6015ddbb73dfba16c535caffc ap/mariadb-5.5.40-i486-1.txz
Slackware x86_64 -current package:
6924f64b6c147556a58a2c6f1929ab5e ap/mariadb-5.5.40-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg mariadb-5.5.40-i486-1_slack14.1.txz
Then, restart the database server:
# sh /etc/rc.d/rc.mysqld restart
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: MySQL, MariaDB: Multiple vulnerabilities
Date: November 05, 2014
Bugs: #525504
ID: 201411-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in the MySQL and MariaDB,
possibly allowing attackers to cause unspecified impact. MariaDB is an
enhanced, drop-in replacement for MySQL.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-db/mysql < 5.5.40 >= 5.5.40
2 dev-db/mariadb < 5.5.40-r1 >= 5.5.40-r1
-------------------------------------------------------------------
2 affected packages
Description
===========
Multiple unspecified vulnerabilities have been discovered in MySQL.
Please review the CVE identifiers referenced below for details.
Impact
======
A remote attacker could exploit these vulnerabilities to cause
unspecified impact, possibly including remote execution of arbitrary
code, Denial of Service, or disclosure of sensitive information.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All MySQL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mysql-5.5.40"
All MariaDB users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-db/mariadb-5.5.40-r1"
References
==========
[ 1 ] CVE-2014-6464
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6464
[ 2 ] CVE-2014-6469
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6469
[ 3 ] CVE-2014-6491
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6491
[ 4 ] CVE-2014-6494
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6494
[ 5 ] CVE-2014-6496
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6496
[ 6 ] CVE-2014-6500
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6500
[ 7 ] CVE-2014-6507
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6507
[ 8 ] CVE-2014-6555
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6555
[ 9 ] CVE-2014-6559
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6559
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201411-02.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
.
For the unstable distribution (sid), these problems will be fixed soon. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
3
| VAR-201410-1000 | CVE-2014-3381 | Cisco Email Security Appliance Run on Cisco AsyncOS of ZIP Vulnerabilities that can bypass malware filtering in the inspection engine |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
The ZIP inspection engine in Cisco AsyncOS 8.5 and earlier on the Cisco Email Security Appliance (ESA) does not properly analyze ZIP archives, which allows remote attackers to bypass malware filtering via a crafted archive, aka Bug ID CSCup07934. Vendors have confirmed this vulnerability Bug ID CSCup07934 It is released as.A third party may be able to bypass malware filtering through a crafted archive. Cisco AsyncOS is the operating system used by multiple Cisco products. A remote security bypass vulnerability exists in Cisco AsyncOS Software that allows an attacker to bypass certain security restrictions and perform unauthorized operations. Cisco AsyncOS Software is prone to a remote security-bypass vulnerability.
This issue is being tracked by Cisco Bug ID CSCup07934. The vulnerability is caused by the program not correctly parsing ZIP compressed files
| VAR-201410-1486 | No CVE | Multiple Huawei Products VRP SSH Denial of Service Vulnerability |
CVSS V2: - CVSS V3: - Severity: - |
Multiple Huawei products are prone to a denial-of-service vulnerability.
An attacker can exploit this issue to restart the device, denying service to legitimate users.
| VAR-201410-0064 | CVE-2014-3404 | Cisco IOS XE of Autonomic Networking Infrastructure Vulnerability that triggers receipt of invalid messages in components |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
The Autonomic Networking Infrastructure (ANI) component in Cisco IOS XE does not properly validate certificates, which allows remote attackers to trigger acceptance of an invalid message via crafted messages, aka Bug ID CSCuq22677. Vendors have confirmed this vulnerability Bug ID CSCuq22677 It is released as.A third party can trigger the receipt of invalid messages via crafted messages. Cisco IOS is the interconnected network operating system used on most Cisco system routers and network switches. Cisco IOS XE has a security bypass vulnerability that allows an attacker to exploit a vulnerability to bypass certain security restrictions and perform unauthorized operations. Cisco IOS XE Software is prone to a security-bypass vulnerability.
This issue is being tracked by Cisco Bug ID CSCuq22677. The vulnerability is caused by the program not validating certificates properly. A remote attacker could exploit this vulnerability to send a specially crafted message to the ANI device
| VAR-201410-1205 | CVE-2014-8315 | SAP BusinessObjects Explorer Information Disclosure Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 replies with different timing depending on if a connection can be made, which allows remote attackers to conduct port scanning attacks via a host name and port in the cms parameter. Business Objects is the world's leading business intelligence (BI) software company. SAP BusinessObjects Explorer is a browser that it launched. An information disclosure vulnerability exists in SAP BusinessObjects Explorer. This vulnerability could be exploited by an attacker to obtain a group host and its open port information.
BusinessObjects Explorer14.0.5 (build 882) is vulnerable;other versions may also be affected
| VAR-201410-1420 | No CVE | SAP BusinessObjects Explorer Cross-Site Flash Vulnerability |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Business Objects is the world's leading business intelligence (BI) software company. SAP BusinessObjects Explorer is a browser that it launched. A cross-site flash vulnerability exists in SAP BusinessObjects Explorer. An attacker could exploit this vulnerability to steal user's session information.
Remote attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks
| VAR-201410-1206 | CVE-2014-8316 | SAP BusinessObjects Explorer XML External Entity Injection Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
XML External Entity (XXE) vulnerability in polestar_xml.jsp in SAP BusinessObjects Explorer 14.0.5 build 882 allows remote attackers to read arbitrary files via the xmlParameter parameter in an explorationSpaceUpdate request. Supplementary information : CWE Vulnerability type by CWE-611: Improper Restriction of XML External Entity Reference ('XXE') (XML Inappropriate restrictions on external entity references ) Has been identified. http://cwe.mitre.org/data/definitions/611.htmlBy a third party explorationSpaceUpdate Request xmlParameter An arbitrary file may be read through the parameter.
Attackers can exploit this issue to obtain potentially sensitive information or cause a denial-of-service condition. This may lead to further attacks.
BusinessObjects Explorer 14.0.5 (build 882) is vulnerable; other versions may also be affected