The Windows Error Reporting (WER) component in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass the Protected Process Light protection mechanism and read the contents of arbitrary process-memory locations by leveraging administrative privileges, aka "Windows Error Reporting Security Feature Bypass Vulnerability." http://packetstormsecurity.com/files/134392/Microsoft-Windows-8.1-Ahcache.sys-NtApphelpCacheControl-Privilege-Escalation.html 62134 71927 MS15-006 ms-wer-cve20150001-security-bypass(99513) win-ms15kb3004365-update(99514) The AhcVerifyAdminContext function in ahcache.sys in the Application Compatibility component in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not verify that an impersonation token is associated with an administrative account, which allows local users to gain privileges by running AppCompatCache.exe with a crafted DLL file, aka MSRC ID 20544 or "Microsoft Application Compatibility Infrastructure Elevation of Privilege Vulnerability." 61277 http://twitter.com/sambowne/statuses/550384131683520512 71972 http://www.zdnet.com/article/google-discloses-unpatched-windows-vulnerability/ https://code.google.com/p/google-security-research/issues/detail?id=118 MS15-001 ms-appcompatcache-cve20150002-priv-esc(99523) win-ms15kb3023266-update(99524) win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." 72457 MS15-010 ms-kmd-cve20150003-priv-esc(100430) The User Profile Service (aka ProfSvc) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges by conducting a junction attack to load another user's UsrClass.dat registry hive, aka MSRC ID 20674 or "Microsoft User Profile Service Elevation of Privilege Vulnerability." 61927 71967 https://code.google.com/p/google-security-research/issues/detail?id=123 MS15-003 ms-profsvc-cve20150004-priv-esc(99519) win-ms15kb3021674-update(99520) The NETLOGON service in Microsoft Windows Server 2003 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2, when a Domain Controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, aka "NETLOGON Spoofing Vulnerability." http://packetstormsecurity.com/files/130773/Windows-Pass-Through-Authentication-Methods-Improper-Validation.html 20150310 [CORE-2015-0005] - Windows Pass-Through Authentication Methods Improper Validation http://www.coresecurity.com/advisories/windows-pass-through-authentication-methods-improper-validation 1031891 MS15-027 https://www.samba.org/samba/history/samba-4.2.10.html The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability." 62098 62184 71930 MS15-005 ms-nla-cve20150006-security-bypass(99521) win-ms15kb3022777-update(99522) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remote attackers to execute arbitrary code by making crafted data available on a UNC share, as demonstrated by Group Policy data from a spoofed domain controller, aka "Group Policy Remote Code Execution Vulnerability." http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-hardening-group-policy.aspx VU#787252 72477 1031719 MS15-011 ms-grouppolicy-cve20150008-code-exec(100426) https://www.jasadvisors.com/additonal-jasbug-security-exploit-info/ The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows man-in-the-middle attackers to disable a signing requirement and trigger a revert-to-default action by spoofing domain-controller responses, aka "Group Policy Security Feature Bypass Vulnerability." http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-hardening-group-policy.aspx 72476 1031722 MS15-014 The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, when the CRYPTPROTECTMEMORY_SAME_LOGON option is used, does not check an impersonation token's level, which allows local users to bypass intended decryption restrictions by leveraging a service that (1) has a named-pipe planting vulnerability or (2) uses world-readable shared memory for encrypted data, aka "CNG Security Feature Bypass Vulnerability" or MSRC ID 20707. http://code.google.com/p/google-security-research/issues/detail?id=128 72461 MS15-010 mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass an impersonation protection mechanism, and obtain privileges for redirection of WebDAV requests, via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability." 62154 71960 1031531 MS15-008 win-ms15kb3019215-update(99526) ms-webdav-cve20150011-priv-esc(99527) Microsoft System Center Virtual Machine Manager (VMM) 2012 R2 Update Rollup 4 does not properly validate the roles of users, which allows local users to obtain server and virtual-machine administrative privileges by establishing a server session with Active Directory credentials, aka "Virtual Machine Manager Elevation of Privilege Vulnerability." 72473 1031726 1034652 MS15-017 ms-vmmanager-cve20150012-priv-esc(100428) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability." 61580 71968 1031523 MS15-002 ms-telnet-cve20150014-code-exec(99517) win-ms15kb3020393-update(99518) Microsoft Windows Server 2003 SP2, Server 2008 SP2 and R2 SP1, and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (system hang and RADIUS outage) via crafted username strings to (1) Internet Authentication Service (IAS) or (2) Network Policy Server (NPS), aka "Network Policy Server RADIUS Implementation Denial of Service Vulnerability." 62148 71933 1031532 MS15-007 Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via a crafted pathname in an executable file, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Directory Traversal Elevation of Privilege Vulnerability." http://blog.trendmicro.com/trendlabs-security-intelligence/cve-2015-0016-escaping-the-internet-explorer-sandbox/ http://packetstormsecurity.com/files/130201/MS15-004-Microsoft-Remote-Desktop-Services-Web-Proxy-IE-Sandbox-Escape.html 62076 35983 71965 1031524 MS15-004 ms-windows-cve20150016-priv-esc(99515) win-ms15kb3025421-update(99516) Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041. 72402 1031723 MS15-009 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0037, CVE-2015-0040, and CVE-2015-0066. 72403 1031723 MS15-009 Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 72425 1031723 MS15-009 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041. 72426 1031723 MS15-009 Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 72436 1031723 MS15-009 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041. 72437 1031723 MS15-009 Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0025. 72438 1031723 MS15-009 20150210 Microsoft Internet Explorer CTreeNode Use-after-Free Vulnerability ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0023. 72439 1031723 MS15-009 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041. 72440 1031723 MS15-009 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0035, CVE-2015-0039, CVE-2015-0052, and CVE-2015-0068. 72441 1031723 MS15-009 Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0048. 72442 1031723 MS15-009 Microsoft Internet Explorer 6 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 72443 1031723 MS15-009 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041. 72444 1031723 MS15-009 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0036, and CVE-2015-0041. 72445 1031723 MS15-009 vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 8 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability." 72910 1031887 1031888 MS15-018 MS15-019 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0039, CVE-2015-0052, and CVE-2015-0068. 72447 1031723 MS15-009 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, and CVE-2015-0041. 72446 1031723 MS15-009 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0040, and CVE-2015-0066. 72448 1031723 MS15-009 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0042 and CVE-2015-0046. 72404 1031723 MS15-009 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0052, and CVE-2015-0068. 72409 1031723 MS15-009 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0037, and CVE-2015-0066. http://blog.skylined.nl/20161114001.html 20161114 CVE-2015-0040: Microsoft Internet Explorer 11 MSHTML CMapElement::Notify use-after-free details 72410 1031723 MS15-009 40757 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, and CVE-2015-0036. 72411 1031723 MS15-009 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0046. 72412 1031723 MS15-009 Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 72413 1031723 MS15-009 Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0050. 72414 1031723 MS15-009 Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0053. 72415 1031723 MS15-009 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0042. 72416 1031723 MS15-009 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0028. 72417 1031723 MS15-009 Microsoft Internet Explorer 8 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 72418 1031723 MS15-009 Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0044. http://blog.skylined.nl/20161122001.html 20161125 CVE-2015-0050: Microsoft Internet Explorer 8 MSHTML SRunPointer::SpanQualifier/RunType OOB read details 20161122 CVE-2015-0050: Microsoft Internet Explorer 8 MSHTML SRunPointer::SpanQualifier/RunType OOB read details 72419 1031723 MS15-009 40841 Microsoft Internet Explorer 8 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability." 72453 1031723 MS15-009 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0039, and CVE-2015-0068. 72420 1031723 MS15-009 Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0045. 72421 1031723 MS15-009 Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." 72478 1031723 MS15-009 Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." 72479 1031723 MS15-009 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1623 and CVE-2015-1626. 72924 1031888 MS15-018 win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." 72466 MS15-010 ms-kmd-cve20150057-priv-esc(100431) 39035 Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a crafted application, aka "Windows Cursor Object Double Free Vulnerability." 72468 MS15-010 ms-kmd-cve20150058-priv-sec(100432) win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted TrueType font, aka "TrueType Font Parsing Remote Code Execution Vulnerability." 72470 MS15-010 ms-kmd-cve20150059-code-exec(100433) The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly scale fonts, which allows local users to cause a denial of service (system hang) via a crafted application, aka "Windows Font Driver Denial of Service Vulnerability." 72472 MS15-010 ms-kmd-cve20150060-dos(100434) Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for TIFF images, which allows remote attackers to obtain sensitive information from process memory via a crafted image file, aka "TIFF Processing Information Disclosure Vulnerability." 72456 1031725 MS15-016 ms-tiff-cve20150061-info-disc(100435) win-ms15kb3029944-update(100436) Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges via a crafted application that leverages incorrect impersonation handling in a process that uses the SeAssignPrimaryTokenPrivilege privilege, aka "Windows Create Process Elevation of Privilege Vulnerability." 62840 72458 1031724 MS15-015 ms-windows-cve20150062-priv-esc(100437) win-ms15kb3031432-update(100438) Microsoft Excel 2007 SP3; the proofing tools in Office 2010 SP2; Excel 2010 SP2; Excel 2013 Gold, SP1, and RT; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Excel Remote Code Execution Vulnerability." 62808 72460 1031720 MS15-012 ms-excel-cve20150063-code-exec(100439) Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Office Remote Code Execution Vulnerability." 62808 72463 1031720 MS15-012 37967 Microsoft Word 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "OneTableDocumentStream Remote Code Execution Vulnerability." 62808 72465 1031720 MS15-012 37966 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0037, and CVE-2015-0040. 72422 1031723 MS15-009 Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 72423 1031723 MS15-009 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0039, and CVE-2015-0052. 72424 1031723 MS15-009 Microsoft Internet Explorer 10 and 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability." 72454 1031723 MS15-009 Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability." 72480 1031723 MS15-009 Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability." 72455 1031723 MS15-009 Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)." http://community.websense.com/blogs/securitylabs/archive/2015/02/05/another-day-another-zero-day-internet-explorer-s-turn-cve-2015-0072.aspx http://innerht.ml/blog/ie-uxss.html http://packetstormsecurity.com/files/130308/Microsoft-Internet-Explorer-Universal-XSS-Proof-Of-Concept.html 20150131 Major Internet Explorer Vulnerability - NOT Patched http://www.pcworld.com/article/2879372/dangerous-ie-vulnerability-opens-door-to-powerful-phishing-attacks.html 20150209 Cookie hijacking: Internet Explorer UXSS (CVE-2015-0072) 72489 1031888 MS15-018 ms-ie-cve20150072-xss(100606) https://nakedsecurity.sophos.com/2015/02/04/internet-explorer-has-a-cross-site-scripting-zero-day-bug/ The Windows Registry Virtualization feature in the kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict changes to virtual stores, which allows local users to gain privileges via a crafted application, aka "Registry Virtualization Elevation of Privilege Vulnerability." 72908 1031899 MS15-025 Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly allocate memory, which allows remote attackers to cause a denial of service via a crafted (1) web site or (2) file, aka "Adobe Font Driver Denial of Service Vulnerability." 72892 1031889 MS15-021 The kernel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Impersonation Level Check Elevation of Privilege Vulnerability." 72915 1031899 MS15-025 The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "JPEG XR Parser Information Disclosure Vulnerability." 72918 1031894 MS15-029 The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize function buffers, which allows local users to obtain sensitive information from kernel memory, and possibly bypass the ASLR protection mechanism, via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability." 72897 1031897 MS15-023 win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate the token of a calling thread, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." 72902 1031897 MS15-023 The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to cause a denial of service (memory consumption and RDP outage) by establishing many RDP sessions that do not properly free allocated memory, aka "Remote Desktop Protocol (RDP) Denial of Service Vulnerability." 1031892 MS15-030 Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly initialize memory for rendering of malformed PNG images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Malformed PNG Parsing Information Disclosure Vulnerability." 72909 1031898 MS15-024 Windows Text Services (WTS) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "WTS Remote Code Execution Vulnerability." 72886 1031890 MS15-020 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. The Task Scheduler in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to bypass intended restrictions on launching executable files via a crafted task, aka "Task Scheduler Security Feature Bypass Vulnerability." 72913 1031893 MS15-028 Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 Gold and SP1, Word 2013 Gold and SP1, Office 2013 RT Gold and SP1, Word 2013 RT Gold and SP1, Excel Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Excel Services on SharePoint Server 2013 Gold and SP1, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, Office Web Apps Server 2010 SP2, Web Apps Server 2013 Gold and SP1, SharePoint Server 2007 SP3, Windows SharePoint Services 3.0 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability." <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> 1031896 MS15-022 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 Gold and SP1, Word 2013 RT Gold and SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, and Web Apps Server 2013 Gold and SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability." 1031896 MS15-022 Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0089. 72893 1031889 MS15-021 Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0090, CVE-2015-0091, CVE-2015-0092, and CVE-2015-0093. 72898 1031889 MS15-021 Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0087. 72896 1031889 MS15-021 Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0091, CVE-2015-0092, and CVE-2015-0093. 72904 1031889 MS15-021 Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0092, and CVE-2015-0093. 72905 1031889 MS15-021 Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0093. 72906 1031889 MS15-021 Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0092. 72907 1031889 MS15-021 The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly restrict the availability of address information during a function call, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability." 1031897 MS15-023 The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to cause a denial of service (NULL pointer dereference and blue screen), or obtain sensitive information from kernel memory and possibly bypass the ASLR protection mechanism, via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability." 72936 1031897 MS15-023 Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, leading to DLL loading during Windows Explorer access to the icon of a crafted shortcut, aka "DLL Planting Remote Code Execution Vulnerability." 72894 1031890 MS15-020 Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Word Local Zone Remote Code Execution Vulnerability." 1031896 MS15-022 37657 Task Scheduler in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges by triggering application execution by an invalid task, aka "Task Scheduler Elevation of Privilege Vulnerability." <a href="https://cwe.mitre.org/data/definitions/701.html">CWE-701: Weaknesses Introduced During Design</a> 1032112 MS15-037 Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 72925 1031888 MS15-018 Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 72926 1031888 MS15-018 Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business Process Manager Express 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; and IBM Business Process Manager Advanced 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5. 72920 http://www-01.ibm.com/support/docview.wss?uid=swg21693134 Multiple cross-site scripting (XSS) vulnerabilities in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified data fields. JR50457 http://www-01.ibm.com/support/docview.wss?uid=swg21693270 IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to execute arbitrary code via unspecified vectors. 97999 http://www-01.ibm.com/support/docview.wss?uid=swg21694974 Cross-site scripting (XSS) vulnerability in the Process Portal in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. JR50162 JR50607 http://www-01.ibm.com/support/docview.wss?uid=swg21694937 Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. JR50795 http://www-01.ibm.com/support/docview.wss?uid=swg21694935 IBM Tivoli IT Asset Management for IT, Tivoli Service Request Manager, and Change and Configuration Management Database 7.1 through 7.1.1.8 and 7.2 and Maximo Asset Management and Maximo Industry Solutions 7.1 through 7.1.1.8, 7.5 before 7.5.0.7 IFIX003, and 7.6 before 7.6.0.0 IFIX002 allow remote authenticated users to conduct directory traversal attacks via unspecified vectors. 97998 http://www-01.ibm.com/support/docview.wss?uid=swg21694974 Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.8, and Maximo Asset Management 7.1 through 7.1.1.8 and 7.2 for Tivoli IT Asset Management for IT and certain other products, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-0104, CVE-2015-0107, and CVE-2015-0109. http://www-01.ibm.com/support/docview.wss?uid=swg21694974 ibm-tsam-cve20150108-xss(99605) Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.8, and Maximo Asset Management 7.1 through 7.1.1.8 and 7.2 for Tivoli IT Asset Management for IT and certain other products, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-0104, CVE-2015-0107, and CVE-2015-0108. http://www-01.ibm.com/support/docview.wss?uid=swg21694974 ibm-tsam-cve20150109-xss(99606) IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intended access restrictions on internal service types via vectors involving the executeServiceByName URL. 73274 https://www-304.ibm.com/support/docview.wss?uid=swg21694940 Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.0.1, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Quality Manager (RQM) 2.0 through 2.0.1, 3.0 through 3.0.1.6, 4.0 through 4.0.7, and 5.0 through 5.0.2; Rational Team Concert (RTC) 2.0 through 2.0.0.2, 3.x before 3.0.1.6 IF6, 4.x before 4.0.7 IF5, and 5.x before 5.0.2 IF4; Rational Requirements Composer (RRC) 2.0 through 2.0.0.4, 3.x before 3.0.1.6 IF6, and 4.0 through 4.0.7; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF5 and 5.x before 5.0.2 IF4; Rational Engineering Lifecycle Manager (RELM) 1.0 through 1.0.0.1, 4.0.3 through 4.0.7, and 5.0 through 5.0.2; Rational Rhapsody Design Manager (DM) 3.0 through 3.0.1, 4.0 through 4.0.7, and 5.0 through 5.0.2; and Rational Software Architect Design Manager (RSA DM) 3.0 through 3.0.1, 4.0 through 4.0.7, and 5.0 through 5.0.2 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> http://www-01.ibm.com/support/docview.wss?uid=swg21957763 The Jazz help system in IBM Rational Collaborative Lifecycle Management 4.0 through 5.0.2, Rational Quality Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Team Concert 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Requirements Composer 4.0 through 4.0.7, Rational DOORS Next Generation 4.0 through 4.0.7 and 5.0 through 5.0.2, Rational Engineering Lifecycle Manager 4.0.3 through 4.0.7 and 5.0 through 5.0.2, Rational Rhapsody Design Manager 4.0 through 4.0.7 and 5.0 through 5.0.2, and Rational Software Architect Design Manager 4.0 through 4.0.7 and 5.0 through 5.0.2 allows remote attackers to read JSP source code via a crafted request. http://www-01.ibm.com/support/docview.wss?uid=swg21882770 Stack-based buffer overflow in IBM V5R4, and IBM i Access for Windows 6.1 and 7.1. 72914 http://www-01.ibm.com/support/docview.wss?uid=nas8N1020540 Cross-site request forgery (CSRF) vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to hijack the authentication of customer accounts. http://www-01.ibm.com/support/docview.wss?uid=swg21902807 IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request forgery (CSRF) attacks via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21902807 The LDAP Server in IBM Domino 8.5.x before 8.5.3 FP6 IF6 and 9.x before 9.0.1 FP3 IF1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, aka SPR KLYH9SLRGM. 1032027 http://www-01.ibm.com/support/docview.wss?uid=swg21700029 IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only weak TLS ciphers, which might make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node. IT05725 http://www-01.ibm.com/support/docview.wss?uid=swg21957998 FastBack Mount in IBM Tivoli Storage Manager FastBack 6.1.x before 6.1.11.1 allows remote attackers to execute arbitrary code by connecting to the Mount port. http://www-01.ibm.com/support/docview.wss?uid=swg21699645 Buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 has unspecified impact and remote attack vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21700549 IBM Rational Requirements Composer 3.0 through 3.0.1.6 and 4.0 through 4.0.7 and Rational DOORS Next Generation (RDNG) 4.0 through 4.0.7 and 5.0 through 5.0.2, when LTPA single sign on is used with WebSphere Application Server, do not terminate a Requirements Management (RM) session upon LTPA token expiration, which allows remote attackers to obtain access by leveraging an unattended workstation. <a href="https://cwe.mitre.org/data/definitions/613.html">CWE-613: Insufficient Session Expiration</a> 74910 http://www-01.ibm.com/support/docview.wss?uid=swg21903761 Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0123. 73093 1031884 http://www-01.ibm.com/support/docview.wss?uid=swg21698253 Cross-site scripting (XSS) vulnerability in IBM Rational Team Concert 2.x and 3.x before 3.0.1.6 iFix 5, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0122. 73101 1031884 http://www-01.ibm.com/support/docview.wss?uid=swg21698253 Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0128. 73103 1031885 http://www-01.ibm.com/support/docview.wss?uid=swg21696927 Cross-site scripting (XSS) vulnerability in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 4.x before 4.0.7 iFix3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. 73105 http://www-01.ibm.com/support/docview.wss?uid=swg21697297 IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to bypass intended file-upload restrictions via a modified extension. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> http://www-01.ibm.com/support/docview.wss?uid=swg21902807 IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks via a crafted web site. http://www-01.ibm.com/support/docview.wss?uid=swg21902807 Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager 2.x and 3.x before 3.0.1.6 iFix4, 4.x before 4.0.7 iFix3, and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-0124. 1031885 http://www-01.ibm.com/support/docview.wss?uid=swg21697126 Cross-site scripting (XSS) vulnerability in IBM Rational Quality Manager (RQM) 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. 1031886 http://www-01.ibm.com/support/docview.wss?uid=swg21696856 Cross-site scripting (XSS) vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Quality Manager (RQM) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Team Concert (RTC) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5; Rational Requirements Composer (RRC) 4.x through 4.0.7; and Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF6 and 5.x before 5.0.2 IF5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. http://www-01.ibm.com/support/docview.wss?uid=swg21960407 Cross-site scripting (XSS) vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21902807 The XML parser in IBM Rational DOORS Next Generation 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 and Rational Requirements Composer 2.x and 3.x before 3.0.1.6 iFix5 and 4.x before 4.0.7 iFix3 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. http://www-01.ibm.com/support/docview.wss?uid=swg21698248 IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> 1031881 JR52499 http://www-01.ibm.com/support/docview.wss?uid=swg21696242 Buffer overflow in the SSLv2 implementation in IBM Domino 8.5.x before 8.5.1 FP5 IF3, 8.5.2 before FP4 IF3, 8.5.3 before FP6 IF6, 9.0 before IF7, and 9.0.1 before FP2 IF3 allows remote attackers to execute arbitrary code via unspecified vectors. 1032027 http://www-01.ibm.com/support/docview.wss?uid=swg21700029 IBM Domino 8.5 before 8.5.3 FP6 IF4 and 9.0 before 9.0.1 FP3 IF2 allows remote attackers to execute arbitrary code or cause a denial of service (integer truncation and application crash) via a crafted GIF image, aka SPR KLYH9T7NT9. 1032151 http://www-01.ibm.com/support/docview.wss?uid=swg21701647 powervc-iso-import in IBM PowerVC 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 places an access token on the command line during IVM and PowerKVM management, which allows local users to obtain sensitive information by listing the process. http://www-01.ibm.com/support/docview.wss?uid=nas8N1020608 IBM PowerVC Standard 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 validates Hardware Management Console (HMC) certificates only during the pre-login stage, which allows man-in-the-middle attackers to spoof devices via a crafted certificate. http://www-01.ibm.com/support/docview.wss?uid=nas8N1020611 GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server (ISDS) 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204. SUSE-SU-2015:1073 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1021 RHSA-2015:1091 73326 http://www-01.ibm.com/support/docview.wss?uid=swg21698703 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 through 8.0.0.1 CF15 and 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. 1031880 PI33329 http://www-01.ibm.com/support/docview.wss?uid=swg21697213 An unspecified ActiveX control in IBM SPSS Statistics 22.0 through FP1 on 32-bit platforms allows remote attackers to execute arbitrary code via a crafted HTML document. http://www-01.ibm.com/support/docview.wss?uid=swg21697746 IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to modify arbitrary user filters via a JSON request. http://www-01.ibm.com/support/docview.wss?uid=swg21963358 IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-mode transition and data-storage outage) by calling the System Administration Mode function. http://www-01.ibm.com/support/docview.wss?uid=swg21963358 IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading error messages. http://www-01.ibm.com/support/docview.wss?uid=swg21963358 Cross-site scripting (XSS) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2014-8916. http://www-01.ibm.com/support/docview.wss?uid=swg21963358 Cross-site request forgery (CSRF) vulnerability in IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. http://www-01.ibm.com/support/docview.wss?uid=swg21963358 IBM Content Collector for Email 3.0 before 3.0.0.6-IBM-ICC-Server-IF001 and 4.0 before 4.0.0.3-IBM-ICC-Server-IF001 does not properly handle an unspecified query operator during searches of IBM FileNet P8 systems with IBM Content Search Services, which allows local users to bypass intended document-access restrictions and obtain sensitive information via a crafted search query. http://www-01.ibm.com/support/docview.wss?uid=swg21696594 The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs, which allows remote authenticated users to obtain sensitive information or modify data via unspecified API calls. LI78430 http://www-01.ibm.com/support/docview.wss?uid=swg21696693 The remote administration UI in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to bypass intended access restrictions via unspecified vectors. ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-815/REVB/DIR-815_REVB_FIRMWARE_PATCH_NOTES_2.07.B01_EN.PDF dlink-dir815-cve20150150-sec-bypass(110583) Cross-site request forgery (CSRF) vulnerability in D-Link DIR-815 devices with firmware before 2.07.B01 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-815/REVB/DIR-815_REVB_FIRMWARE_PATCH_NOTES_2.07.B01_EN.PDF dlink-dir815-cve20150151-csrf(110584) D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the administrative password. ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-815/REVB/DIR-815_REVB_FIRMWARE_PATCH_NOTES_2.07.B01_EN.PDF dlink-dir815-cve20150152-info-disc(110585) D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the wireless key. ftp://ftp2.dlink.com/SECURITY_ADVISEMENTS/DIR-815/REVB/DIR-815_REVB_FIRMWARE_PATCH_NOTES_2.07.B01_EN.PDF dlink-dir815-cve20150153-info-disc(110586) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. IT06812 JR52420 http://www-01.ibm.com/support/docview.wss?uid=swg21697120 IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to cause a denial of service (daemon crash) by leveraging an unspecified scalar function in a SQL statement. 75947 1032882 IT07103 IT07107 IT07108 IT07109 http://www-01.ibm.com/support/docview.wss?uid=swg21697987 Cross-site scripting (XSS) vulnerability in the Coach NG framework in IBM Business Process Manager (BPM) 8.0 through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. 1031964 JR52137 JR52322 JR52355 http://www-01.ibm.com/support/docview.wss?uid=swg21696378 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-3570. Reason: This candidate is a reservation duplicate of CVE-2014-3570. Notes: All CVE users should reference CVE-2014-3570 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary commands with SYSTEM privileges via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21699470 SQL injection vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21699470 IBM Security SiteProtector System 3.0, 3.1, and 3.1.1 allows local users to gain privileges. 74038 ibm-siteprotector-cve20150162-priv-esc(100865) https://www-01.ibm.com/support/docview.wss?uid=swg21700012 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none. Cross-site scripting (XSS) vulnerability in textAngular-sanitize.js in textAngular before 1.3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the editor. textangular-cve20150167-xss(100929) https://github.com/fraywing/textAngular/releases/tag/v1.3.7 Cross-site scripting (XSS) vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21699470 IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arguments via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21699470 IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows local users to obtain sensitive information by reading cached data. http://www-01.ibm.com/support/docview.wss?uid=swg21699470 Directory traversal vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to write to arbitrary files via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21699470 IBM Security SiteProtector System 3.0, 3.1.0 and 3.1.1 allows remote attackers to bypass intended security restrictions and consequently execute unspecified commands and obtain sensitive information via unknown vectors. IBM X-Force ID: 100927. http://www-01.ibm.com/support/docview.wss?uid=swg21699472 The HTTP connection-management functionality in Internet Pass-Thru (IPT) before 2.1.0.2 in IBM WebSphere MQ, when HTTPS is disabled, does not properly generate MQIPT Session IDs, which makes it easier for remote attackers to bypass intended restrictions on MQ message data by predicting an ID value. 1032630 http://www-01.ibm.com/support/docview.wss?uid=swg21699547 The SNMP implementation in IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.5 does not properly handle configuration data, which allows remote authenticated users to obtain sensitive information via unspecified vectors. 1032190 PI21072 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 does not properly implement authData elements, which allows remote authenticated users to gain privileges via unspecified vectors. 1032190 PI33008 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 Cross-site scripting (XSS) vulnerability in MQ XR WebSockets Listener in WMQ Telemetry in IBM WebSphere MQ 8.0 before 8.0.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URI that is included in an error response. 1032200 http://www-01.ibm.com/support/docview.wss?uid=swg21699549 Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.5.0 before CF05 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. 1031880 PI35228 http://www-01.ibm.com/support/docview.wss?uid=swg21697213 The Java overlay feature in IBM Bluemix Liberty before 1.13-20150209-1122 for Java does not properly support WAR applications, which allows remote attackers to obtain sensitive information via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21696864 Notes System Diagnostic (NSD) in IBM Domino 8.5.x before 8.5.3 FP6 IF6 and 9.x before 9.0.1 FP3 IF1 allows local users to obtain the System privilege via unspecified vectors, aka SPR TCHL9SST8V. 1032027 http://www-01.ibm.com/support/docview.wss?uid=swg21700029 42605 The Connector Migration Tool in IBM InfoSphere Information Server 8.1 through 11.3 allows remote authenticated users to bypass intended restrictions on job creation and modification via unspecified vectors. JR51665 http://www-01.ibm.com/support/docview.wss?uid=swg21697306 The cluster repository manager in IBM WebSphere MQ 7.5 before 7.5.0.5 and 8.0 before 8.0.0.2 allows remote authenticated administrators to cause a denial of service (memory overwrite and daemon outage) by triggering multiple transmit-queue records. 74706 1032374 IT05869 http://www-01.ibm.com/support/docview.wss?uid=swg21883457 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-0191. Reason: This candidate is a duplicate of CVE-2014-0191. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2014-0191 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to gain privileges via unknown vectors related to the Java Virtual Machine. SUSE-SU-2015:1073 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1021 RHSA-2015:1091 IV70682 IV70683 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL that triggers an error condition. JR52626 http://www-01.ibm.com/support/docview.wss?uid=swg21697944 XML External Entity (XXE) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and IBM Sterling File Gateway 2.1 and 2.2 allows remote attackers to read arbitrary files via a crafted XML data. 73401 IT06733 http://www-01.ibm.com/support/docview.wss?uid=swg21699482 Cross-site scripting (XSS) vulnerability in IBM Content Template Catalog 4.x before 4.1.4 for WebSphere Portal 8.0.x and 4.x before 4.3.1 for WebSphere Portal 8.5.x allows remote attackers to inject arbitrary web script or HTML via a crafted URL. http://www-01.ibm.com/support/docview.wss?uid=swg21958969 CRLF injection vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 before 7.0.0.8 Cumulative iFix 2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL. <a href="http://cwe.mitre.org/data/definitions/113.html">CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')</a> JR51324 JR52306 http://www-01.ibm.com/support/docview.wss?uid=swg21960181 IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to obtain root privileges for program execution via unspecified vectors. 73282 1032880 http://www-01.ibm.com/support/docview.wss?uid=isg3T1022062 http://www-304.ibm.com/support/docview.wss?uid=swg21902662 IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 in certain cipherList configurations allows remote attackers to bypass authentication and execute arbitrary programs as root via unspecified vectors. 73278 1032880 http://www-01.ibm.com/support/docview.wss?uid=isg3T1022062 http://www-304.ibm.com/support/docview.wss?uid=swg21902662 The mmfslinux kernel module in IBM General Parallel File System (GPFS) 3.4 before 3.4.0.32, 3.5 before 3.5.0.24, and 4.1 before 4.1.0.7 allows local users to cause a denial of service (memory corruption) via unspecified character-device ioctl calls. 73283 1032880 http://www-01.ibm.com/support/docview.wss?uid=isg3T1022062 http://www-304.ibm.com/support/docview.wss?uid=swg21902662 IBM WebSphere Commerce 6.x through 6.0.0.11 and 7.x before 7.0.0.8 IF2 allows local users to obtain sensitive database information via unspecified vectors. 1032392 JR50683 JR52306 http://www-01.ibm.com/support/docview.wss?uid=swg21902799 The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to send messages to other sessions via unspecified vectors. https://pivotal.io/security/cve-2015-0201 The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes. openSUSE-SU-2015:0672 http://subversion.apache.org/security/CVE-2015-0202-advisory.txt MDVSA-2015:192 76446 1032100 USN-2721-1 GLSA-201610-05 The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an invalid range in a sequence set, (2) content-bearing methods other than message-transfer, or (3) a session-gap control before a corresponding session-attach. 72030 RHBA-2016:1500 https://issues.apache.org/jira/browse/QPID-6310 https://packetstormsecurity.com/files/129941/Apache-Qpid-0.30-Denial-Of-Service.html The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679 APPLE-SA-2015-04-08-2 openSUSE-SU-2015:0130 SUSE-SU-2015:0578 SUSE-SU-2015:0946 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 SUSE-SU-2015:2166 SUSE-SU-2015:2168 SUSE-SU-2015:2182 SUSE-SU-2015:2192 SUSE-SU-2015:2216 SUSE-SU-2016:0113 openSUSE-SU-2016:0640 HPSBUX03162 HPSBUX03244 HPSBGN03299 HPSBHF03289 HPSBOV03318 HPSBUX03334 HPSBMU03380 HPSBMU03345 HPSBMU03409 HPSBMU03396 HPSBMU03413 HPSBMU03397 RHSA-2015:0066 RHSA-2015:0800 RHSA-2015:0849 RHSA-2016:1650 http://support.novell.com/security/cve/CVE-2015-0204.html 20150310 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products DSA-3125 MDVSA-2015:019 MDVSA-2015:062 MDVSA-2015:063 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 71936 91787 1033378 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 http://www-304.ibm.com/support/docview.wss?uid=swg21960769 https://bto.bluecoat.com/security-advisory/sa88 https://bto.bluecoat.com/security-advisory/sa91 openssl-cve20150204-weak-security(99707) https://freakattack.com/ https://github.com/openssl/openssl/commit/ce325c60c74b0fa784f5872404b722e120e5cab0 https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241 https://kc.mcafee.com/corporate/index?page=content&id=SB10102 https://kc.mcafee.com/corporate/index?page=content&id=SB10108 https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 https://support.apple.com/HT204659 https://support.citrix.com/article/CTX216642 https://www.openssl.org/news/secadv_20150108.txt https://www.openssl.org/news/secadv_20150319.txt The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679 FEDORA-2015-0512 FEDORA-2015-0601 openSUSE-SU-2015:0130 SUSE-SU-2015:0578 SUSE-SU-2015:0946 openSUSE-SU-2015:1277 HPSBHF03289 HPSBMU03380 HPSBMU03409 HPSBMU03396 HPSBMU03413 HPSBMU03397 RHSA-2015:0066 20150310 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products DSA-3125 MDVSA-2015:019 MDVSA-2015:062 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 71941 91787 1033378 https://bto.bluecoat.com/security-advisory/sa88 openssl-cve20150205-sec-bypass(99708) https://github.com/openssl/openssl/commit/1421e0c584ae9120ca1b88098f13d6d2e90b83a3 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 https://kc.mcafee.com/corporate/index?page=content&id=SB10102 https://kc.mcafee.com/corporate/index?page=content&id=SB10108 https://support.citrix.com/article/CTX216642 https://www.openssl.org/news/secadv_20150108.txt Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection. FEDORA-2015-0512 FEDORA-2015-0601 openSUSE-SU-2015:0130 SUSE-SU-2015:0946 openSUSE-SU-2015:1277 HPSBHF03289 HPSBMU03380 HPSBMU03409 HPSBMU03396 HPSBMU03413 HPSBMU03397 RHSA-2015:0066 20150310 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products DSA-3125 MDVSA-2015:019 MDVSA-2015:062 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 71940 91787 1033378 https://bto.bluecoat.com/security-advisory/sa88 openssl-cve20150206-dos(99704) https://github.com/openssl/openssl/commit/103b171d8fc282ef435f8de9afbf7782e312961f https://kc.mcafee.com/corporate/index?page=content&id=SB10102 https://kc.mcafee.com/corporate/index?page=content&id=SB10108 https://www.openssl.org/news/secadv_20150108.txt The dtls1_listen function in d1_lib.c in OpenSSL 1.0.2 before 1.0.2a does not properly isolate the state information of independent data streams, which allows remote attackers to cause a denial of service (application crash) via crafted DTLS traffic, as demonstrated by DTLS 1.0 traffic to a DTLS 1.2 server. <a href="http://cwe.mitre.org/data/definitions/476.html" rel="nofollow">CWE-476: NULL Pointer Dereference</a> HPSBMU03380 HPSBMU03409 HPSBMU03397 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73229 1031929 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202351 https://git.openssl.org/?p=openssl.git;a=commit;h=819418110b6fff4a7b96f01a5d68f71df3e3b736 https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 https://www.openssl.org/news/secadv_20150319.txt The ASN.1 signature-verification implementation in the rsa_item_verify function in crypto/rsa/rsa_ameth.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted RSA PSS parameters to an endpoint that uses the certificate-verification feature. <a href="http://cwe.mitre.org/data/definitions/476.html" rel="nofollow">CWE-476: NULL Pointer Dereference</a> HPSBMU03380 HPSBMU03409 HPSBMU03397 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73230 1031929 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202369 https://git.openssl.org/?p=openssl.git;a=commit;h=4b22cce3812052fe64fc3f6d58d8cc884e3cb834 https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 https://www.openssl.org/news/secadv_20150319.txt Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 APPLE-SA-2015-06-30-2 FEDORA-2015-4303 FEDORA-2015-4320 FEDORA-2015-4300 FEDORA-2015-6951 FEDORA-2015-6855 SUSE-SU-2015:0541 openSUSE-SU-2015:1277 openSUSE-SU-2016:0640 openSUSE-SU-2015:0554 HPSBGN03306 SSRT102000 HPSBMU03380 HPSBMU03409 HPSBMU03413 HPSBMU03397 RHSA-2015:0715 RHSA-2015:0716 RHSA-2015:0752 RHSA-2016:1089 RHSA-2016:2957 http://support.apple.com/kb/HT204942 DSA-3197 MDVSA-2015:062 MDVSA-2015:063 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73239 1031929 USN-2537-1 https://access.redhat.com/articles/1384453 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1196737 https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=1b4a8df38fc9ab3c089ca5765075ee53ec5bd66a https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 https://support.citrix.com/article/CTX216642 FreeBSD-SA-15:06 https://www.openssl.org/news/secadv_20150319.txt wpa_supplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack. https://bugzilla.redhat.com/show_bug.cgi?id=1178263 https://bugzilla.redhat.com/show_bug.cgi?id=1178921 mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtain sensitive information via requests to the LTI Ajax service. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47920 [oss-security] 20150119 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=278611 Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48368 [oss-security] 20150119 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=278612 Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allow remote attackers to hijack the authentication of unspecified victims. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48106 [oss-security] 20150119 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=278613 message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to bypass a messaging-disabled setting via a web-services request, as demonstrated by a people-search request. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48329 [oss-security] 20150119 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=278614 calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to obtain sensitive calendar-event information via a web-services request. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48017 [oss-security] 20150119 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=278615 access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48034 [oss-security] 20150119 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=278616 filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48546 [oss-security] 20150119 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=278617 Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-47964 [oss-security] 20150119 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=278618 Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header. http://advisories.mageia.org/MGASA-2015-0026.html FEDORA-2015-0714 FEDORA-2015-0804 FEDORA-2015-0790 openSUSE-SU-2015:0643 openSUSE-SU-2015:1598 MDVSA-2015:036 MDVSA-2015:109 USN-2469-1 https://www.djangoproject.com/weblog/2015/jan/13/security/ The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a "\njavascript:" URL. http://advisories.mageia.org/MGASA-2015-0026.html FEDORA-2015-0714 FEDORA-2015-0804 openSUSE-SU-2015:0643 openSUSE-SU-2015:1598 USN-2469-1 MDVSA-2015:036 MDVSA-2015:109 https://www.djangoproject.com/weblog/2015/jan/13/security/ The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file. http://advisories.mageia.org/MGASA-2015-0026.html FEDORA-2015-0714 FEDORA-2015-0804 FEDORA-2015-0790 openSUSE-SU-2015:0643 openSUSE-SU-2015:1598 USN-2469-1 MDVSA-2015:036 MDVSA-2015:109 https://www.djangoproject.com/weblog/2015/jan/13/security/ ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries. http://advisories.mageia.org/MGASA-2015-0026.html FEDORA-2015-0714 FEDORA-2015-0804 FEDORA-2015-0790 openSUSE-SU-2015:0643 openSUSE-SU-2015:1598 USN-2469-1 MDVSA-2015:109 https://www.djangoproject.com/weblog/2015/jan/13/security/ Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling. http://packetstormsecurity.com/files/130106/Apache-Qpid-0.30-Anonymous-Action-Prevention.html 20150126 CVE-2015-0223: anonymous access to qpidd cannot be prevented 72319 RHBA-2016:1500 qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203. FEDORA-2016-120b194a75 [www-announce] 20150126 CVE-2015-0224: qpidd can be crashed by unauthenticated user http://packetstormsecurity.com/files/130105/Apache-Qpid-0.30-Crash.html RHSA-2015:0660 RHSA-2015:0661 RHSA-2015:0662 RHSA-2015:0707 20150126 CVE-2015-0224: qpidd can be crashed by unauthenticated user 72317 1031872 RHBA-2016:1500 RHSA-2015:0708 https://bugzilla.redhat.com/show_bug.cgi?id=1186302 https://issues.apache.org/jira/browse/QPID-6310 The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. http://packetstormsecurity.com/files/131249/Apache-Cassandra-Remote-Code-Execution.html RHSA-2015:1947 [user] 20150401 [SECURITY ANNOUNCEMENT] CVE-2015-0225 20150401 [SECURITY ANNOUNCEMENT] CVE-2015-0225 73478 1034002 Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487. RHSA-2015:0846 RHSA-2015:0847 RHSA-2015:0848 RHSA-2015:0849 RHSA-2015:1176 RHSA-2015:1177 72553 RHSA-2016:1376 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03900en_us https://ws.apache.org/wss4j/advisories/CVE-2015-0226.txt.asc https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks." RHSA-2015:0773 RHSA-2015:0846 RHSA-2015:0847 RHSA-2015:0848 RHSA-2015:0849 RHSA-2015:1176 RHSA-2015:1177 http://ws.apache.org/wss4j/advisories/CVE-2015-0227.txt.asc 72557 apache-wss4j-sec-bypass(100837) https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03900en_us https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html The lua_websocket_read function in lua_request.c in the mod_lua module in the Apache HTTP Server through 2.4.12 allows remote attackers to cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function. http://advisories.mageia.org/MGASA-2015-0099.html APPLE-SA-2015-08-13-2 APPLE-SA-2015-09-16-4 openSUSE-SU-2015:0418 RHSA-2015:1666 http://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x/CHANGES http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 73041 91787 1032967 USN-2523-1 https://github.com/apache/httpd/commit/643f0fcf3b8ab09a68f0ecd2aa37aafeda3e63ef [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html https://support.apple.com/HT205219 https://support.apple.com/kb/HT205031 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none. Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://advisories.mageia.org/MGASA-2015-0040.html APPLE-SA-2015-09-30-3 SUSE-SU-2015:0365 openSUSE-SU-2015:0325 SSRT102066 HPSBMU03380 HPSBMU03409 RHSA-2015:1053 RHSA-2015:1066 RHSA-2015:1135 DSA-3195 MDVSA-2015:032 MDVSA-2015:079 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html http://www.php.net/ChangeLog-5.php 72539 https://bugs.php.net/bug.php?id=68710 https://bugzilla.redhat.com/show_bug.cgi?id=1185397 https://github.com/php/php-src/commit/b585a3aed7880a5fa5c18e2b838fc96f40e075bd GLSA-201503-03 GLSA-201606-10 https://support.apple.com/HT205267 The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image. <a href="http://cwe.mitre.org/data/definitions/824.html">CWE-824: Access of Uninitialized Pointer</a> http://advisories.mageia.org/MGASA-2015-0040.html http://git.php.net/?p=php-src.git;a=commit;h=21bc7464f454fec18a9ec024c738f195602fee2a http://git.php.net/?p=php-src.git;a=commit;h=2fc178cf448d8e1b95d1314e47eeef610729e0df http://git.php.net/?p=php-src.git;a=commit;h=55001de6d8c6ed2aada870a76de1e4b4558737bf APPLE-SA-2015-09-30-3 SUSE-SU-2015:0365 openSUSE-SU-2015:0325 HPSBMU03380 HPSBMU03409 RHSA-2015:1053 RHSA-2015:1066 RHSA-2015:1135 RHSA-2015:1218 DSA-3195 MDVSA-2015:032 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html http://www.php.net/ChangeLog-5.php 72541 https://bugs.php.net/bug.php?id=68799 https://bugzilla.redhat.com/show_bug.cgi?id=1185472 GLSA-201503-03 https://support.apple.com/HT205267 Multiple insecure Temporary File vulnerabilities in 389 Administration Server before 1.1.38. FEDORA-2015-1711 https://bugzilla.redhat.com/show_bug.cgi?id=1183151 Multiple temporary file creation vulnerabilities in pki-core 10.2.0. https://bugzilla.redhat.com/show_bug.cgi?id=1183176 https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-0234.html Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST." http://blogs.sophos.com/2015/01/29/sophos-products-and-the-ghost-vulnerability-affecting-linux/ http://linux.oracle.com/errata/ELSA-2015-0090.html http://linux.oracle.com/errata/ELSA-2015-0092.html APPLE-SA-2015-06-30-2 APPLE-SA-2015-10-21-4 APPLE-SA-2015-09-30-3 HPSBGN03247 HPSBHF03289 HPSBGN03285 HPSBGN03270 HPSBMU03330 http://packetstormsecurity.com/files/130171/Exim-ESMTP-GHOST-Denial-Of-Service.html http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html http://packetstormsecurity.com/files/130974/Exim-GHOST-glibc-gethostbyname-Buffer-Overflow.html http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html RHSA-2015:0126 20150128 Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow 20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series 20150127 GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235) 20150127 Qualys Security Advisory CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow 62758 62812 62813 62816 62865 62870 62871 62879 62883 http://support.apple.com/kb/HT204942 20150128 GNU glibc gethostbyname Function Buffer Overflow Vulnerability DSA-3142 http://www.idirect.net/Partners/~/media/Files/CVE/iDirect-Posted-Common-Vulnerabilities-and-Exposures.pdf MDVSA-2015:039 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 20150311 OpenSSL v1.0.2 for Linux affected by CVE-2015-0235 72325 91787 1032909 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 http://www-01.ibm.com/support/docview.wss?uid=swg21695695 http://www-01.ibm.com/support/docview.wss?uid=swg21695774 http://www-01.ibm.com/support/docview.wss?uid=swg21695835 http://www-01.ibm.com/support/docview.wss?uid=swg21695860 http://www-01.ibm.com/support/docview.wss?uid=swg21696131 http://www-01.ibm.com/support/docview.wss?uid=swg21696243 http://www-01.ibm.com/support/docview.wss?uid=swg21696526 http://www-01.ibm.com/support/docview.wss?uid=swg21696600 http://www-01.ibm.com/support/docview.wss?uid=swg21696602 http://www-01.ibm.com/support/docview.wss?uid=swg21696618 https://bto.bluecoat.com/security-advisory/sa90 https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/01/27/the-ghost-vulnerability https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04874668 https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10671 https://kc.mcafee.com/corporate/index?page=content&id=SB10100 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series GLSA-201503-04 https://security.netapp.com/advisory/ntap-20150127-0001/ https://support.apple.com/HT205267 https://support.apple.com/HT205375 https://www.f-secure.com/en/web/labs_global/fsc-2015-1 https://www.qualys.com/research/security-advisories/GHOST-CVE-2015-0235.txt https://www.sophos.com/en-us/support/knowledgebase/121879.aspx libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. http://advisories.mageia.org/MGASA-2015-0046.html openSUSE-SU-2015:0225 RHSA-2015:0323 http://security.libvirt.org/2015/0001.html MDVSA-2015:035 MDVSA-2015:070 USN-2867-1 Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain. RHSA-2015:0888 1032231 selinux-policy as packaged in Red Hat OpenShift 2 allows attackers to obtain process listing information via a privilege escalation attack. https://access.redhat.com/security/cve/CVE-2015-0238 https://bugzilla.redhat.com/show_bug.cgi?id=1184739 The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f3747379accba8e95d70cec0eae0582c8c182050 [bk-commits-head] 20150123 KVM: x86: SYSENTER emulation is broken RHSA-2015:1272 DSA-3170 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.5 MDVSA-2015:058 [oss-security] 20150127 KVM SYSENTER emulation vulnerability - CVE-2015-0239 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 72842 USN-2513-1 USN-2514-1 USN-2515-1 USN-2516-1 USN-2517-1 USN-2518-1 https://bugzilla.redhat.com/show_bug.cgi?id=1186448 https://github.com/torvalds/linux/commit/f3747379accba8e95d70cec0eae0582c8c182050 The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c. http://advisories.mageia.org/MGASA-2015-0084.html SUSE-SU-2015:0353 SUSE-SU-2015:0371 openSUSE-SU-2015:0375 SUSE-SU-2015:0386 openSUSE-SU-2016:1064 openSUSE-SU-2016:1106 openSUSE-SU-2016:1107 SSRT101979 SSRT101952 RHSA-2015:0249 RHSA-2015:0250 RHSA-2015:0251 RHSA-2015:0252 RHSA-2015:0253 RHSA-2015:0254 RHSA-2015:0255 RHSA-2015:0256 RHSA-2015:0257 GLSA-201502-15 DSA-3171 MDVSA-2015:081 MDVSA-2015:082 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html 72711 1031783 SSA:2015-064-01 USN-2508-1 https://access.redhat.com/articles/1346913 https://bugzilla.redhat.com/show_bug.cgi?id=1191325 https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/ https://support.lenovo.com/product_security/samba_remote_vuln https://support.lenovo.com/us/en/product_security/samba_remote_vuln 36741 https://www.samba.org/samba/security/CVE-2015-0240 D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds. http://advisories.mageia.org/MGASA-2015-0071.html openSUSE-SU-2015:0300 DSA-3161 MDVSA-2015:176 [oss-security] 20150209 CVE-2015-0245: denial of service in dbus >= 1.4 systemd activation http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-1493. Reason: This candidate is a reservation duplicate of CVE-2015-1493. Notes: All CVE users should reference CVE-2015-1493 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Heap-based buffer overflow in openfs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code via crafted block group descriptor data in a filesystem image. http://advisories.mageia.org/MGASA-2015-0061.html http://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=f66e6ce4 FEDORA-2015-1840 FEDORA-2015-2511 FEDORA-2015-2516 SUSE-SU-2015:1103 openSUSE-SU-2015:1006 http://packetstormsecurity.com/files/130283/e2fsprogs-Input-Sanitization.html DSA-3166 MDVSA-2015:045 MDVSA-2015:067 http://www.ocert.org/advisories/ocert-2015-002.html 20150205 [oCERT-2015-002] e2fsprogs input sanitization errors 72520 USN-2507-1 https://bugzilla.redhat.com/show_bug.cgi?id=1187032 e2fsprogs-cve20150247-bo(100740) GLSA-201701-06 The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers. APPLE-SA-2015-09-16-2 openSUSE-SU-2015:0672 RHSA-2015:1633 RHSA-2015:1742 http://subversion.apache.org/security/CVE-2015-0248-advisory.txt DSA-3231 MDVSA-2015:192 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 74260 1033214 USN-2721-1 GLSA-201610-05 https://support.apple.com/HT205217 The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (aka VTL). http://cve.killedkenny.io/cve/CVE-2015-0249 [oss-security] 20150330 Fwd: CVE-2015-0249: Apache Roller allows admin users to execute arbitrary Java code https://mail-archives.apache.org/mod_mbox/roller-user/201503.mbox/%3CCAF1aazAPWTduVhrPr7WiFaspFdsh21yf0YiSB3UmLjtDVGnfXw@mail.gmail.com%3E XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> http://advisories.mageia.org/MGASA-2015-0138.html http://packetstormsecurity.com/files/130964/Apache-Batik-XXE-Injection.html RHSA-2016:0041 RHSA-2016:0042 20150322 [CVE-2015-0250] Apache Batik Information Disclosure Vulnerability (XXE Injection) DSA-3205 MDVSA-2015:203 1032781 USN-2548-1 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 http://xmlgraphics.apache.org/security.html The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences. APPLE-SA-2015-09-16-2 openSUSE-SU-2015:0672 RHSA-2015:1633 RHSA-2015:1742 20150611 Apache vulnerability program faulting module ntdll.dll http://subversion.apache.org/security/CVE-2015-0251-advisory.txt DSA-3231 MDVSA-2015:192 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 74259 1033214 USN-2721-1 GLSA-201610-05 https://support.apple.com/HT205217 internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data. FEDORA-2015-4226 FEDORA-2015-4272 FEDORA-2015-4251 FEDORA-2015-4228 FEDORA-2015-4321 FEDORA-2015-4285 openSUSE-SU-2016:0966 http://packetstormsecurity.com/files/131756/Apache-Xerces-C-XML-Parser-Denial-Of-Service.html RHSA-2015:1193 DSA-3199 http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html 73252 1032254 http://xerces.apache.org/xerces-c/secadv/CVE-2015-0252.txt https://shibboleth.net/community/advisories/secadv_20150319.txt 36906 The read_request_line function in server/protocol.c in the Apache HTTP Server 2.4.12 does not initialize the protocol structure member, which allows remote attackers to cause a denial of service (NULL pointer dereference and process crash) by sending a request that lacks a method to an installation that enables the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> http://httpd.apache.org/security/vulnerabilities_24.html APPLE-SA-2015-08-13-2 APPLE-SA-2015-09-16-4 RHSA-2015:1666 http://www.apache.org/dist/httpd/CHANGES_2.4 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 75964 1032967 https://bz.apache.org/bugzilla/show_bug.cgi?id=57531 https://github.com/apache/httpd/commit/6a974059190b8a0c7e499f4ab12fe108127099cb [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html https://support.apple.com/HT205219 https://support.apple.com/kb/HT205031 Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag. <a href="http://cwe.mitre.org/data/definitions/611.html" target="_blank">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> openSUSE-SU-2015:1751 [tomcat-taglibs-user] 20150227 [SECURITY] CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags http://packetstormsecurity.com/files/130575/Apache-Standard-Taglibs-1.2.1-XXE-Remote-Command-Execution.html RHSA-2015:1695 RHSA-2016:1838 RHSA-2016:1839 RHSA-2016:1840 RHSA-2016:1841 http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html 20150227 [SECURITY] CVE-2015-0254 XXE and RCE via XSL extension in JSTL XML tags 72809 1034934 USN-2551-1 RHSA-2016:1376 [tomcat-dev] 20190319 svn commit: r1855831 [27/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value in a XkbSetGeometry request. http://advisories.mageia.org/MGASA-2015-0073.html openSUSE-SU-2015:0337 openSUSE-SU-2015:0338 RHSA-2015:0797 DSA-3160 MDVSA-2015:119 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 72578 USN-2500-1 http://www.x.org/wiki/Development/Security/Advisory-2015-02-10/ GLSA-201504-06 Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup, which allows local users to obtain sensitive information by reading files in the directory. RHSA-2015:0888 1032231 OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage. [openstack-announce] 20150313 [OSSA 2015-005] Nova console Cross-Site WebSocket hijacking (CVE-2015-0259) RHSA-2015:0790 RHSA-2015:0843 RHSA-2015:0844 https://bugs.launchpad.net/nova/+bug/1409142 RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method. [oss-security] 20150210 CVE-2015-0260: Kallithea: API key of repository's creator exposed by get_repo API method 72573 kallithea-cve20150260-info-disc(100888) https://kallithea-scm.org/security/cve-2015-0260.html https://rhodecode.com/blog/rhodecode-enterprise-security-release/ Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value. http://advisories.mageia.org/MGASA-2015-0114.html FEDORA-2015-4939 FEDORA-2015-4804 openSUSE-SU-2015:0616 http://packetstormsecurity.com/files/130730/tcpdump-Denial-Of-Service-Code-Execution.html DSA-3193 MDVSA-2015:125 MDVSA-2015:182 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html 20150309 tcpdump 4.7.2 remote crashes 73019 1031937 USN-2580-1 RHSA-2017:1871 https://bugzilla.redhat.com/show_bug.cgi?id=1201792 GLSA-201510-04 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> RHSA-2015:1041 RHSA-2015:1538 RHSA-2015:1539 1032442 https://camel.apache.org/security-advisories.data/CVE-2015-0263.txt.asc https://git-wip-us.apache.org/repos/asf?p=camel.git;a=commitdiff;h=7d19340bcdb42f7aae584d9c5003ac4f7ddaee36 [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> RHSA-2015:1041 RHSA-2015:1538 RHSA-2015:1539 1032442 https://camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc https://git-wip-us.apache.org/repos/asf?p=camel.git;a=commitdiff;h=1df559649a96a1ca0368373387e542f46e4820da [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header. 76208 http://www.slideshare.net/wojdwo/big-problems-with-big-data-hadoop-interfaces-security https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger [ranger-dev] 20150805 CVEs fixed in Ranger 0.5 The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct access to module URLs. 76221 http://www.slideshare.net/wojdwo/big-problems-with-big-data-hadoop-interfaces-security https://cwiki.apache.org/confluence/display/RANGER/Vulnerabilities+found+in+Ranger [ranger-dev] 20150805 CVEs fixed in Ranger 0.5 The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file. <a href="https://cwe.mitre.org/data/definitions/61.html">CWE-61: UNIX Symbolic Link (Symlink) Following</a> RHSA-2015:0986 74622 The vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running on ARM hardware with general interrupt controller (GIC) version 2, allows local guest users to cause a denial of service (host crash) by writing an invalid value to the GICD.SGIR register. 72591 1031746 http://xenbits.xen.org/xsa/advisory-117.html xen-cve20150268-dos(100868) Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors. https://contao.org/en/news/contao-3_2_19.html https://contao.org/en/news/contao-3_4_4.html https://contao.org/en/news/directory-traversal-vulnerability-cve-2015-0269.html The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read arbitrary files via a crafted path. Per <a href="https://access.redhat.com/security/cve/CVE-2015-0271">this link</a> this vulnerability requires authentication. RHSA-2015:0645 RHSA-2015:0840 RHSA-2015:0841 GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215. http://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=d5fc88e573fa58b93034b04d35a2454f5d28cad9 SUSE-SU-2015:2108 SUSE-SU-2015:2194 SUSE-SU-2015:2292 SUSE-SU-2015:2339 SUSE-SU-2015:2350 SUSE-SU-2016:0354 SUSE-SU-2016:2074 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 76814 USN-2792-1 https://bugzilla.redhat.com/show_bug.cgi?id=1192132 Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://git.php.net/?p=php-src.git;a=commit;h=71335e6ebabc1b12c057d8017fd811892ecdfd24 APPLE-SA-2015-06-30-2 APPLE-SA-2015-10-21-4 APPLE-SA-2015-09-30-3 SUSE-SU-2015:0424 SUSE-SU-2015:0436 openSUSE-SU-2015:0440 SSRT102066 HPSBMU03380 HPSBMU03409 http://php.net/ChangeLog-5.php RHSA-2015:1053 RHSA-2015:1066 RHSA-2015:1135 RHSA-2015:1218 http://support.apple.com/kb/HT204942 DSA-3195 MDVSA-2015:079 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 72701 1031945 USN-2535-1 https://bugs.php.net/bug.php?id=68942 https://bugzilla.redhat.com/show_bug.cgi?id=1194730 GLSA-201606-10 https://support.apple.com/HT205267 https://support.apple.com/HT205375 The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8275cdd0e7ac550dcce2b3ef6d2fb3b808c1ae59 RHSA-2015:0290 RHSA-2015:0694 1031853 USN-2543-1 USN-2544-1 https://bugzilla.redhat.com/show_bug.cgi?id=1195248 https://github.com/torvalds/linux/commit/8275cdd0e7ac550dcce2b3ef6d2fb3b808c1ae59 The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request. http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0f2af21aae11972fa924374ddcf52e88347cf5a8 RHSA-2015:1778 RHSA-2015:1787 [oss-security] 20150223 CVE-2015-0275 -- Linux kernel: fs: ext4: fallocate zero range page size > block size BUG() http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 75139 1034454 [linux-ext4] 20150218 [PATCH] ext4: Allocate entire range in zero range https://bugzilla.redhat.com/show_bug.cgi?id=1193907 https://github.com/torvalds/linux/commit/0f2af21aae11972fa924374ddcf52e88347cf5a8 https://support.f5.com/csp/article/K05211147 Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2. [oss-security] 20150410 CVE-2015-0276: Kallithea: Lack of CSRF attack protection enables gaining unauthorised access to users' accounts 74052 https://kallithea-scm.org/security/cve-2015-0276.html The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience element when an AudienceRestriction is specified, which allows remote attackers to log in to other users' accounts via a crafted SAML assertion. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6254 for lack of validation for the Destination attribute in a Response element in a SAML assertion. RHSA-2015:0846 RHSA-2015:0847 RHSA-2015:0848 RHSA-2015:0849 https://bugzilla.redhat.com/show_bug.cgi?id=1194832 https://issues.jboss.org/browse/PLINK-678 libuv before 0.10.34 does not properly drop group privileges, which allows context-dependent attackers to gain privileges via unspecified vectors. http://advisories.mageia.org/MGASA-2015-0186.html MDVSA-2015:228 https://github.com/libuv/libuv/commit/66ab38918c911bcff025562cf06237d7fedaba0c https://github.com/libuv/libuv/pull/215 https://groups.google.com/forum/#!msg/libuv/0JZxwLMtsMI/jraczskYWWQJ FEDORA-2015-2313 GLSA-201611-10 JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter. JVN#56297719 JVNDB-2015-001959 http://packetstormsecurity.com/files/153734/Tufin-Secure-Change-Remote-Code-Execution.html RHSA-2015:0719 20190723 Tufin SecureChange uses Richfaces 4.3.5, vulnerable to CVE-2015-0279 (unauthenticated RCE) https://bugzilla.redhat.com/show_bug.cgi?id=1192140 GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors. RHSA-2015:1457 DSA-3191 http://www.gnutls.org/security.html 73119 1032148 The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups. FEDORA-2015-4747 FEDORA-2015-4788 RHSA-2015:0728 73377 https://bugzilla.redhat.com/show_bug.cgi?id=1195729 https://git.fedorahosted.org/cgit/slapi-nis.git/commit/?id=6573f91c95f7a353ad3bdf2fe95b0c15932aa097 Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811. RHSA-2016:0590 https://bugzilla.redhat.com/show_bug.cgi?id=1181152 https://bugzilla.redhat.com/show_bug.cgi?id=1181472 https://bugzilla.redhat.com/show_bug.cgi?id=1314906 https://bugzilla.redhat.com/show_bug.cgi?id=1315398 https://github.com/spacewalkproject/spacewalk/commit/dd418384171473c3e31386a1b4792f8c555dc744 https://github.com/spacewalkproject/spacewalk/commit/f3792c79c1c251a49cc4e382be8591636326a794 The ssl3_client_hello function in s3_clnt.c in OpenSSL 1.0.2 before 1.0.2a does not ensure that the PRNG is seeded before proceeding with a handshake, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and then conducting a brute-force attack. HPSBMU03380 HPSBMU03409 HPSBMU03397 http://www.fortiguard.com/advisory/2015-03-24-openssl-vulnerabilities-march-2015 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73234 1031929 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202410 https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=e1b568dd2462f7cacf98f3d117936c34e2849a6b https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 https://www.openssl.org/news/secadv_20150319.txt The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 APPLE-SA-2015-06-30-2 APPLE-SA-2015-09-16-1 APPLE-SA-2015-09-30-3 FEDORA-2015-4303 FEDORA-2015-4320 FEDORA-2015-4300 FEDORA-2015-6951 FEDORA-2015-6855 SUSE-SU-2015:0541 SUSE-SU-2015:0578 openSUSE-SU-2015:1277 openSUSE-SU-2016:0640 openSUSE-SU-2015:0554 HPSBGN03306 SSRT102000 HPSBMU03380 HPSBMU03409 HPSBMU03413 HPSBMU03397 RHSA-2015:0715 RHSA-2015:0716 RHSA-2015:0752 RHSA-2016:2957 http://support.apple.com/kb/HT204942 DSA-3197 http://www.fortiguard.com/advisory/2015-03-24-openssl-vulnerabilities-march-2015 MDVSA-2015:062 MDVSA-2015:063 http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73225 1031929 1032917 USN-2537-1 https://access.redhat.com/articles/1384453 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202366 https://git.openssl.org/?p=openssl.git;a=commit;h=c3c7fb07dc975dc3c9de0eddb7d8fd79fc9c67c1 https://kc.mcafee.com/corporate/index?page=content&id=SB10110 https://support.apple.com/HT205212 https://support.apple.com/HT205267 https://support.citrix.com/article/CTX216642 FreeBSD-SA-15:06 https://www.openssl.org/news/secadv_20150319.txt The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 APPLE-SA-2015-06-30-2 APPLE-SA-2015-09-16-1 APPLE-SA-2015-09-30-3 FEDORA-2015-4303 FEDORA-2015-4320 FEDORA-2015-4300 FEDORA-2015-6951 FEDORA-2015-6855 SUSE-SU-2015:0541 SUSE-SU-2015:0578 openSUSE-SU-2015:1277 openSUSE-SU-2016:0640 SUSE-SU-2016:0678 openSUSE-SU-2015:0554 HPSBGN03306 SSRT102000 HPSBMU03380 HPSBMU03409 HPSBMU03397 RHSA-2015:0715 RHSA-2015:0716 RHSA-2015:0752 RHSA-2015:0800 http://support.apple.com/kb/HT204942 DSA-3197 MDVSA-2015:062 MDVSA-2015:063 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73227 1031929 USN-2537-1 https://access.redhat.com/articles/1384453 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202380 https://git.openssl.org/?p=openssl.git;a=commit;h=b717b083073b6cacc0a5e2397b661678aff7ae7f https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 https://support.apple.com/HT205212 https://support.apple.com/HT205267 https://support.citrix.com/article/CTX216642 FreeBSD-SA-15:06 https://www.openssl.org/news/secadv_20150319.txt The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 APPLE-SA-2015-06-30-2 FEDORA-2015-4303 FEDORA-2015-4320 FEDORA-2015-4300 FEDORA-2015-6951 FEDORA-2015-6855 SUSE-SU-2015:0541 SUSE-SU-2015:0578 openSUSE-SU-2015:1277 openSUSE-SU-2016:0640 openSUSE-SU-2015:0554 HPSBGN03306 SSRT102000 HPSBMU03380 HPSBMU03409 HPSBMU03413 HPSBMU03397 RHSA-2015:0715 RHSA-2015:0716 RHSA-2015:0752 RHSA-2015:0800 http://support.apple.com/kb/HT204942 DSA-3197 MDVSA-2015:062 MDVSA-2015:063 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73237 1031929 USN-2537-1 https://access.redhat.com/articles/1384453 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202418 https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=28a00bcd8e318da18031b2ac8778c64147cd54f9 https://kc.mcafee.com/corporate/index?page=content&id=SB10110 https://rt.openssl.org/Ticket/Display.html?id=3708&user=guest&pass=guest GLSA-201503-11 https://support.citrix.com/article/CTX216642 FreeBSD-SA-15:06 https://www.openssl.org/news/secadv_20150319.txt The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 APPLE-SA-2015-06-30-2 FEDORA-2015-4303 FEDORA-2015-4320 FEDORA-2015-4300 FEDORA-2015-6951 FEDORA-2015-6855 SUSE-SU-2015:0541 SUSE-SU-2015:0578 openSUSE-SU-2015:1277 openSUSE-SU-2016:0640 openSUSE-SU-2015:0554 HPSBGN03306 SSRT102000 HPSBMU03380 HPSBMU03409 HPSBMU03397 RHSA-2015:0715 RHSA-2015:0716 RHSA-2015:0752 RHSA-2015:0800 http://support.apple.com/kb/HT204942 DSA-3197 http://www.fortiguard.com/advisory/2015-03-24-openssl-vulnerabilities-march-2015 MDVSA-2015:062 MDVSA-2015:063 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73231 1031929 USN-2537-1 https://access.redhat.com/articles/1384453 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202384 https://git.openssl.org/?p=openssl.git;a=commit;h=c0334c2c92dd1bc3ad8138ba6e74006c3631b0f9 https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 FreeBSD-SA-15:06 https://www.openssl.org/news/secadv_20150319.txt The multi-block feature in the ssl3_write_bytes function in s3_pkt.c in OpenSSL 1.0.2 before 1.0.2a on 64-bit x86 platforms with AES NI support does not properly handle certain non-blocking I/O cases, which allows remote attackers to cause a denial of service (pointer corruption and application crash) via unspecified vectors. HPSBMU03380 HPSBMU03409 HPSBMU03397 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73226 1031929 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202345 https://git.openssl.org/?p=openssl.git;a=commit;h=77c77f0a1b9f15b869ca3342186dfbedd1119d0e https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 https://www.openssl.org/news/secadv_20150319.txt The sigalgs implementation in t1_lib.c in OpenSSL 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by using an invalid signature_algorithms extension in the ClientHello message during a renegotiation. <a href="http://cwe.mitre.org/data/definitions/476.html" rel="nofollow">CWE-476: NULL Pointer Dereference</a> HPSBMU03380 HPSBMU03409 HPSBMU03397 http://www.fortiguard.com/advisory/2015-03-24-openssl-vulnerabilities-march-2015 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73235 1031929 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202338 https://git.openssl.org/?p=openssl.git;a=commit;h=76343947ada960b6269090638f5391068daee88d https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 https://www.openssl.org/news/secadv_20150319.txt Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 FEDORA-2015-4303 FEDORA-2015-4320 FEDORA-2015-4300 SUSE-SU-2015:0578 SSRT102000 HPSBMU03380 HPSBMU03409 HPSBMU03397 RHSA-2015:0715 RHSA-2015:0716 RHSA-2015:0752 RHSA-2015:0800 DSA-3197 http://www.fortiguard.com/advisory/2015-03-24-openssl-vulnerabilities-march-2015 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73228 1031929 USN-2537-1 https://access.redhat.com/articles/1384453 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202395 https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=d0666f289ac013094bbbf547bfbcd616199b7d2d https://kc.mcafee.com/corporate/index?page=content&id=SB10110 https://rt.openssl.org/Ticket/Display.html?id=2608&user=guest&pass=guest GLSA-201503-11 https://support.citrix.com/article/CTX216642 https://www.openssl.org/news/secadv_20150319.txt The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10680 APPLE-SA-2015-06-30-2 FEDORA-2015-4303 FEDORA-2015-4320 FEDORA-2015-4300 FEDORA-2015-6951 FEDORA-2015-6855 SUSE-SU-2015:0541 SUSE-SU-2015:0578 SUSE-SU-2016:0617 SUSE-SU-2016:0620 SUSE-SU-2016:0621 SUSE-SU-2016:0624 openSUSE-SU-2016:0628 SUSE-SU-2016:0631 openSUSE-SU-2016:0637 openSUSE-SU-2016:0638 openSUSE-SU-2016:0640 SUSE-SU-2016:0641 openSUSE-SU-2016:0720 SUSE-SU-2016:1057 openSUSE-SU-2015:0554 SSRT102000 HPSBMU03380 HPSBMU03409 HPSBMU03397 RHSA-2015:0715 RHSA-2015:0716 RHSA-2015:0752 RHSA-2015:0800 http://support.apple.com/kb/HT204942 MDVSA-2015:062 MDVSA-2015:063 http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 73232 1031929 USN-2537-1 https://access.redhat.com/articles/1384453 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202404 https://git.openssl.org/?p=openssl.git;a=commit;h=86f8fb0e344d62454f8daf3e15236b2b59210756 https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 https://support.citrix.com/article/CTX216642 FreeBSD-SA-15:06 https://www.openssl.org/news/secadv_20150319.txt The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file. FEDORA-2015-2895 FEDORA-2015-2897 FEDORA-2015-2866 FEDORA-2015-2869 FEDORA-2015-2886 FEDORA-2015-2901 openSUSE-SU-2015:0573 [Announce] 20150227 Qt Security Advisory: DoS vulnerability in the BMP image handler 73029 USN-2626-1 The pre-install script in texlive 3.1.20140525_r34255.fc21 as packaged in Fedora 21 and rpm, and texlive 6.20131226_r32488.fc20 and rpm allows local users to delete arbitrary files via a crafted file in the user's home directory. FEDORA-2015-4332 FEDORA-2015-4872 [oss-security] 20150227 CVE-2015-0296 preinstall scriptlet in texlive-base rpm of fedora allows unprivileged user to delete arbitrary files(maybe others) 72826 https://bugzilla.redhat.com/show_bug.cgi?id=1197082 Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager. RHSA-2015:0862 1032181 Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message. RHSA-2015:1641 RHSA-2015:1642 https://issues.jboss.org/browse/MODCLUSTER-453 Multiple cross-site scripting (XSS) vulnerabilities in Open Source Point of Sale 2.3.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. http://packetstormsecurity.com/files/133737/Open-Source-Point-Of-Sale-2.3.1-Cross-Site-Scripting.html Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 do not properly validate files, which has unspecified impact and attack vectors. http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 62177 62187 GLSA-201502-02 72034 1031525 adobe-cve20150301-unspecified(99981) Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to obtain sensitive keystroke information via unspecified vectors. http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 62177 62187 GLSA-201502-02 72035 1031525 adobe-cve20150302-info-disc(99982) Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0306. http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 62177 62187 GLSA-201502-02 72031 1031525 adobe-cve20150303-code-exec(99983) Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0309. http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 62177 62187 GLSA-201502-02 72032 1031525 adobe-cve20150304-bo(99985) 20141016 Adobe Flash Player Sound Object "loadCompressedDataFromByteArray" Heap Overflow Vulnerability Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion." http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 62177 62187 GLSA-201502-02 72033 1031525 adobe-cve20150305-code-exec(99987) Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0303. http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 62177 62187 GLSA-201502-02 72036 1031525 adobe-cve20150306-code-exec(99984) Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors. http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 62177 62187 GLSA-201502-02 72037 1031525 adobe-cve20150307-info-disc(99988) Use-after-free vulnerability in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 62177 62187 GLSA-201502-02 72039 1031525 adobe-cve20150308-code-exec(99989) Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0304. http://helpx.adobe.com/security/products/flash-player/apsb15-01.html 62177 62187 GLSA-201502-02 72038 1031525 adobe-cve20150309-bo(99986) Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015. http://helpx.adobe.com/security/products/flash-player/apsb15-02.html GLSA-201502-02 72261 1031609 Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015. http://helpx.adobe.com/security/products/flash-player/apsa15-01.html http://helpx.adobe.com/security/products/flash-player/apsb15-03.html SUSE-SU-2015:0151 SUSE-SU-2015:0163 http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html GLSA-201502-02 72283 1031597 https://technet.microsoft.com/library/security/2755801 Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux allows attackers to execute arbitrary code via unspecified vectors. <a href="http://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free </a> http://helpx.adobe.com/security/products/flash-player/apsb15-03.html 72343 1031634 adobe-flash-cve20150312-code-exec(100394) https://technet.microsoft.com/library/security/2755801 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 http://packetstormsecurity.com/files/131189/Adobe-Flash-Player-ByteArray-With-Workers-Use-After-Free.html 117853 72429 1031686 adobe-flash-cve20150313-code-exec(100641) https://helpx.adobe.com/security/products/flash-player/apsa15-02.html https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 36579 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150314-code-exec(100700) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0320, and CVE-2015-0322. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150315-code-exec(100697) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150316-code-exec(100701) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0319. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150317-code-exec(100706) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150318-code-exec(100702) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0317. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150319-code-exec(100707) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0315, and CVE-2015-0322. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150320-code-exec(100698) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0329, and CVE-2015-0330. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150321-code-exec(100703) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0315, and CVE-2015-0320. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150322-code-exec(100699) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0327. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150323-bo(100708) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150324-bo(100710) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0326 and CVE-2015-0328. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150325-dos(100711) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0325 and CVE-2015-0328. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150326-dos(100712) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0323. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150327-bo(100709) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-0325 and CVE-2015-0326. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150328-dos(100713) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, and CVE-2015-0330. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150329-code-exec(100704) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, and CVE-2015-0329. SUSE-SU-2015:0236 openSUSE-SU-2015:0237 openSUSE-SU-2015:0238 SUSE-SU-2015:0239 RHSA-2015:0140 GLSA-201502-02 72514 1031706 adobe-flash-cve20150330-code-exec(100705) https://helpx.adobe.com/security/products/flash-player/apsb15-04.html https://technet.microsoft.com/library/security/2755801 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0725 72698 https://helpx.adobe.com/security/products/flash-player/apsb15-04.html Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0333, CVE-2015-0335, and CVE-2015-0339. openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 openSUSE-SU-2015:0725 RHSA-2015:0697 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0335, and CVE-2015-0339. openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 RHSA-2015:0697 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0336. openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 RHSA-2015:0697 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0333, and CVE-2015-0339. openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 RHSA-2015:0697 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0334. openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 RHSA-2015:0697 73084 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 36962 Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass the Same Origin Policy via unspecified vectors. openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 RHSA-2015:0697 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors. <a href="http://cwe.mitre.org/data/definitions/190.html">CWE-190: Integer Overflow or Wraparound</a> openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 RHSA-2015:0697 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0333, and CVE-2015-0335. openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 RHSA-2015:0697 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass intended file-upload restrictions via unspecified vectors. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 RHSA-2015:0697 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0342. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 RHSA-2015:0697 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0341. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0490 SUSE-SU-2015:0491 SUSE-SU-2015:0493 openSUSE-SU-2015:0496 RHSA-2015:0697 1031922 https://helpx.adobe.com/security/products/flash-player/apsb15-05.html GLSA-201503-09 Cross-site scripting (XSS) vulnerability in admin/home/homepage/search in the web app in Adobe Connect before 9.4 allows remote attackers to inject arbitrary web script or HTML via the query parameter. http://packetstormsecurity.com/files/132269/Adobe-Connect-9.3-Cross-Site-Scripting.html 20150611 XSS vulnerability Adobe Connect 9.3 (CVE-2015-0343 ) 20150611 XSS vulnerability Adobe Connect 9.3 (CVE-2015-0343 ) 1032567 https://helpx.adobe.com/adobe-connect/release-note/connect-94-release-notes.html#Issues%20Resolved Cross-site scripting (XSS) vulnerability in the web app in Adobe Connect before 9.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 1032567 https://helpx.adobe.com/adobe-connect/release-note/connect-94-release-notes.html#Issues%20Resolved Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 1032106 https://helpx.adobe.com/security/products/coldfusion/apsb15-07.html Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0359. <a href="http://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free</a> openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74067 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043. openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74062 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Buffer overflow in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors. openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0351, CVE-2015-0358, and CVE-2015-3039. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74064 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043. openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74062 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0349, CVE-2015-0358, and CVE-2015-3039. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74064 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043. openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74062 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043. openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74062 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043. openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74062 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043. openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74062 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion." <a href="http://cwe.mitre.org/data/definitions/843.html">CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')</a> openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2015-3040. openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0349, CVE-2015-0351, and CVE-2015-3039. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74064 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0346. <a href="http://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free</a> openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74067 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043. openSUSE-SU-2015:0718 SUSE-SU-2015:0722 SUSE-SU-2015:0723 openSUSE-SU-2015:0725 RHSA-2015:0813 74062 1032105 https://helpx.adobe.com/security/products/flash-player/apsb15-06.html GLSA-201504-07 Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> FEDORA-2015-0331 FEDORA-2015-0345 openSUSE-SU-2015:0226 openSUSE-SU-2015:0256 71882 1031498 http://xenbits.xen.org/xsa/advisory-116.html GLSA-201504-04 Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7 allows remote attackers to affect confidentiality via unknown vectors related to BI Publisher Security. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72170 oracle-cpujan2015-cve20150362(100076) Unspecified vulnerability in the Siebel Core EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration Business Services. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72203 1031578 oracle-cpujan2015-cve20150363(100128) Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect availability via unknown vectors related to Integration Business Services. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72218 1031578 oracle-cpujan2015-cve20150364(100133) Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72190 1031578 oracle-cpujan2015-cve20150365(100122) Unspecified vulnerability in the Siebel Core - EAI component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Java Integration, a different vulnerability than CVE-2014-0369. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72180 1031578 oracle-cpujan2015-cve20150366(100118) Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to affect integrity via vectors related to SSO Engine. Per: http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html Please refer to My Oracle Support Note 1952939.1 for instructions on how to address this issue. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72179 oracle-cpujan2015-cve20150367(100077) Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.3.4, and 6.3.5 allows remote attackers to affect availability via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72123 1031576 oracle-cpujan2015-cve20150368(100105) Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to AX/HI Web UI. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72192 1031578 oracle-cpujan2015-cve20150369(100123) Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect integrity via unknown vectors, a different vulnerability than CVE-2013-5858. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72171 1031572 oracle-cpujan2015-cve20150370(100072) Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect integrity and availability via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72163 1031572 oracle-cpujan2015-cve20150371(100070) Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72183 oracle-cpujan2015-cve20150372(100078) Unspecified vulnerability in the OJVM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. Per: http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html This brings the OJVM component of Database in line with Java SE security fixes delivered as of January CPU 2015. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72145 1031572 oracle-cpujan2015-cve20150373(100067) Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges : Foreign Key. FEDORA-2015-1162 SUSE-SU-2015:0743 RHSA-2015:0116 RHSA-2015:0117 RHSA-2015:0118 RHSA-2015:1628 DSA-3135 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72227 1031581 USN-2480-1 oracle-cpujan2015-cve20150374(100191) GLSA-201504-05 Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows remote attackers to affect confidentiality via unknown vectors related to Network. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72153 1031583 oracle-cpujan2015-cve20150375(100164) Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Content Server. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72189 Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local users to affect availability via unknown vectors related to Core, a different vulnerability than CVE-2015-0418. openSUSE-SU-2015:0229 http://www.c7zero.info/stuff/csw2017_ExploringYourSystemDeeper_updated.pdf DSA-3143 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72219 oracle-cpujan2015-cve20150377(100176) GLSA-201612-27 Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Libc. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72147 1031583 oracle-cpujan2015-cve20150378(100174) Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 allows remote attackers to affect integrity via vectors related to PIA Core Technology. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72244 1031577 oracle-cpujan2015-cve20150379(100111) Unspecified vulnerability in the Oracle Telecommunications Billing Integrator component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.5, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to OA Based UI for Bill Summary. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72236 1031579 oracle-cpujan2015-cve20150380(100101) Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382. FEDORA-2015-1162 SUSE-SU-2015:0743 RHSA-2015:0116 RHSA-2015:0117 RHSA-2015:0118 RHSA-2015:1628 DSA-3135 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72214 1031581 USN-2480-1 oracle-cpujan2015-cve20150381(100185) GLSA-201504-05 Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0381. FEDORA-2015-1162 SUSE-SU-2015:0743 RHSA-2015:0116 RHSA-2015:0117 RHSA-2015:0118 RHSA-2015:1628 DSA-3135 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72200 1031581 USN-2480-1 oracle-cpujan2015-cve20150382(100184) GLSA-201504-05 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot. Per: http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. HPSBUX03281 FEDORA-2015-8264 FEDORA-2015-8226 FEDORA-2015-8251 openSUSE-SU-2015:0190 SUSE-SU-2015:0336 SUSE-SU-2015:0503 SSRT101951 SSRT101968 RHSA-2015:0068 RHSA-2015:0079 RHSA-2015:0080 RHSA-2015:0085 RHSA-2015:0086 DSA-3144 DSA-3147 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72155 1031580 USN-2486-1 USN-2487-1 http://www.vmware.com/security/advisories/VMSA-2015-0003.html oracle-cpujan2015-cve20150383(100148) GLSA-201507-14 GLSA-201603-14 Unspecified vulnerability in the Siebel Public Sector component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect integrity via unknown vectors related to Public Sector Portal. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72221 1031578 oracle-cpujan2015-cve20150384(100134) Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Pluggable Auth. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72229 1031581 oracle-cpujan2015-cve20150385(100190) GLSA-201504-05 Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 allows remote attackers to affect availability via unknown vectors related to Web Listener, a different vulnerability than CVE-2013-0338, CVE-2013-2877, and CVE-2014-0191. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72193 Unspecified vulnerability in the Siebel Core - Server OM Services component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via vectors related to Security - LDAP Security Adapter. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72198 1031578 oracle-cpujan2015-cve20150387(100126) Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0417. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72209 1031578 oracle-cpujan2015-cve20150388(100130) Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2014-6592. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72199 Unspecified vulnerability in the MICROS Retail component in Oracle Retail Applications Xstore: 3.2.1, 3.4.2, 3.5.0, 4.0.1, 4.5.1, 4.8.0, 5.0.3, 5.5.3, 6.0.6, and 6.5.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Xstore Point of Sale. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72247 1031591 oracle-cpujan2015-cve20150390(100138) Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier, and 5.6.19 and earlier, allows remote authenticated users to affect availability via vectors related to DDL. SUSE-SU-2015:0743 RHSA-2015:0116 RHSA-2015:0117 RHSA-2015:0118 RHSA-2015:1628 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72205 1031581 oracle-cpujan2015-cve20150391(100186) GLSA-201504-05 Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Config - Scripting. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72182 1031578 oracle-cpujan2015-cve20150392(100119) Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to DB Privileges. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the researcher's claim that the PUBLIC role is granted the INDEX privilege for the DUAL table during a "seeded install," which allows remote authenticated users to gain SYSDBA privileges and execute arbitrary code. http://www.databaseforensics.com/Oracle_Jan2015_CPU.pdf http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72230 1031579 oracle-cpujan2015-cve20150393(100097) Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via unknown vectors related to Report Distribution. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72246 1031577 oracle-cpujan2015-cve20150394(100115) Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. HPSBUX03281 openSUSE-SU-2015:0190 SUSE-SU-2015:0336 SUSE-SU-2015:0503 SSRT101951 SSRT101968 RHSA-2015:0068 RHSA-2015:0079 RHSA-2015:0080 RHSA-2015:0085 RHSA-2015:0086 RHSA-2015:0136 RHSA-2015:0264 DSA-3144 DSA-3147 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72142 1031580 USN-2486-1 USN-2487-1 http://www.vmware.com/security/advisories/VMSA-2015-0003.html oracle-cpujan2015-cve20150395(100143) GLSA-201507-14 GLSA-201603-14 https://www-304.ibm.com/support/docview.wss?uid=swg21695474 Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Admin Console. 62480 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72121 1031570 oracle-cpujan2015-cve20150396(100073) Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to File System, a different vulnerability than CVE-2014-6570 and CVE-2014-6600. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72164 1031583 oracle-cpujan2015-cve20150397(100173) Unspecified vulnerability in the Siebel Life Sciences component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Clinical Trip Report. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72207 1031578 oracle-cpujan2015-cve20150398(100129) Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 10.1.3.4.2 and 11.1.1.7 allows remote authenticated users to affect confidentiality via unknown vectors related to Analytics Web General. 62475 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72204 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Libraries. As per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html HPSBUX03281 openSUSE-SU-2015:0190 SUSE-SU-2015:0336 SUSE-SU-2015:0503 SSRT101951 SSRT101968 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72159 1031580 USN-2486-1 USN-2487-1 http://www.vmware.com/security/advisories/VMSA-2015-0003.html oracle-cpujan2015-cve20150400(100149) GLSA-201507-14 GLSA-201603-14 https://www-304.ibm.com/support/docview.wss?uid=swg21695474 Unspecified vulnerability in the Oracle Directory Server Enterprise Edition component in Oracle Fusion Middleware 7.0 and 11.1.1.7 allows remote authenticated users to affect integrity via unknown vectors related to Admin Console. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72212 Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Integration - COM. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72187 1031578 oracle-cpujan2015-cve20150402(100121) Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. As per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html HPSBUX03281 SUSE-SU-2015:0336 SSRT101951 SSRT101968 RHSA-2015:0079 RHSA-2015:0080 RHSA-2015:0086 RHSA-2015:0264 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72148 1031580 http://www.vmware.com/security/advisories/VMSA-2015-0003.html oracle-cpujan2015-cve20150403(100145) GLSA-201507-14 https://www-304.ibm.com/support/docview.wss?uid=swg21695474 Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Error Messages. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72224 1031579 oracle-cpujan2015-cve20150404(100100) Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to XA. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment. As per http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. HPSBUX03281 SUSE-SU-2015:0336 SSRT101951 SSRT101968 RHSA-2015:0079 RHSA-2015:0080 RHSA-2015:0086 RHSA-2015:0264 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72154 1031580 http://www.vmware.com/security/advisories/VMSA-2015-0003.html oracle-cpujan2015-cve20150406(100147) GLSA-201507-14 https://www-304.ibm.com/support/docview.wss?uid=swg21695474 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to Swing. As per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. HPSBUX03281 openSUSE-SU-2015:0190 SUSE-SU-2015:0336 SUSE-SU-2015:0503 SSRT101951 SSRT101968 RHSA-2015:0068 RHSA-2015:0079 RHSA-2015:0080 RHSA-2015:0085 RHSA-2015:0086 RHSA-2015:0136 RHSA-2015:0264 DSA-3144 DSA-3147 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72162 1031580 USN-2486-1 USN-2487-1 http://www.vmware.com/security/advisories/VMSA-2015-0003.html oracle-cpujan2015-cve20150407(100150) GLSA-201507-14 GLSA-201603-14 https://www-304.ibm.com/support/docview.wss?uid=swg21695474 Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. As per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html HPSBUX03281 openSUSE-SU-2015:0190 SUSE-SU-2015:0336 SUSE-SU-2015:0503 SSRT101951 SSRT101968 RHSA-2015:0068 RHSA-2015:0079 RHSA-2015:0080 RHSA-2015:0085 RHSA-2015:0086 RHSA-2015:0136 RHSA-2015:0264 DSA-3144 DSA-3147 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72140 1031580 USN-2486-1 USN-2487-1 http://www.vmware.com/security/advisories/VMSA-2015-0003.html oracle-cpujan2015-cve20150408(100142) GLSA-201507-14 GLSA-201603-14 https://www-304.ibm.com/support/docview.wss?uid=swg21695474 Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72223 1031581 oracle-cpujan2015-cve20150409(100188) GLSA-201504-05 Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security. Per: http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. HPSBUX03281 openSUSE-SU-2015:0190 SUSE-SU-2015:0336 SUSE-SU-2015:0503 SSRT101951 SSRT101968 RHSA-2015:0068 RHSA-2015:0079 RHSA-2015:0080 RHSA-2015:0085 RHSA-2015:0086 RHSA-2015:0136 RHSA-2015:0264 DSA-3144 DSA-3147 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72165 1031580 USN-2486-1 USN-2487-1 http://www.vmware.com/security/advisories/VMSA-2015-0003.html oracle-cpujan2015-cve20150410(100151) https://kc.mcafee.com/corporate/index?page=content&id=SB10104 GLSA-201507-14 https://source.android.com/security/bulletin/2016-11-01.html https://www-304.ibm.com/support/docview.wss?uid=swg21695474 Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption. FEDORA-2015-1162 SUSE-SU-2015:0743 RHSA-2015:0116 RHSA-2015:0117 RHSA-2015:0118 RHSA-2015:1628 DSA-3135 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72191 1031581 USN-2480-1 oracle-cpujan2015-cve20150411(100183) GLSA-201504-05 Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS. As per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. HPSBUX03281 openSUSE-SU-2015:0190 SUSE-SU-2015:0336 SUSE-SU-2015:0503 SSRT101951 SSRT101968 RHSA-2015:0068 RHSA-2015:0079 RHSA-2015:0080 RHSA-2015:0085 RHSA-2015:0086 RHSA-2015:0264 DSA-3144 DSA-3147 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72136 1031580 USN-2486-1 USN-2487-1 http://www.vmware.com/security/advisories/VMSA-2015-0003.html oracle-cpujan2015-cve20150412(100140) GLSA-201507-14 GLSA-201603-14 https://www-304.ibm.com/support/docview.wss?uid=swg21695474 Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability. As per http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. HPSBUX03281 SUSE-SU-2015:0336 SSRT101968 RHSA-2015:0079 RHSA-2015:0080 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72176 1031580 USN-2487-1 http://www.vmware.com/security/advisories/VMSA-2015-0003.html oracle-cpujan2015-cve20150413(100156) GLSA-201507-14 Unspecified vulnerability in the Oracle SOA Suite component in Oracle Fusion Middleware 11.1.1.7 and 12.1.3.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Fabric Layer. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72220 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Session Management. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72241 1031579 oracle-cpujan2015-cve20150415(100102) Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Roles & Privileges. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72128 1031576 oracle-cpujan2015-cve20150416(100109) Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0388. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72211 1031578 oracle-cpujan2015-cve20150417(100131) Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local users to affect availability via unknown vectors related to Core, a different vulnerability than CVE-2015-0377. openSUSE-SU-2015:0229 DSA-3143 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72194 oracle-cpujan2015-cve20150418(100182) GLSA-201612-27 Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2013-1510. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72197 1031578 oracle-cpujan2015-cve20150419(100125) Unspecified vulnerability in the Oracle Forms component in Oracle Fusion Middleware 11.1.1.7 and 11.1.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Forms Services. 62479 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72225 Unspecified vulnerability in Oracle Java SE 8u25 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the installation process. As per Oracle: Applies to installation process on client deployment of Java. SUSE-SU-2015:0336 RHSA-2015:0080 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72150 1031580 oracle-cpujan2015-cve20150421(100146) GLSA-201507-14 Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, and 6.3.5 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Infrastructure. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72127 1031576 oracle-cpujan2015-cve20150422(100108) Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Unspecified vulnerability in the Integrated Lights Out Manager (ILOM) component in Oracle Sun Systems Products Suite ILOM prior to 3.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to IPMI. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72181 1031594 oracle-cpujan2015-cve20150424(100158) Unspecified vulnerability in the Oracle Enterprise Asset Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Siebel Core - Unix/Windows. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72185 1031578 oracle-cpujan2015-cve20150425(100120) Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.3 and 12.1.0.4 allows remote attackers to affect confidentiality via unknown vectors related to UI Framework. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72235 Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.3.20 allows local users to affect integrity and availability via vectors related to VMSVGA virtual graphics device, a different vulnerability than CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and CVE-2014-6595. openSUSE-SU-2015:0229 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72216 oracle-cpujan2015-cve20150427(100181) GLSA-201612-27 Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Resource Control. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72144 1031583 oracle-cpujan2015-cve20150428(100169) Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect integrity and availability via vectors related to RPC Utility. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72133 1031583 oracle-cpujan2015-cve20150429(100172) Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality via vectors related to RPC Utility. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72141 1031583 oracle-cpujan2015-cve20150430(100175) Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0 6.3.1, 6.3.2, 6.3.4, and 6.3.5 allows remote attackers to affect integrity via unknown vectors related to UI Infrastructure. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72125 1031576 oracle-cpujan2015-cve20150431(100107) Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key. FEDORA-2015-1162 SUSE-SU-2015:0743 RHSA-2015:0116 RHSA-2015:0117 RHSA-2015:0118 RHSA-2015:1628 DSA-3135 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72217 1031581 USN-2480-1 oracle-cpujan2015-cve20150432(100187) GLSA-201504-05 Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to InnoDB : DML. SUSE-SU-2015:0946 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1647 RHSA-2015:1665 DSA-3229 DSA-3311 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 USN-2575-1 GLSA-201507-19 Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to affect confidentiality via vectors related to Integration with OAM. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72226 oracle-cpujan2015-cve20150434(100081) Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, and 6.3.5 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72122 1031576 oracle-cpujan2015-cve20150435(100104) Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect confidentiality via unknown vectors related to Login. http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72249 1031589 oracle-cpujan2015-cve20150436(100136) Unspecified vulnerability in Oracle Java SE 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. SUSE-SU-2015:0336 RHSA-2015:0080 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html 72146 1031580 oracle-cpujan2015-cve20150437(100144) GLSA-201603-11 Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-4756. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74085 1032121 GLSA-201507-19 Unspecified vulnerability in the Oracle Knowledge component in Oracle Right Now Service Cloud 8.2.3.10.1 and 8.4.7.2 allows remote attackers to affect integrity via unknown vectors related to Information Manager Console. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Encryption. SUSE-SU-2015:0946 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1647 RHSA-2015:1665 DSA-3229 DSA-3311 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 USN-2575-1 GLSA-201507-19 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via vectors related to Configurator DMZ rules. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032129 Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via vectors related to ZFS File system. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032132 Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect integrity via unknown vectors related to Console. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032131 Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to WebCenter Spaces Application. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032131 Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 3.0-04 allows remote authenticated users to affect confidentiality via vectors related to OpenSSO Web Agents. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032131 Unspecified vulnerability in the Oracle VM Server for SPARC component in Oracle Sun Systems Products Suite 3.1 and 3.2 allows remote attackers to affect confidentiality via unknown vectors related to Ldom Manager. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74127 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote attackers to affect confidentiality via vectors related to PORTAL. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032125 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors. Per Oracle: The CVSS score is 6.8 only on Windows for Database versions prior to 12c. The CVSS is 4.0 (Confidentiality is "Partial+") for Database 12c on Windows and for all versions of Database on Linux, Unix and other platforms. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032118 Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Portlet Services. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032131 Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2629. Per Oracle: The CVSS score is 9.0 only on Windows for Database versions prior to 12c. The CVSS is 6.5 (Confidentiality, Integrity and Availability is "Partial+") for Database 12c on Windows and for all versions of Database on Linux, Unix and other platforms. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032118 Unspecified vulnerability in in Oracle Java SE 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 SUSE-SU-2015:2166 SUSE-SU-2015:2168 SUSE-SU-2015:2182 SUSE-SU-2015:2192 SUSE-SU-2015:2216 SUSE-SU-2016:0113 RHSA-2015:0854 RHSA-2015:0857 RHSA-2015:0858 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1091 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74141 1032120 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 GLSA-201603-11 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0491. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 SUSE-SU-2015:2166 SUSE-SU-2015:2168 SUSE-SU-2015:2182 SUSE-SU-2015:2192 SUSE-SU-2015:2216 SUSE-SU-2016:0113 RHSA-2015:0854 RHSA-2015:0857 RHSA-2015:0858 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1021 RHSA-2015:1091 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74083 1032120 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 GLSA-201603-11 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://advisories.mageia.org/MGASA-2015-0158.html openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 RHSA-2015:0806 RHSA-2015:0807 RHSA-2015:0808 RHSA-2015:0809 RHSA-2015:0854 RHSA-2015:0857 RHSA-2015:0858 DSA-3234 DSA-3235 DSA-3316 MDVSA-2015:212 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74097 1032120 USN-2573-1 USN-2574-1 GLSA-201603-11 Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Authentication Engine. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032131 Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032124 Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032124 Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote attackers to affect confidentiality via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032124 Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Infrastructure. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032124 Unspecified vulnerability in the Oracle Retail Back Office component in Oracle Retail Applications 12.0, 12.0IN, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0, and 14.1 allows remote attackers to affect integrity via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74093 1032128 Unspecified vulnerability in the PeopleSoft Enterprise HCM Talent Acquisition Manager component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote attackers to affect integrity via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032917 Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, and 12.1.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. SUSE-SU-2015:1353 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032903 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://advisories.mageia.org/MGASA-2015-0158.html openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 SUSE-SU-2015:2166 SUSE-SU-2015:2168 SUSE-SU-2015:2182 SUSE-SU-2015:2192 SUSE-SU-2015:2216 SUSE-SU-2016:0113 RHSA-2015:0806 RHSA-2015:0807 RHSA-2015:0808 RHSA-2015:0809 RHSA-2015:0854 RHSA-2015:0857 RHSA-2015:0858 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1021 RHSA-2015:1091 DSA-3234 DSA-3235 DSA-3316 MDVSA-2015:212 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74072 1032120 USN-2573-1 USN-2574-1 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 GLSA-201603-11 Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect integrity via unknown vectors related to Hotspot. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) openSUSE-SU-2015:0773 RHSA-2015:0809 RHSA-2015:0854 DSA-3234 DSA-3235 DSA-3316 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74149 1032120 GLSA-201603-11 Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to libelfsign. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74138 1032132 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2015-0487. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032125 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control MOS 12.1.0.5 and 12.1.0.6 allows remote attackers to affect integrity via unknown vectors related to My Oracle Support Plugin. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032122 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.1, 8.5.0, and 8.5.1 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-0493. Per Oracle: Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS Base Score would increase to 6.8. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74139 1032131 Unspecified vulnerability in the JD Edwards EnterpriseOne Technology component in Oracle JD Edwards Products 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Runtime Security. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032126 Unspecified vulnerability in the SQL Trace Analyzer component in Oracle Support Tools before 12.1.11 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. Per Oracle: Please refer to My Oracle Support Note 215187.1 for instructions on upgrading to SQLT version 12.1.11. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity via unknown vectors related to Beans. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://advisories.mageia.org/MGASA-2015-0158.html openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 SUSE-SU-2015:2166 SUSE-SU-2015:2168 SUSE-SU-2015:2182 SUSE-SU-2015:2192 SUSE-SU-2015:2216 SUSE-SU-2016:0113 RHSA-2015:0806 RHSA-2015:0807 RHSA-2015:0808 RHSA-2015:0809 RHSA-2015:0854 RHSA-2015:0857 RHSA-2015:0858 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1021 RHSA-2015:1091 DSA-3234 DSA-3235 DSA-3316 MDVSA-2015:212 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74119 1032120 USN-2573-1 USN-2574-1 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 GLSA-201603-11 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect confidentiality via vectors related to JCE. Per Oracle: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://advisories.mageia.org/MGASA-2015-0158.html openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 SUSE-SU-2015:2166 SUSE-SU-2015:2168 SUSE-SU-2015:2182 SUSE-SU-2015:2192 SUSE-SU-2015:2216 SUSE-SU-2016:0113 RHSA-2015:0806 RHSA-2015:0807 RHSA-2015:0808 RHSA-2015:0809 RHSA-2015:0854 RHSA-2015:0857 RHSA-2015:0858 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1021 RHSA-2015:1091 DSA-3234 DSA-3235 DSA-3316 MDVSA-2015:212 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74147 1032120 1035517 USN-2573-1 USN-2574-1 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 http://www-304.ibm.com/support/docview.wss?uid=swg21903565 http://www-304.ibm.com/support/docview.wss?uid=swg21960194 GLSA-201603-11 Unspecified vulnerability in the XDK and XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect availability via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032118 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40 allows remote attackers to affect integrity and availability via unknown vectors related to Tools. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://advisories.mageia.org/MGASA-2015-0158.html openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 SUSE-SU-2015:2166 SUSE-SU-2015:2168 SUSE-SU-2015:2182 SUSE-SU-2015:2192 SUSE-SU-2015:2216 SUSE-SU-2016:0113 RHSA-2015:0806 RHSA-2015:0807 RHSA-2015:0808 RHSA-2015:0809 RHSA-2015:0854 RHSA-2015:0857 RHSA-2015:0858 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1021 RHSA-2015:1091 DSA-3234 DSA-3235 DSA-3316 MDVSA-2015:212 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74104 1032120 USN-2573-1 USN-2574-1 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 GLSA-201603-11 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.2.0 and 12.1.3.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032131 Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect integrity via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032118 Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0492. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 RHSA-2015:0854 RHSA-2015:0857 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74135 1032120 GLSA-201603-11 Unspecified vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032125 Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) openSUSE-SU-2015:0773 RHSA-2015:0854 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74145 1032120 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 GLSA-201603-11 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2015-0472. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032125 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JRockit R28.3.5, allows remote attackers to affect availability via vectors related to JSSE. Per Oracle: Applies to client and server deployment of JSSE. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://advisories.mageia.org/MGASA-2015-0158.html openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 SUSE-SU-2015:2166 SUSE-SU-2015:2168 SUSE-SU-2015:2182 SUSE-SU-2015:2192 SUSE-SU-2015:2216 SUSE-SU-2016:0113 RHSA-2015:0806 RHSA-2015:0807 RHSA-2015:0808 RHSA-2015:0809 RHSA-2015:0854 RHSA-2015:0857 RHSA-2015:0858 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1021 RHSA-2015:1091 DSA-3234 DSA-3235 DSA-3316 MDVSA-2015:212 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74111 1032120 USN-2573-1 USN-2574-1 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 http://www-304.ibm.com/support/docview.wss?uid=swg21903565 http://www-304.ibm.com/support/docview.wss?uid=swg21960194 http://www-304.ibm.com/support/docview.wss?uid=swg21960769 GLSA-201603-11 Unspecified vulnerability in the Application Management Pack for Oracle E-Business Suite component in Oracle E-Business Suite AMP 121030 and 121020 allows local users to affect confidentiality via vectors related to EBS Plugin. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032129 Unspecified vulnerability in the Oracle Agile Engineering Data Management component in Oracle Supply Chain Products Suite 6.1.3.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to BAS - Base Component. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032124 Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and Java FX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0459. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 SUSE-SU-2015:2166 SUSE-SU-2015:2168 SUSE-SU-2015:2182 SUSE-SU-2015:2192 SUSE-SU-2015:2216 SUSE-SU-2016:0113 RHSA-2015:0854 RHSA-2015:0857 RHSA-2015:0858 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1021 RHSA-2015:1091 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74094 1032120 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 GLSA-201603-11 Unspecified vulnerability in Oracle Java SE 7u76 and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0484. Per Oracle: Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) openSUSE-SU-2015:0773 openSUSE-SU-2015:0774 SUSE-SU-2015:0833 RHSA-2015:0854 RHSA-2015:0857 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74129 1032120 GLSA-201603-11 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.1, 8.5.0, and 8.5.1 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-0474. Per Oracle: Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS Base Score would increase to 6.8. (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) http://packetstormsecurity.com/files/131494/Oracle-Outside-In-ibpsd2.dll-PSD-File-Processing-Buffer-Overflow.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 20150416 Secunia Research: Oracle Outside In ibpsd2.dll PSD File Processing Buffer Overflow Vulnerability 74134 1032131 Unspecified vulnerability in the Oracle Retail Central Office component in Oracle Retail Applications 13.1, 13.2, 13.3, 13.4, 14.0, and 14.1 allows remote attackers to affect integrity via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032128 Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.x and 11.x allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Workbench. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality via vectors related to PIA Search Functionality. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032125 Unspecified vulnerability in the PeopleSoft Enterprise Portal Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote attackers to affect integrity via unknown vectors related to Enterprise Portal. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032125 Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Replication. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Federated. SUSE-SU-2015:0946 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1647 RHSA-2015:1665 DSA-3229 DSA-3311 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 USN-2575-1 https://mariadb.com/kb/en/mariadb/mariadb-5543-release-notes/ GLSA-201507-19 Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74081 1032121 GLSA-201507-19 Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Compiling. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 SUSE-SU-2015:0946 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1647 RHSA-2015:1665 DSA-3229 DSA-3311 MDVSA-2015:227 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 USN-2575-1 https://mariadb.com/kb/en/mariadb/mariadb-5543-release-notes/ GLSA-201507-19 Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1 and 8.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032127 Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Error Messages. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032129 Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL. SUSE-SU-2015:0946 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1647 RHSA-2015:1665 DSA-3229 DSA-3311 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74112 1032121 USN-2575-1 https://mariadb.com/kb/en/mariadb/mariadb-5543-release-notes/ GLSA-201507-19 Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB, a different vulnerability than CVE-2015-0508. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB, a different vulnerability than CVE-2015-0506. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Unspecified vulnerability in the Oracle Hyperion BI+ component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to Reporting and Analysis. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032123 Unspecified vulnerability in the Oracle Commerce Platform component in Oracle Commerce Platform 9.4, 10.0, and 10.2 allows remote attackers to affect integrity via vectors related to Dynamo Application Framework - HTML Admin User Interface. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : SP. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> 20150129 ESA-2015-002: Unisphere Central Security Update for Multiple Vulnerabilities 72374 1031684 Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified fields. 20150120 ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities 72259 1031567 EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 might allow remote attackers to obtain cleartext data-center discovery credentials by leveraging certain SRM access to conduct a decryption attack. 20150120 ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities http://packetstormsecurity.com/files/130910/EMC-M-R-Watch4net-Insecure-Credential-Storage.html 20150318 EMC M&R (Watch4net) data storage collector credentials are not properly protected 20150318 EMC M&R (Watch4net) data storage collector credentials are not properly protected 72257 1031567 https://www.securify.nl/advisory/SFY20141101/emc_m_r__watch4net__data_storage_collector_credentials_are_not_properly_protected.html Unrestricted file upload vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to execute arbitrary code by uploading and then accessing an executable file. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> 20150120 ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities 72256 1031567 Directory traversal vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to read arbitrary files via a crafted URL. 20150120 ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities 20150318 Path traversal vulnerability in EMC M&R (Watch4net) MIB Browser 20150318 Path traversal vulnerability in EMC M&R (Watch4net) MIB Browser 72255 1031567 https://www.securify.nl/advisory/SFY20141105/path_traversal_vulnerability_in_emc_m_r__watch4net__mib_browser.html The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which allows remote authenticated users to obtain sensitive information by reading a file. 20150204 ESA-2015-010: EMC Documentum D2 Multiple Vulnerabilities 72501 1031693 emc-documentum-cve20150517-info-disc(100874) The Properties service in the D2FS web-service component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 allows remote authenticated users to obtain superuser privileges via an unspecified method call that modifies group permissions. 20150204 ESA-2015-010: EMC Documentum D2 Multiple Vulnerabilities 72502 1031693 emc-documentum-cve20150518-priv-esc(100875) The InputAccel Database (IADB) installation process in EMC Captiva Capture 7.0 before patch 25 and 7.1 before patch 13 places a cleartext InputAccel (IA) SQL password in a DAL log file, which allows local users to obtain sensitive information by reading a file. 20150205 ESA-2015-012: EMC Captiva Capture Sensitive Information Disclosure Vulnerability http://packetstormsecurity.com/files/130284/EMC-Captiva-Capture-Sensitive-Information-Disclosure.html emc-captiva-cve20150519-info-disc(100748) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Cross-site scripting (XSS) vulnerability in EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to the CMP shared secret parameter. http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html 20150311 ESA-2015-014: RSA Digital Certificate Solution Multiple Vulnerabilities 1031912 Cross-site scripting (XSS) vulnerability in EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allows remote attackers to inject arbitrary web script or HTML via vectors related to the email address parameter. http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html 20150311 ESA-2015-014: RSA Digital Certificate Solution Multiple Vulnerabilities 1031912 EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allow remote attackers to cause an Administration Server denial of service via an invalid MIME e-mail message with a multipart/* Content-Type header. http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html 20150311 ESA-2015-014: RSA Digital Certificate Solution Multiple Vulnerabilities 1031912 SQL injection vulnerability in the Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html 20150310 ESA-2015-040: EMC Secure Remote Services Virtual Edition Security Update for Multiple Vulnerabilities 20150318 EMC Secure Remote Services Virtual Edition Provisioning component is affected by SQL injection 20150318 EMC Secure Remote Services Virtual Edition Provisioning component is affected by SQL injection https://www.securify.nl/advisory/SFY20141113/emc_secure_remote_services_virtual_edition_provisioning_component_is_affected_by_sql_injection.html The Gateway Provisioning service in EMC Secure Remote Services Virtual Edition (ESRS VE) 3.02 and 3.03 allows remote attackers to execute arbitrary OS commands via unspecified vectors. http://packetstormsecurity.com/files/130768/EMC-Secure-Remote-Services-GHOST-SQL-Injection-Command-Injection.html 20150310 ESA-2015-040: EMC Secure Remote Services Virtual Edition Security Update for Multiple Vulnerabilities 20150318 Command injection vulnerability in EMC Secure Remote Services Virtual Edition 20150318 Command injection vulnerability in EMC Secure Remote Services Virtual Edition https://www.securify.nl/advisory/SFY20141112/command_injection_vulnerability_in_emc_secure_remote_services_virtual_edition.html Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Validation Manager (RVM) 3.2 before build 201 allow remote attackers to inject arbitrary web script or HTML via the (1) displayMode or (2) wrapPreDisplayMode parameter. 20150616 ESA-2015-043: RSA Validation Manager Security Update for Multiple Vulnerabilities 1032590 EMC Documentum xCelerated Management System (xMS) 1.1 before P14 stores cleartext Windows Service credentials in a batch file during Documentum Platform and xCelerated Composition Platform (xCP) provisioning, which allows local users to obtain sensitive information by reading a file. http://packetstormsecurity.com/files/130959/EMC-Documentum-xMS-Sensitive-Information-Disclosure.html 20150325 ESA-2015-044: EMC Documentum xMS Sensitive Information Disclosure Vulnerability The RPC daemon in EMC Isilon OneFS 6.5.x and 7.0.x before 7.0.2.13, 7.1.0 before 7.1.0.6, 7.1.1 before 7.1.1.2, and 7.2.0 before 7.2.0.1 allows local users to gain privileges by leveraging an ability to modify system files. http://packetstormsecurity.com/files/131035/EMC-Isilon-OneFS-Privilege-Escalation.html 20150325 ESA-2015-049: EMC Isilon OneFS Privilege Escalation Vulnerability EMC PowerPath Virtual Appliance (aka vApp) before 2.0 has default passwords for the (1) emcupdate and (2) svcuser accounts, which makes it easier for remote attackers to obtain potentially sensitive information via a login session. http://packetstormsecurity.com/files/131250/EMC-PowerPath-Virtual-Appliance-Undocumented-User-Accounts.html 20150401 ESA-2015-056: EMC PowerPath Virtual Appliance Undocumented User Accounts Vulnerability Buffer overflow in an unspecified function in nsr_render_log in EMC NetWorker before 8.0.4.3, 8.1.x before 8.1.2.6, and 8.2.x before 8.2.1.2 allows local users to gain privileges via unknown vectors. 20150415 ESA-2015-069: EMC NetWorker Buffer Overflow Vulnerability 1032147 EMC SourceOne Email Management before 7.2 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack. http://packetstormsecurity.com/files/131748/EMC-SourceOne-Email-Management-Account-Lockout-Policy.html 20150504 ESA-2015-077: EMC SourceOne Email Management Account Lockout 1032238 EMC RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account. http://packetstormsecurity.com/files/131710/RSA-IMG-6.9-6.9.1-Insecure-Password-Reset.html 20150429 ESA-2015-078: RSA Identity Management and Governance (IMG) Insecure Password Reset Vulnerability 1032218 EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier allow remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message, a similar issue to CVE-2014-3572. 20150817 ESA-2015-081: RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities 76377 EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-J before 6.2, RSA BSAFE SSL-J before 6.2, and RSA BSAFE SSL-C 2.8.9 and earlier do not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, a similar issue to CVE-2014-8275. 20150817 ESA-2015-081: RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities 76377 1033297 1033298 EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier do not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a similar issue to CVE-2015-0204. 20150817 ESA-2015-081: RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities 76377 EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allow remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero, a similar issue to CVE-2015-1787. 20150817 ESA-2015-081: RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities 76377 Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-C Micro Edition (Crypto-C ME) before 4.0.4 and 4.1, and RSA BSAFE SSL-C 2.8.9 and earlier allows remote attackers to cause a denial of service (memory corruption or segmentation fault) or possibly have unspecified other impact via crafted base64 data, a similar issue to CVE-2015-0292. 20150817 ESA-2015-081: RSA BSAFE Micro Edition Suite, Crypto-C Micro Edition, Crypto-J, SSL-J and SSL-C Multiple Vulnerabilities 76377 1033299 ftagent.exe in EMC AutoStart 5.4.x and 5.5.x before 5.5.0.508 HF4 allows remote attackers to execute arbitrary commands via crafted packets. http://packetstormsecurity.com/files/131749/EMC-AutoStart-5.4.3-5.5.0-Packet-Injection.html 20150504 ESA-2015-084: EMC AutoStart Packet Injection Vulnerability VU#581276 1032237 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. SQL injection vulnerability in the xAdmin interface in EMC Document Sciences xPression 4.2 before P44 and 4.5 SP1 before P03 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. 20150516 ESA-2015-087 EMC Document Sciences xPression SQL Injection Vulnerability Cross-site request forgery (CSRF) vulnerability in EMC RSA Web Threat Detection before 5.1 allows remote attackers to hijack the authentication of arbitrary users. 20150603 ESA-2015-091: RSA Web Threat Detection Cross-Site Request Forgery Vulnerability 1032477 Multiple cross-site request forgery (CSRF) vulnerabilities in EMC RSA Archer GRC 5.5 SP1 before P3 allow remote attackers to hijack the authentication of arbitrary users. 20150817 ESA-2015-094: RSA Archer GRC Multiple Cross-Site Request Forgery Vulnerabilities 76404 1033300 EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. 20150626 ESA-2015-097: EMC Secure Remote Services (ESRS) Virtual Edition (VE) Multiple Security Vulnerabilities 1032740 EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly generate random values for session cookies, which makes it easier for remote attackers to hijack sessions by predicting a value. <a href="https://cwe.mitre.org/data/definitions/331.html">CWE-331: Insufficient Entropy</a> 20150626 ESA-2015-097: EMC Secure Remote Services (ESRS) Virtual Edition (VE) Multiple Security Vulnerabilities 1032740 EMC Unisphere for VMAX 8.x before 8.0.3.4 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors. 20150625 ESA-2015-102: EMC Unisphere for VMAX Remote Code Execution Vulnerability 1032732 EMC Unified Infrastructure Manager/Provisioning (UIM/P) 4.1 allows remote attackers to bypass LDAP authentication by providing a valid account name. 20150616 ESA-2015-106: EMC Unified Infrastructure Manager/Provisioning (UIM/P) Authentication Bypass Vulnerability 1032589 The D2CenterstageService.getComments service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors. 20150701 ESA-2015-108: EMC Documentum D2 Multiple DQL Injection Vulnerabilities 1032769 The D2DownloadService.getDownloadUrls service method in EMC Documentum D2 4.1 and 4.2 before 4.2 P16 and 4.5 before P03 allows remote authenticated users to conduct Documentum Query Language (DQL) injection attacks and bypass intended read-access restrictions via unspecified vectors. 20150701 ESA-2015-108: EMC Documentum D2 Multiple DQL Injection Vulnerabilities 1032769 Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. 20150623 ESA-2015-109: EMC Documentum D2 Cross-Site Scripting 1032693 Directory traversal vulnerability in EMC Documentum Thumbnail Server 6.7SP1 before P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P01 allows remote attackers to bypass intended Content Server access restrictions via unspecified vectors. 20150623 ESA-2015-110: EMC Documentum Thumbnail Server Directory Traversal Vulnerability 1032694 Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. 20150701 ESA-2015-111: EMC Documentum WebTop Client Products Multiple Vulnerabilities 1032770 Directory traversal vulnerability in the gcab_folder_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo." openSUSE-SU-2015:0043 [oss-security] 20150105 Re: CVE Request: gcab: directory traversal https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774580 https://bugzilla.gnome.org/show_bug.cgi?id=742331 Cross-site scripting (XSS) vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 SP3 allows remote attackers to inject arbitrary web script or HTML via the page_id parameter. http://packetstormsecurity.com/files/130008/CMS-Websitebaker-2.8.3-SP3-Cross-Site-Scripting.html 20150118 Reflecting XSS vulnerability in administrative backend of CMS Websitebaker v. 2.8.3 SP3 http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-03.html http://sroesemann.blogspot.de/2015/01/sroeadv-2015-03_4.html 72104 https://twitter.com/sroesemann/status/555397239229911040 The ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html. http://packetstormsecurity.com/files/129828/Pirelli-ADSL2-2-Wireless-Router-P.DGA4001N-Information-Disclosure.html 35721 Buffer overflow in the XnsSdkDeviceIpInstaller.ocx ActiveX control in Samsung iPOLiS Device Manager 1.12.2 allows remote attackers to execute arbitrary code via a long string in the first argument to the (1) ReadConfigValue or (2) WriteConfigValue function. http://packetstormsecurity.com/files/131421/Samsung-iPOLiS-1.12.2-ReadConfigValue-Remote-Code-Execution.html 20150221 Samsung iPolis XnsSdkDeviceIpInstaller.ocx ActiveX Remote Code Execution Vulnerabilities Open-source ARJ archiver 3.10.22 allows remote attackers to conduct directory traversal attacks via a symlink attack in an ARJ archive. FEDORA-2015-5603 FEDORA-2015-5546 FEDORA-2015-5524 DSA-3213 MDVSA-2015:201 [oss-security] 20150103 CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash [oss-security] 20150105 Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash 71860 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774434 GLSA-201612-15 Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive. FEDORA-2015-5603 FEDORA-2015-5546 FEDORA-2015-5524 DSA-3213 MDVSA-2015:201 [oss-security] 20150103 CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash [oss-security] 20150105 Re: CVE Request: arj: symlink directory traversal and directory traversal via //multiple/leading/slash 71895 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435 GLSA-201612-15 Multiple use-after-free vulnerabilities in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet, related to the use of packet-scope memory instead of pinfo-scope memory. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0113 http://www.wireshark.org/security/wnpa-sec-2015-01.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10720 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e843c6797db98bfceab382d5d7e76727e1014f5e The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not initialize certain data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. openSUSE-SU-2015:0113 http://www.wireshark.org/security/wnpa-sec-2015-01.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10806 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=a442a1c0e815fd61416cf408bd74d85a042ccc6a asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet. openSUSE-SU-2015:0113 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.wireshark.org/security/wnpa-sec-2015-02.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10773 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8e96830156bea314207b97315ccebd605317f142 Multiple use-after-free vulnerabilities in epan/dissectors/packet-dec-dnart.c in the DEC DNA Routing Protocol dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allow remote attackers to cause a denial of service (application crash) via a crafted packet, related to the use of packet-scope memory instead of pinfo-scope memory. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://advisories.mageia.org/MGASA-2015-0019.html openSUSE-SU-2015:0113 RHSA-2015:1460 DSA-3141 MDVSA-2015:022 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 71921 http://www.wireshark.org/security/wnpa-sec-2015-03.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10724 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=a559f2a050947f793c00159c0cd4d30f403f217c epan/dissectors/packet-smtp.c in the SMTP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 uses an incorrect length value for certain string-append operations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. http://advisories.mageia.org/MGASA-2015-0019.html openSUSE-SU-2015:0113 MDVSA-2015:022 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 71916 http://www.wireshark.org/security/wnpa-sec-2015-04.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10823 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=611cfd00c283e7a77a2f1fd89c01b0b9f691411b https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=854157883bd1972e012c65c0418a9732ef5d9fb0 Buffer underflow in the ssl_decrypt_record function in epan/dissectors/packet-ssl-utils.c in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet that is improperly handled during decryption of an SSL session. http://advisories.mageia.org/MGASA-2015-0019.html openSUSE-SU-2015:0113 RHSA-2015:1460 DSA-3141 MDVSA-2015:022 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 71922 http://www.wireshark.org/security/wnpa-sec-2015-05.html https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=d3581aecda62d2a51ea7088fd46975415b03ec57 Use-after-free vulnerability in the msm_set_crop function in drivers/media/video/msm/msm_camera.c in the MSM-Camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call. 92379 https://www.codeaurora.org/projects/security-advisories/multiple-issues-camera-drivers-cve-2014-9410-cve-2015-0568 Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that establishes a packet filter. http://source.android.com/security/bulletin/2016-05-01.html 77691 https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015 39308 Stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in wlan_hdd_hostapd.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that uses a long WPS IE element. http://source.android.com/security/bulletin/2016-05-01.html 77691 https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015 The WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify authorization for private SET IOCTL calls, which allows attackers to gain privileges via a crafted application, related to wlan_hdd_hostapd.c and wlan_hdd_wext.c. http://source.android.com/security/bulletin/2016-05-01.html 77691 https://www.codeaurora.org/projects/security-advisories/multiple-issues-wlan-driver-allow-local-privilege-escalation-cve-2015 Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (zero-value write) or possibly have unspecified other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl call. http://source.android.com/security/bulletin/2016-10-01.html 93312 https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=8fb32c3a8147b82e2bb159b3f70d803c9e68899b https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=34ad3d34fbff11b8e1210b9da0dac937fb956b61 https://www.codeaurora.org/race-condition-leading-arbitrary-null-write-adsp-using-ioctl-compatfastrpcioctlinvokefd-cve-2015 drivers/media/platform/msm/broadcast/tsc.c in the TSC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via a crafted application that makes a TSC_GET_CARD_STATUS ioctl call. https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=e20f20aaed6b6d2fd1667bad9be9ef35103a51df https://www.codeaurora.org/issues-tsc-tspp2-and-buspm-drivers-cve-2015-0573-cve-2016-2441-cve-2016-2442 In all Qualcomm products with Android releases from CAF using the Linux kernel, the validation of filesystem access was insufficient. 103671 https://source.android.com/security/bulletin/2017-07-01 https://source.android.com/security/bulletin/2018-04-01 In all Qualcomm products with Android releases from CAF using the Linux kernel, insecure ciphersuites were included in the default configuration. 99467 https://source.android.com/security/bulletin/2017-07-01 In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in HSDPA. 103671 https://source.android.com/security/bulletin/2017-04-01 https://source.android.com/security/bulletin/2017-07-01 https://source.android.com/security/bulletin/2018-04-01 Multiple cross-site scripting (XSS) vulnerabilities in the IronPort Spam Quarantine (ISQ) page in Cisco AsyncOS, as used on the Cisco Email Security Appliance (ESA) and Content Security Management Appliance (SMA), allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCus22925 and CSCup08113. 20150113 Cisco AsyncOS ISQ XSS Vulnerability 72056 1031544 cisco-asyncos-cve20150577-xss(100556) Cisco Adaptive Security Appliance (ASA) Software, when a DHCPv6 relay is configured, allows remote attackers to cause a denial of service (device reload) via crafted DHCP packets on the local network, aka Bug ID CSCur45455. 20150114 Cisco ASA DHCPv6 Relay DoS Vulnerability 72718 1031542 cisco-asa-cve20150578-dos(100549) 20150115 Cisco Adaptive Security Appliance DHCPv6 Relay Denial of Service Vulnerability Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway allow remote attackers to cause a denial of service (memory and CPU consumption, and partial outage) via crafted SIP packets, aka Bug ID CSCur12473. 20150113 Cisco TelePresence VCS and Expressway High CPU Utilization Vulnerability 72057 1031541 20150115 Cisco TelePresence VCS and Expressway High CPU Utilization Vulnerability Multiple SQL injection vulnerabilities in the ACS View reporting interface pages in Cisco Secure Access Control System (ACS) before 5.5 patch 7 allow remote authenticated administrators to execute arbitrary SQL commands via crafted HTTPS requests, aka Bug ID CSCuq79027. 20150211 Cisco Secure Access Control System SQL Injection Vulnerability 72576 1031740 cisco-acs-cve20150580-sql-injection(100812) The XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU and memory consumption) via an external entity declaration in conjunction with an entity reference, as demonstrated by reading private keys, related to an XML External Entity (XXE) issue, aka Bug ID CSCup92880. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> 20150128 Cisco Prime Service Catalog XML External Entity Processing Vulnerability 72350 1031658 The High Availability (HA) subsystem in Cisco NX-OS on MDS 9000 devices allows remote attackers to cause a denial of service via crafted traffic, aka Bug ID CSCuo09129. 20150109 Cisco MDS 9000 Series Denial of Service Vulnerability 71979 1031539 cisco-nxos-cve20150582-dos(99995) Cisco WebEx Meeting Center does not properly restrict the content of URLs, which allows remote attackers to obtain sensitive information via vectors related to file: URIs, aka Bug ID CSCus18281. 20150112 Cisco WebEx Meetings Server Information Disclosure Vulnerability 72012 cisco-webex-cve20150583-info-disc(100565) The image-upgrade implementation on Cisco Desktop Collaboration Experience (aka Collaboration Desk Experience or DX) DX650 endpoints allows local users to execute arbitrary OS commands via an unspecified parameter, aka Bug ID CSCus38947. 20150219 Cisco Collaboration Desk Experience Endpoints Command Injection Vulnerability 72696 The Network-Based Application Recognition (NBAR) protocol implementation in Cisco IOS 15.3(100)M and earlier on Cisco 2900 Integrated Services Router (aka Cisco Internet Router) devices allows remote attackers to cause a denial of service (NBAR process hang) via IPv4 packets, aka Bug ID CSCuo73682. 20150126 Cisco 2900 Series Integrated Services Router Network-Based Application Recognition Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37171 72309 1031659 cisco-2900series-cve20150586-dos(100660) Cross-site request forgery (CSRF) vulnerability in Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo77055. 20150115 Cisco Unified Communications Domain Manager Cross-Site Request Forgery Vulnerability 72082 1031559 cisco-ucdm-cve20150588-csrf(100657) The administrative web interface in Cisco WebEx Meetings Server 1.0 through 1.5 allows remote authenticated users to execute arbitrary OS commands with root privileges via unspecified fields, aka Bug ID CSCuj40460. 20150204 Cisco WebEx Meetings Server Command Injection Vulnerability 72493 1031692 cisco-webex-cve20150589-command-exec(100719) Cisco WebEx Meeting Center allows remote attackers to activate disabled meeting attributes, and consequently obtain sensitive information, by providing crafted parameters during a meeting-join action, aka Bug ID CSCuo34165. 20150115 Cisco Hosted WebEx Meeting Center Information Disclosure 1031558 cisco-webexmc-cve20150590-info-disc(100576) Cisco Unified Communications Domain Manager (UCDM) 10 allows remote attackers to cause a denial of service (daemon hang and GUI outage) via a flood of malformed TCP packets, aka Bug ID CSCur44177. 20150115 Cisco Unified Communications Domain Manager Admin GUI DoS Vulnerability 72084 1031561 cisco-ucdm-cve20150591-dos(100661) The Zone-Based Firewall implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers incorrect kernel-timer handling, aka Bug ID CSCuh25672. 20150209 Cisco IOS Software Kernel Timer Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37416 1031713 ciscoios-cve20150592-dos(100758) The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures, which allows remote attackers to cause a denial of service (device reload) via crafted network traffic, aka Bug ID CSCul65003. 20150209 Cisco IOS Software Zone-Based Firewall Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37417 72549 ciscoios-cve20150593-dos(100757) Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and CSCun18263. 20150226 Cisco Common Services Cross-Site Scripting Vulnerability 72793 1031813 1031814 The XMLAPI in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to obtain sensitive information by reading return messages from crafted GET requests, aka Bug ID CSCuj67079. 20150129 Cisco WebEx Meetings Server XMLAPI Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37238 72370 1031676 cisco-webex-cve20150595-info-disc(100667) Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj67163. 20150129 Cisco WebEx Meetings Server Cross-Site Request Forgery Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37239 72371 1031677 cisco-webex-cve20150596-csrf(100665) The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159. 20150129 Cisco WebEx Meetings Server User Enumeration Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37240 72373 1031678 cisco-webex-cve20150597-info-disc(100658) The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693. Per <a href="http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2015-0598">this link</a>, authentication is required. 20150305 Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability 1031842 The web interface in Cisco Integrated Management Controller in Cisco Unified Computing System (UCS) on C-Series Rack Servers does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuf50138. 20150202 Cisco UCS C-Series Rack Servers Integrated Management Controller Cross-Frame Scripting Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37324 72509 cisco-ucs-cve20150599-xfs(100614) The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to cause a denial of service (logoff) via crafted packets, aka Bug ID CSCuq12139. 20150203 Cisco Unified IP Phone 9900 Series Mobility Extension Availability Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37341 72481 cisco-ipphones-cve20150600-dos(100726) Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allow local users to cause a denial of service (device reload) via crafted commands, aka Bug ID CSCup92790. 20150203 Cisco Unified IP Phone 9900 Series Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37344 72483 cisco-unifiedipphone-cve20150601-dos(100617) The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to obtain sensitive information by sniffing the network, aka Bug ID CSCuq12117. 20150203 Cisco Unified IP Phone 9900 Series Data Disclosure Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37342 72482 cisco-unifiedipphone-cve20150602-info-disc(100615) Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier use weak permissions for unspecified files, which allows local users to cause a denial of service (persistent hang or reboot) by writing to a phone's filesystem, aka Bug ID CSCup90474. 20150203 Cisco Unified IP Phone 9900 Series Insecure Device Permissions Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37345 72484 cisco-unifiedipphone-cve20150603-dos(100619) The web framework on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to upload files to arbitrary locations on a phone's filesystem via crafted HTTP requests, aka Bug ID CSCup90424. 20150203 Cisco Unified IP Phone 9900 Series Arbitrary File Upload Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37346 72485 cisco-unifiedipphone-cve20150604-file-upload(100620) The uuencode inspection engine in Cisco AsyncOS on Cisco Email Security Appliance (ESA) devices 8.5 and earlier allows remote attackers to bypass intended content restrictions via a crafted e-mail attachment with uuencode encoding, aka Bug ID CSCzv54343. 20150206 Cisco AsyncOS Software Uuencoded Email Filtering Bypass Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37384 72528 cisco-asyncos-cve20150605-sec-bypass(100695) The IOS Shell in Cisco IOS allows local users to cause a denial of service (device crash) via unspecified commands, aka Bug ID CSCur59696. 20150210 Cisco IOS Shell Denial of Service Vulnerability 72550 1031717 ciscoios-cve20150606-dos(100810) The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connection attempt with a blank password, aka Bug IDs CSCuo09400 and CSCun16016. 20150226 Cisco IOS Software Authentication Proxy Bypass Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37711 72794 1031817 Race condition in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCul48736. 20150210 Cisco IOS Measurement, Aggregation, and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37421 72566 1031731 ciscoios-cve20150608-dos(100808) Race condition in the Common Classification Engine (CCE) in the Measurement, Aggregation, and Correlation Engine (MACE) implementation in Cisco IOS 15.4(2)T3 and earlier allows remote attackers to cause a denial of service (device reload) via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCuj96752. 20150210 Cisco IOS Measurement, Aggregation, and Correlation Engine Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37420 72564 1031731 ciscoios-cve20150609-dos(100809) Race condition in the object-group ACL feature in Cisco IOS 15.5(2)T and earlier allows remote attackers to bypass intended access restrictions via crafted network traffic that triggers improper handling of the timing of process switching and Cisco Express Forwarding (CEF) switching, aka Bug ID CSCun21071. 20150210 Cisco IOS Software Access Control List Bypass Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37423 72565 1031732 ciscoios-cve20150610-sec-bypass(100807) The administrative web-management portal in Cisco IX 8 (.0.1) and earlier on Cisco TelePresence IX5000 devices does not properly restrict the device-recovery account's access, which allows remote authenticated users to obtain HelpDesk-equivalent privileges by leveraging device-recovery authentication, aka Bug ID CSCus74174. 20150210 Cisco TelePresence IX5000 Series Web Management Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37430 72568 1031733 cisco-cve20150611-priv-esc(100806) The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU6, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (SIP outage) via a crafted UDP packet, aka Bug ID CSCuh25062. 20150401 Multiple Vulnerabilities in Cisco Unity Connection 1032010 The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) via crafted SIP INVITE messages, aka Bug ID CSCul20444. 20150401 Multiple Vulnerabilities in Cisco Unity Connection 1032010 The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) via crafted SIP INVITE messages, aka Bug ID CSCul26267. 20150401 Multiple Vulnerabilities in Cisco Unity Connection 1032010 The call-handling implementation in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, 9.x before 9.1(2)SU2, and 10.0 before 10.0(1)SU1, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (port consumption) by improperly terminating SIP sessions, aka Bug ID CSCul28089. 20150401 Multiple Vulnerabilities in Cisco Unity Connection 1032010 The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU7, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (core dump and restart) by improperly terminating SIP TCP connections, aka Bug ID CSCul69819. 20150401 Multiple Vulnerabilities in Cisco Unity Connection 1032010 Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices allow remote attackers to cause a denial of service (CPU consumption and SNMP outage) via malformed SNMP packets, aka Bug ID CSCur13393. 20150216 Cisco ASR 5000 System Architecture Evolution Gateway High CPU Utilization Vulnerability 1031754 cisco-asr-cve20150617-dos(100923) Cisco IOS XR 5.0.1 and 5.2.1 on Network Convergence System (NCS) 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X (CRS-X) devices allows remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers, aka Bug ID CSCuq95241. 20150220 Cisco IOS XR Software IPv6 Malformed Packet Denial of Service Vulnerability 72713 1031778 Memory leak in the embedded web server in the WebVPN subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to cause a denial of service (memory consumption and SSL outage) via multiple crafted HTTP requests, aka Bug ID CSCue05458. 20150211 Cisco Adaptive Security Appliance WebVPN Embedded Web Server Denial of Service Vulnerability 72579 1031745 cisco-asa-cve20150619-dos(100864) The XML parser in Cisco TelePresence Management Suite (TMS) 14.3(.2) and earlier does not properly handle external entities, which allows remote authenticated users to cause a denial of service via POST requests, aka Bug ID CSCus51494. 20150216 Cisco TelePresence Management Suite XML Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37491 1031753 cisco-telepresence-cve20150620-dos(100924) Cisco TelePresence MCU devices with software 4.5(1.45) allow remote attackers to cause a denial of service (device reload) via an unspecified series of TCP packets, aka Bug ID CSCur50347. 20150217 Cisco TelePresence Multipoint Control Unit Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37495 72635 1031756 cisco-telepresence-cve20150621-dos(100936) The Wireless Intrusion Detection (aka WIDS) functionality on Cisco Wireless LAN Controller (WLC) devices allows remote attackers to cause a denial of service (device outage) via crafted packets that are improperly handled during rendering of the Signature Events Summary page, aka Bug ID CSCus46861. 20150218 Cisco Wireless LAN Controller Denial of Service Vulnerability Cross-site scripting (XSS) vulnerability in the Administrator report page on Cisco Web Security Appliance (WSA) devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus40627. 20150218 Cisco Web Security Appliance Cross-Site Scripting Vulnerability The web framework in Cisco AsyncOS on Email Security Appliance (ESA), Content Security Management Appliance (SMA), and Web Security Appliance (WSA) devices allows remote attackers to trigger redirects via a crafted HTTP header, aka Bug IDs CSCur44412, CSCur44415, CSCur89630, CSCur89636, CSCur89633, and CSCur89639. http://packetstormsecurity.com/files/130525/Cisco-Ironport-AsyncOS-HTTP-Header-Injection.html 20150220 Cisco AsyncOS Software HTTP Redirect Vulnerability 72702 1031781 1031782 The SOAP interface in Cisco Hosted Collaboration Solution (HCS) allows remote attackers to obtain access to system-management tools via crafted Challenge SOAP calls, aka Bug ID CSCuc38114. 20150218 Cisco Hosted Collaboration Solution Unauthorized System Access Vulnerability The proxy engine on Cisco Web Security Appliance (WSA) devices allows remote attackers to bypass intended proxying restrictions via a malformed HTTP method, aka Bug ID CSCus79174. 20150219 Cisco Web Security Appliance HTTP Proxy Bypass Vulnerability Race condition in the SSL implementation on Cisco Intrusion Prevention System (IPS) devices allows remote attackers to cause a denial of service by making many management-interface HTTPS connections during the key-regeneration phase of an upgrade, aka Bug ID CSCui25688. 20150220 Cisco Intrusion Prevention System Key Regeneration HTTPS Denial of Service Vulnerability 72700 1031780 Race condition in the Neighbor Discovery (ND) protocol implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service via a flood of Router Solicitation messages on the local network, aka Bug ID CSCuo67770. 20150226 Vulnerability in IPv6 Neighbor Discovery in Cisco IOS and IOS-XE Software 72797 1031816 The Integrated Management Controller (IMC) in Cisco Unified Computing System (UCS) 1.4(7h) and earlier on C-Series servers allows remote attackers to bypass intended access restrictions by sending crafted DHCP response packets on the local network, aka Bug ID CSCuf52876. 20150224 Cisco UCS C-Series Integrated Management Controller Denial of Service Vulnerability http://tools.cisco.com/security/center/viewAlert.x?alertId=37575 72760 85711 1031796 Cross-site scripting (XSS) vulnerability in the administrative interface in Cisco WebEx Meetings Server 2.5 and 2.5.0.997 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuq86310. 20150513 Cisco WebEx Meetings Server Cross-Site Scripting Vulnerability 74647 1032329 The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to spoof Autonomic Networking Registration Authority (ANRA) responses, and consequently bypass intended device and node access restrictions or cause a denial of service (disrupted domain access), via crafted AN messages, aka Bug ID CSCup62191. 20150325 Multiple Vulnerabilities in Cisco IOS Software and IOS XE Software Autonomic Networking Infrastructure 1031982 The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (disrupted domain access) via spoofed AN messages that reset a finite state machine, aka Bug ID CSCup62293. 20150325 Multiple Vulnerabilities in Cisco IOS Software and IOS XE Software Autonomic Networking Infrastructure 1031982 The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) via spoofed AN messages, aka Bug ID CSCup62315. 20150325 Multiple Vulnerabilities in Cisco IOS Software and IOS XE Software Autonomic Networking Infrastructure 1031982 Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge) via crafted ICMPv4 packets, aka Bug ID CSCsi02145. 20150325 Cisco IOS Software Virtual Routing and Forwarding ICMP Queue Wedge Vulnerability 1031983 The Common Flow Table (CFT) feature in Cisco IOS XE 3.6 and 3.7 before 3.7.1S, 3.8 before 3.8.0S, 3.9 before 3.9.0S, 3.10 before 3.10.0S, 3.11 before 3.11.0S, 3.12 before 3.12.0S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S, when MMON or NBAR is enabled, allows remote attackers to cause a denial of service (device reload) via malformed IPv6 packets with IPv4 UDP encapsulation, aka Bug ID CSCua79665. 20150325 Multiple Vulnerabilities in Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers 1031981 The high-speed logging (HSL) feature in Cisco IOS XE 2.x and 3.x before 3.10.4S, 3.11 before 3.11.3S, 3.12 before 3.12.1S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to cause a denial of service (device reload) via large IP packets that require NAT and HSL processing after fragmentation, aka Bug ID CSCuo25741. 20150325 Multiple Vulnerabilities in Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers 1031981 Cisco IOS XE 2.x and 3.x before 3.9.0S, 3.10 before 3.10.0S, 3.11 before 3.11.0S, 3.12 before 3.12.0S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to cause a denial of service (device reload) via crafted IPv6 packets, aka Bug ID CSCub68073. 20150325 Multiple Vulnerabilities in Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers 1031981 Cisco IOS 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4 and IOS XE 2.5.x, 2.6.x, 3.1.xS through 3.12.xS before 3.12.3S, 3.2.xE through 3.7.xE before 3.7.1E, 3.3.xSG, 3.4.xSG, and 3.13.xS before 3.13.2S allow remote attackers to cause a denial of service (device reload) by sending malformed IKEv2 packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCum36951. 20150325 Cisco IOS Software and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerabilities http://tools.cisco.com/security/center/viewAlert.x?alertId=37816 73333 1031978 Cisco IOS 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4 and IOS XE 2.5.x, 2.6.x, 3.1.xS through 3.12.xS before 3.12.3S, 3.2.xE through 3.7.xE before 3.7.1E, 3.3.xSG, 3.4.xSG, and 3.13.xS before 3.13.2S allow remote attackers to cause a denial of service (memory consumption and device reload) by sending malformed IKEv2 packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCuo75572. 20150325 Cisco IOS Software and IOS XE Software Internet Key Exchange Version 2 Denial of Service Vulnerabilities http://tools.cisco.com/security/center/viewAlert.x?alertId=37815 73333 1031978 AppNav in Cisco IOS XE 3.8 through 3.10 before 3.10.3S, 3.11 before 3.11.3S, 3.12 before 3.12.1S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to execute arbitrary code or cause a denial of service (device reload) via a crafted TCP packet, aka Bug ID CSCuo53622. 20150325 Multiple Vulnerabilities in Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers 1031981 The Layer 4 Redirect (L4R) feature in Cisco IOS XE 2.x and 3.x before 3.10.4S, 3.11 before 3.11.3S, 3.12 before 3.12.2S, 3.13 before 3.13.1S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to cause a denial of service (device reload) via malformed (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCuq59131. 20150325 Multiple Vulnerabilities in Cisco IOS XE Software for Cisco ASR 1000 Series, Cisco ISR 4400 Series, and Cisco Cloud Services 1000v Series Routers 1031981 Memory leak in the TCP input module in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.3.xXO, 3.5.xE, 3.6.xE, 3.8.xS through 3.10.xS before 3.10.5S, and 3.11.xS and 3.12.xS before 3.12.3S allows remote attackers to cause a denial of service (memory consumption or device reload) by sending crafted TCP packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCum94811. 20150325 Cisco IOS Software and IOS XE Software TCP Packet Memory Leak Vulnerability 73340 1031980 Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) UDP packets, aka Bug ID CSCum98371. 20150325 Multiple Vulnerabilities in Cisco IOS Software Common Industrial Protocol Memory leak in Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (memory consumption) via crafted Common Industrial Protocol (CIP) TCP packets, aka Bug ID CSCun49658. 20150325 Multiple Vulnerabilities in Cisco IOS Software Common Industrial Protocol Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) TCP packets, aka Bug ID CSCun63514. 20150325 Multiple Vulnerabilities in Cisco IOS Software Common Industrial Protocol The Service Discovery Gateway (aka mDNS Gateway) in Cisco IOS 12.2, 12.4, 15.0, 15.1, 15.2, 15.3, and 15.4 and IOS XE 3.9.xS and 3.10.xS before 3.10.4S, 3.11.xS before 3.11.3S, 3.12.xS before 3.12.2S, and 3.13.xS before 3.13.1S allows remote attackers to cause a denial of service (device reload) by sending malformed mDNS UDP packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCup70579. 20150325 Cisco IOS Software and IOS XE Software mDNS Gateway Denial of Service Vulnerability 1031979 Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753. 20150226 Cisco ACE 4710 Application Control Engine and Application Neworking Manager Cross-Site Request Forgery Vulnerability 72796 1031815 The Session Description Protocol (SDP) implementation in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X8.2 and Cisco TelePresence Conductor before XC2.4 allows remote attackers to cause a denial of service (mishandled exception and device reload) via a crafted media description, aka Bug IDs CSCus96593 and CSCun73192. 20150311 Multiple Vulnerabilities in Cisco TelePresence Video Communication Server, Cisco Expressway, and Cisco TelePresence Conductor 1031910 The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login parameters, aka Bug IDs CSCur02680 and CSCur05556. 20150311 Multiple Vulnerabilities in Cisco TelePresence Video Communication Server, Cisco Expressway, and Cisco TelePresence Conductor 1031910 Race condition in the TLS implementation in MainApp in the management interface in Cisco Intrusion Prevention System (IPS) Software before 7.3(3)E4 allows remote attackers to cause a denial of service (process hang) by establishing many HTTPS sessions, aka Bug ID CSCuq40652. 20150311 Cisco Intrusion Prevention System MainApp Secure Socket Layer Denial of Service Vulnerability 1031908 Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184. 20150227 Cisco Unified Web Interaction Manager Cross-Site Scripting Vulnerability 72824 1031820 Cross-site scripting (XSS) vulnerability in the login page in Cisco Network Analysis Module (NAM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269. 20150303 Cisco Network Analysis Module Cross-Site Scripting Vulnerability 1031827 Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCur69192. 20150304 Cisco IOS XR Software Malformed RSVP Packet Denial of Service Vulnerability 1031841 The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589. 20150327 Cisco NX-OS Software DHCP Options Command Injection Vulnerability 1031992 The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS allows remote attackers to trigger self-referential adjacencies via a crafted Autonomic Networking (AN) message, aka Bug ID CSCup62157. 20150305 Cisco IOS Autonomic Networking Infrastructure Self-Referential Vulnerability 1031845 Cisco Virtual TelePresence Server Software does not properly restrict use of the serial port, which allows local users to execute arbitrary OS commands as root by leveraging vSphere controller administrative privileges, aka Bug ID CSCus61123. 20150312 Cisco Virtual TelePresence Server Serial Console Privileged Access 1031924 The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858. 20150305 Cisco IOS XR Software Malformed SNMP Packet Denial of Service Vulnerability 1031843 Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385. 20150314 Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability 1031933 Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier does not properly implement access control for IPC messages, which allows local users to write to arbitrary files via crafted messages, aka Bug ID CSCus79392. 20150314 Cisco AnyConnect Secure Mobility Client Arbitrary File Write Vulnerability 1031930 The IPC channel in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary userspace memory locations, and consequently gain privileges, via crafted messages, aka Bug ID CSCus79195. 20150314 Cisco AnyConnect Secure Mobility Client Arbitrary Code Execution Vulnerability 1031932 The Hostscan module in Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to write to arbitrary files via crafted IPC messages, aka Bug ID CSCus79173. 20150314 Cisco AnyConnect Secure Mobility Client Hostscan Path Traversal Vulnerability 1031931 Directory traversal vulnerability in the fmserver servlet in Cisco Prime Data Center Network Manager (DCNM) before 7.1(1) allows remote attackers to read arbitrary files via a crafted pathname, aka Bug ID CSCus00241. 20150401 Cisco Prime Data Center Network Manager File Information Disclosure Vulnerability 1032009 The Management Interface on Cisco Content Services Switch (CSS) 11500 devices 8.20.4.02 and earlier allows remote attackers to bypass intended restrictions on local-network device access via crafted SSH packets, aka Bug ID CSCut14855. 20150318 Cisco Content Services Switch (11500) Unauthenticated Port Forwarding Vulnerability 1031939 Cross-site scripting (XSS) vulnerability in the administration portal in Cisco WebEx Meetings Server 2.5 and 2.5.99.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq66737. 20150319 Cisco WebEx Meetings Server Administrative Portal Cross-Site Scripting Vulnerability 1031968 The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 15.4S and 15.4(3)S allows remote attackers to modify configuration settings or cause a denial of service (partial service outage) by sending crafted Autonomic Networking (AN) messages on an intranet network, aka Bug ID CSCup62167. 20150319 Cisco IOS Software Autonomic Networking Infrastructure Overwrite Vulnerability 1031967 The default configuration of Cisco Small Business IP phones SPA 300 7.5.5 and SPA 500 7.5.5 does not properly support authentication, which allows remote attackers to read audio-stream data or originate telephone calls via a crafted XML request, aka Bug ID CSCuo52482. 20150319 Cisco Small Business SPA300 and SPA500 Series IP Phones Unauthenticated Remote Dial Vulnerability 1031969 The DNS implementation in Cisco Videoscape Distribution Suite for Internet Streaming (VDS-IS) 3.2(1) allows remote attackers to cause a denial of service (CPU consumption and network-resource consumption) via crafted packets, aka Bug ID CSCun15911. 20150319 Cisco Videoscape Distribution Suite for Internet Streaming Denial of Service Vulnerability The DHCPv4 server in Cisco IOS XR 5.2.2 on ASR 9000 devices allows remote attackers to cause a denial of service (service outage) via a flood of crafted DHCP packets, aka Bug ID CSCup67822. 20150324 Cisco IOS XR Software DHCPv4 Server Denial of Service Vulnerability 1031970 Cisco Mobility Services Engine (MSE) 8.0(110.0) allows remote authenticated users to discover the passwords of arbitrary users by (1) reading log files or (2) using an unspecified GUI feature, aka Bug ID CSCut24792. 20150324 Cisco Mobility Service Engine Password Information Disclosure Vulnerability 1031971 Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. 20150326 Cisco Web Security Alert Service Cross-Site Scripting Vulnerability The failover ipsec implementation in Cisco Adaptive Security Appliance (ASA) Software 9.1 before 9.1(6), 9.2 before 9.2(3.3), and 9.3 before 9.3(3) does not properly validate failover communication messages, which allows remote attackers to reconfigure an ASA device, and consequently obtain administrative control, by sending crafted UDP packets over the local network to the failover interface, aka Bug ID CSCur21069. 20150408 Multiple Vulnerabilities in Cisco ASA Software 1032045 The DNS implementation in Cisco Adaptive Security Appliance (ASA) Software 7.2 before 7.2(5.16), 8.2 before 8.2(5.57), 8.3 before 8.3(2.44), 8.4 before 8.4(7.28), 8.5 before 8.5(1.24), 8.6 before 8.6(1.17), 8.7 before 8.7(1.16), 9.0 before 9.0(4.33), 9.1 before 9.1(6.1), 9.2 before 9.2(3.4), and 9.3 before 9.3(3) allows man-in-the-middle attackers to cause a denial of service (memory consumption or device outage) by triggering outbound DNS queries and then sending crafted responses to these queries, aka Bug ID CSCuq77655. 20150408 Multiple Vulnerabilities in Cisco ASA Software 1032045 The XML parser in Cisco Adaptive Security Appliance (ASA) Software 8.4 before 8.4(7.28), 8.6 before 8.6(1.17), 9.0 before 9.0(4.33), 9.1 before 9.1(6), 9.2 before 9.2(3.4), and 9.3 before 9.3(3), when Clientless SSL VPN, AnyConnect SSL VPN, or AnyConnect IKEv2 VPN is used, allows remote attackers to cause a denial of service (VPN outage or device reload) via a crafted XML document, aka Bug ID CSCus95290. 20150408 Multiple Vulnerabilities in Cisco ASA Software 1032045 The virtualization layer in Cisco ASA FirePOWER Software before 5.3.1.2 and 5.4.x before 5.4.0.1 and ASA Context-Aware (CX) Software before 9.3.2.1-9 allows remote attackers to cause a denial of service (device reload) by rapidly sending crafted packets to the management interface, aka Bug IDs CSCus11007 and CSCun56954. 20150408 Cisco ASA FirePOWER Services and Cisco ASA CX Services Crafted Packets Denial of Service Vulnerability 1032046 The web-authentication functionality on Cisco Wireless LAN Controller (WLC) devices 7.3(103.8) and 7.4(110.0) allows remote attackers to cause a denial of service (device reload) via a malformed password, aka Bug ID CSCui57980. 20150326 Cisco Wireless LAN Controller Task Name aaaQueueReader Denial of Service Vulnerability 1031990 Cisco Unified Call Manager (CM) 9.1(2.1000.28) does not properly restrict resource requests, which allows remote authenticated users to read arbitrary files via unspecified vectors, aka Bug ID CSCuq44439. 20150327 Cisco Unified Call Manager Arbitrary File Retrieval Vulnerability 1031991 The TFTP server in Cisco IOS 12.2(44)SQ1, 12.2(33)XN1, 12.4(25e)JAM1, 12.4(25e)JAO5m, 12.4(23)JY, 15.0(2)ED1, 15.0(2)EY3, 15.1(3)SVF4a, and 15.2(2)JB1 and IOS XE 2.5.x, 2.6.x, 3.1.xS, 3.2.xS, 3.3.xS, 3.4.xS, and 3.5.xS before 3.6.0S; 3.1.xSG, 3.2.xSG, and 3.3.xSG before 3.4.0SG; 3.2.xSE before 3.3.0SE; 3.2.xXO before 3.3.0XO; 3.2.xSQ; 3.3.xSQ; and 3.4.xSQ allows remote attackers to cause a denial of service (device hang or reload) via multiple requests that trigger improper memory management, aka Bug ID CSCts66733. 20150722 Cisco IOS Software TFTP Server Denial of Service Vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150722-tftp/cvrf/cisco-sa-20150722-tftp_cvrf.xml 1033023 Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute arbitrary code by visiting a "deprecated page," aka Bug ID CSCup90168. 20150331 Cisco Unified Communications Domain Manager Application Software Remote Code Execution Vulnerability 1032002 Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to obtain sensitive information via a file-inclusion attack, aka Bug ID CSCup94744. 20150331 Cisco Unified Communications Domain Manager Application Software Information Disclosure Vulnerability 1032003 SQL injection vulnerability in the Image Management component in Cisco Unified Communications Domain Manager 8.1(4) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuq52515. 20150331 Cisco Unified Communications Domain Manager Application Software SQL Injection Vulnerability 1032001 Cisco IOS XE before 3.7.5S on ASR 1000 devices does not properly handle route adjacencies, which allows remote attackers to cause a denial of service (device hang) via crafted IP packets, aka Bug ID CSCub31873. 20150331 Cisco ASR1000 Series Routers Incomplete or Glean Adjacencies Denial of Service Vulnerability 1032004 The SNMP implementation in Cisco NX-OS 6.1(2)I2(3) on Nexus 9000 devices, when a Reset High Availability (HA) policy is configured, allows remote authenticated users to cause a denial of service (device reload) via unspecified vectors, aka Bug ID CSCuq92240. 20150402 Cisco Nexus 9000 Series Denial of Service Vulnerability 1032021 The SNMP implementation in Cisco IOS 15.1(2)SG4 on Catalyst 4500 devices, when single-switch Virtual Switching System (VSS) is configured, allows remote authenticated users to cause a denial of service (device crash) by performing SNMP polling, aka Bug ID CSCuq04574. 20150402 Cisco Catalyst 4500 SNMP Polling Denial of Service Vulnerability 1032022 Cisco IOS XE 3.10.2S on an ASR 1000 device with an Embedded Services Processor (ESP) module, when NAT is enabled, allows remote attackers to cause a denial of service (module crash) via malformed H.323 packets, aka Bug ID CSCup21070. 20150403 Cisco ASR1000 Series Routers ESP Module Denial of Service Vulnerability 1032023 Cisco Cloud Web Security before 3.0.1.7 allows remote attackers to bypass intended filtering protection mechanisms by leveraging improper handling of HTTP methods, aka Bug ID CSCut69743. 20150406 Cisco Cloud Web Security Filtering Bypass Vulnerability Cross-site scripting (XSS) vulnerability in the HTML help system on Cisco Wireless LAN Controller (WLC) devices before 8.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCun95178. 20150406 Cisco Wireless LAN Controller HTML Help Cross-Site Scripting Vulnerability 1032024 A certain Cisco JAR file, as distributed in Cache Cleaner in Cisco Secure Desktop (CSD), allows remote attackers to execute arbitrary commands via a crafted web site, aka Bug ID CSCup83001. 20150415 Cisco Secure Desktop Cache Cleaner Command Execution Vulnerability 1032140 Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via crafted serialized objects, aka Bug ID CSCut39230. 20150410 Cisco Web Security Appliance Pickle Python Module Arbitrary Code Execution Vulnerability 1032097 Cisco Web Security Appliance (WSA) devices with software 8.5.0-ise-147 do not properly restrict use of the pickle Python module during certain tunnel-status checks, which allows local users to execute arbitrary Python code and gain privileges via a crafted pickle file, aka Bug ID CSCut39259. 20150413 Cisco Web Security Appliance Python File Processing Privilege Escalation Vulnerability 1032097 Cisco ASR 9000 devices with software 5.3.0.BASE do not recognize that certain ACL entries have a single-host constraint, which allows remote attackers to bypass intended network-resource access restrictions by using an address that was not supposed to have been allowed, aka Bug ID CSCur28806. 20150409 Cisco Aggregate Services Router 9000 ASR9K Security Bypass Vulnerability 1032059 Cisco IOS XR 4.3.4 through 5.3.0 on ASR 9000 devices, when uRPF, PBR, QoS, or an ACL is configured, does not properly handle bridge-group virtual interface (BVI) traffic, which allows remote attackers to cause a denial of service (chip and card hangs and reloads) by triggering use of a BVI interface for IPv4 packets, aka Bug ID CSCur62957. 20150415 Cisco IOS XR Software BVI Routed Packet Denial of Service Vulnerability 74162 1032139 Cross-site scripting (XSS) vulnerability in the login page in Cisco TC Software before 7.1.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq94977. 20150414 Cisco TelePresence Collaboration Desk and Room Endpoints Cross-Site Scripting Vulnerability 1032137 Open redirect vulnerability in the login page in Cisco TC Software before 6.3-26 and 7.x before 7.3.0 on Cisco TelePresence Collaboration Desk and Room Endpoints devices allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors, aka Bug ID CSCuq94980. 20150414 Cisco TelePresence Collaboration Desk and Room Endpoints HTML Redirect Vulnerability 1032136 Multiple cross-site scripting (XSS) vulnerabilities in filter search forms in admin web pages on Cisco Web Security Appliance (WSA) devices with software 8.5.0-497 allow remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut39213. 20150414 Cisco Web Security Appliance Cross-Site Scripting Vulnerability 1032135 SQL injection vulnerability in the Interactive Voice Response (IVR) component in Cisco Unified Communications Manager (UCM) 10.5(1.98991.13) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut21563. 20150414 Cisco Unified Communications Manager Interactive Voice Response Interface SQL Injection Vulnerability 1032134 Cross-site request forgery (CSRF) vulnerability in the Dashboard page in the monitoring-and-report section in Cisco Secure Access Control Server Solution Engine before 5.5(0.46.5) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuj62924. 20150416 Cisco Secure Access Control Server Dashboard Page Cross-Site Request Forgery Vulnerability 1032163 Cisco UCS Central Software before 1.3(1a) allows remote attackers to execute arbitrary commands via a crafted HTTP request, aka Bug ID CSCut46961. 20150506 Cisco UCS Central Software Arbitrary Command Execution Vulnerability 74491 1032267 Unrestricted file upload vulnerability in the Custom Prompts upload implementation in Cisco Unified MeetingPlace 8.6(1.9) allows remote authenticated users to execute arbitrary code by using the languageShortName parameter to upload a file that provides shell access, aka Bug ID CSCus95712. 20150420 Cisco Unified MeetingPlace Custom Prompts languageShortName Parameter Arbitrary Code Execution Vulnerability 1032165 Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857. 20150420 Cisco Unified MeetingPlace Administrative Web Interface Reflected Cross-Site Scripting Vulnerability 1032164 Multiple cross-site request forgery (CSRF) vulnerabilities in API features in Cisco Unified MeetingPlace 8.6(1.9) allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus95884. 20150421 Cisco Unified MeetingPlace Server Multiple State Changing URL API Functionalities Cross-Site Request Forgery Vulnerability 1032334 Cross-site request forgery (CSRF) vulnerability in the SOAP API endpoints of the web-services directory in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts, aka Bug ID CSCus97494. 20150421 Cisco Unified MeetingPlace Web Services Directory SOAP API Endpoints Cross-Site Request Forgery Vulnerability 74258 1032335 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667 Open redirect vulnerability in Cisco FireSIGHT System Software 5.3.1.1, 5.3.1.2, and 6.0.0 in FireSIGHT Management Center allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted HTTP header, aka Bug IDs CSCut06060, CSCut06056, and CSCus98966. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> 20150422 Cisco FireSIGHT Management Center Web Framework HTTP Header Redirection Vulnerability Cross-site scripting (XSS) vulnerability in Cisco FireSIGHT System Software 5.3.1.1 and 6.0.0 in FireSIGHT Management Center allows remote authenticated users to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCus85425. 20150422 Cisco FireSIGHT Management Center Web Framework Stored Cross-Site Scripting Vulnerability Cisco IOS 15.4S, 15.4SN, and 15.5S and IOS XE 3.13S and 3.14S allow remote attackers to cause a denial of service (device crash) by including an IA_NA option in a DHCPv6 Solicit message on the local network, aka Bug ID CSCur29956. 20150428 Cisco IOS Software and Cisco IOS XE Software Crafted DHCPv6 Sequence Denial of Service Vulnerability 1032210 Cisco IOS 15.5S and IOS XE allow remote authenticated users to cause a denial of service (device crash) by leveraging knowledge of the RADIUS secret and sending crafted RADIUS packets, aka Bug ID CSCur21348. 20150428 Cisco IOS Software and Cisco IOS XE Software Crafted RADIUS Packet Denial of Service Vulnerability 1032211 The Overlay Transport Virtualization (OTV) implementation in Cisco IOS XE 3.10S allows remote attackers to cause a denial of service (device reload) via a series of packets that are considered oversized and trigger improper fragmentation handling, aka Bug IDs CSCup37676 and CSCup30335. 20150428 Cisco IOS XE Software OTV Processing Code Denial of Service Vulnerability 1032212 The hamgr service in the IPv6 Proxy Mobile (PM) implementation in Cisco StarOS 18.1.0.59776 on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and call-processing outage) via malformed PM packets, aka Bug ID CSCut94711. 20150428 Cisco StarOS for Cisco ASR 5000 Series HAMGR Service Proxy Mobile IPv6 Processing Denial of Service Vulnerability 1032213 The session-manager service in Cisco StarOS 12.0, 12.2(300), 14.0, and 14.0(600) on ASR 5000 devices allows remote attackers to cause a denial of service (service reload and packet loss) via malformed HTTP packets, aka Bug ID CSCud14217. 20150429 Cisco StarOS for Cisco ASR 5000 Series HTTP Packet Processing Denial of Service Vulnerability 1032219 The web framework in Cisco TelePresence Advanced Media Gateway Series Software before 1.1(1.40), Cisco TelePresence IP Gateway Series Software, Cisco TelePresence IP VCR Series Software before 3.0(1.27), Cisco TelePresence ISDN Gateway Software before 2.2(1.94), Cisco TelePresence MCU Software before 4.4(3.54) and 4.5 before 4.5(1.45), Cisco TelePresence MSE Supervisor Software before 2.3(1.38), Cisco TelePresence Serial Gateway Series Software before 1.0(1.42), Cisco TelePresence Server Software for Hardware before 3.1(1.98), and Cisco TelePresence Server Software for Virtual Machine before 4.1(1.79) allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors, aka Bug IDs CSCul55968, CSCur08993, CSCur15803, CSCur15807, CSCur15825, CSCur15832, CSCur15842, CSCur15850, and CSCur15855. 20150513 Command Injection Vulnerability in Multiple Cisco TelePresence Products Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595. 20150501 Cisco Finesse Server Cross-Site Scripting Vulnerability 1032222 SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug IDs CSCut33447 and CSCut33608. 20150505 Cisco Unified Communications Manager SQL Injection Vulnerability 1032260 Cross-site request forgery (CSRF) vulnerability in the CUCReports page in Cisco Unity Connection 11.0(0.98000.225) and 11.0(0.98000.332) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut33659. 20150505 Cisco Unity Connection CUCReports Page Cross-Site Request Forgery Vulnerability 1032259 Cisco Unified Communications Manager 10.0(1.10000.12) allows local users to gain privileges via a command string in an unspecified parameter, aka Bug ID CSCut19546. 20150508 Cisco Unified Communications Manager root Shell Access Local Privilege Escalation Vulnerability 1032278 Cisco NX-OS 4.0 through 6.1 on Nexus 1000V 3000, 4000, 5000, 6000, and 7000 devices and Unified Computing System (UCS) platforms allows remote attackers to cause a denial of service (TCP stack reload) by sending crafted TCP packets to a device that has a TIME_WAIT TCP session, aka Bug ID CSCub70579. 20160302 Cisco NX-OS Software TCP Netstack Denial of Service Vulnerability 1035159 1035160 Cisco NX-OS 4.0 through 7.3 on Multilayer Director and Nexus 1000V, 2000, 3000, 3500, 4000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote authenticated users to bypass intended AAA restrictions and obtain privileged CLI access via crafted parameters in an SSH connection negotiation, aka Bug IDs CSCum35502, CSCuw78669, CSCuw79754, and CSCux88492. 20161005 Cisco NX-OS Software-Based Products Authentication, Authorization, and Accounting Bypass Vulnerability 93410 1036947 The network drivers in Cisco TelePresence T, Cisco TelePresence TE, and Cisco TelePresence TC before 7.3.2 allow remote attackers to cause a denial of service (process restart or device reload) via a flood of crafted IP packets, aka Bug ID CSCuj68952. 20150513 Multiple Vulnerabilities in Cisco TelePresence TC and TE Software The wireless web-authentication subsystem on Cisco Wireless LAN Controller (WLC) devices 7.5.x and 7.6.x before 7.6.120 allows remote attackers to cause a denial of service (process crash and device restart) via a crafted value, aka Bug ID CSCum03269. 20150508 Cisco Wireless LAN Controller Wireless Web Authentication Denial of Service Vulnerability 1032277 Multiple cross-site scripting (XSS) vulnerabilities in dncs 7.0.0.12 in Cisco Headend Digital Broadband Delivery System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCur25604. 20150512 Cisco Headend Digital Broadband Delivery System Cross-Site Scripting Vulnerability 1032304 Cisco Videoscape Distribution Suite Service Broker (aka VDS-SB), when a VDSM configuration on UCS is used, and Videoscape Distribution Suite for Internet Streaming (aka VDS-IS or CDS-IS) before 3.3.1 R7 and 4.x before 4.0.0 R4 allow remote attackers to cause a denial of service (device reload) via a crafted HTTP request, aka Bug IDs CSCus79834 and CSCuu63409. 20150715 Cisco Videoscape Delivery System Denial of Service Vulnerability 1032936 The web administration interface on Cisco Wireless LAN Controller (WLC) devices before 7.0.241, 7.1.x through 7.4.x before 7.4.122, and 7.5.x and 7.6.x before 7.6.120 allows remote authenticated users to cause a denial of service (device crash) via unspecified parameters, aka Bug IDs CSCum65159 and CSCum65252. 20150513 Cisco Wireless LAN Controller Web Administration Interface Authenticated Remote Denial of Service Vulnerability 74641 1032327 Cross-site scripting (XSS) vulnerability in the HTTP module in Cisco Security Manager (CSM) 4.7(0)SP1(1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789. 20150513 Cisco Security Manager Cross-Site Scripting Vulnerability 1032326 Cross-site scripting (XSS) vulnerability in Cisco Access Control Server (ACS) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu11002. 20150513 Cisco Access Control Server Cross-Site Scripting Vulnerability 1032328 Cross-site scripting (XSS) vulnerability in Cisco Secure Access Control Server Solution Engine (ACSE) 5.5(0.1) allows remote attackers to inject arbitrary web script or HTML via a file-inclusion attack, aka Bug ID CSCuu11005. 20150514 Cisco Access Control Server File Inclusion Vulnerability 1032338 The SMB module in Cisco Wide Area Application Services (WAAS) 6.0(1) allows remote attackers to cause a denial of service (module reload) via an invalid field in a Negotiate Protocol request, aka Bug ID CSCuo75645. 20150514 Cisco Wide Area Application Services Server Message Block Protocol Module Denial of Service Vulnerability 1032339 The ISDN implementation in Cisco IOS 15.3S allows remote attackers to cause a denial of service (device reload) via malformed Q931 SETUP messages, aka Bug ID CSCut37890. 20150514 Cisco IOS Voice Gateway Malformed ISDN Q931 Message Denial of Service Vulnerability 1032337 Cross-site scripting (XSS) vulnerability in Cisco AsyncOS on the Web Security Appliance (WSA) 9.0.0-193; Email Security Appliance (ESA) 8.5.6-113, 9.1.0-032, 9.1.1-000, and 9.6.0-000; and Content Security Management Appliance (SMA) 9.1.0-033 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug IDs CSCuu37430, CSCuu37420, CSCut71981, and CSCuv50167. 20150727 Cisco Email Security Appliance AsyncOS Cross-Site Scripting Vulnerability 1033086 1033087 CRLF injection vulnerability in the HTTP Header Handler in Digital Broadband Delivery System in Cisco Headend System Release allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks, via a crafted request, aka Bug ID CSCur25580. 20150529 Cisco Headend Digital Broadband Delivery System HTTP Response-Splitting Vulnerability 1032445 Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8.5.6-106 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCut87743. 20150514 Cisco Email Security Appliance Cross-Site Scripting Vulnerability 1032333 Cross-site request forgery (CSRF) vulnerability in Cisco Unified Customer Voice Portal (CVP) 10.5(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut93970. 20150515 Cisco Unified Customer Voice Portal Cross-Site Request Forgery Vulnerability 1032340 Cross-site request forgery (CSRF) vulnerability in Cisco MediaSense 10.5(1) and earlier allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu16728. 20150514 Cisco MediaSense Cross-Site Request Forgery Vulnerability 1032336 Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.1 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) GET or (2) POST parameter, aka Bug ID CSCuu11099. 20150608 Cisco FireSIGHT Management Center Cross-Site Scripting Vulnerability 1032518 Cross-site scripting (XSS) vulnerability in the Web Tracking Report page on Cisco Web Security Appliance (WSA) devices 8.5.0-497 allows remote attackers to inject arbitrary web script or HTML via an unspecified field, aka Bug ID CSCuu16008. 20150515 Cisco Web Security Appliance Web Tracking Report Page Cross-Site Scripting Vulnerability 1032349 The Lights-Out Management (LOM) implementation in Cisco FireSIGHT System Software 5.3.0 on Sourcefire 3D Sensor devices allows remote authenticated users to perform arbitrary Baseboard Management Controller (BMC) file uploads via unspecified vectors, aka Bug ID CSCus87938. 20150518 Cisco Sourcefire 3D System Lights-Out Management Arbitrary File Upload Vulnerability 74709 1032359 Cross-site request forgery (CSRF) vulnerability in Cisco Unified Intelligence Center 10.6(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCus28826. 20150519 Cisco Unified Intelligence Center Cross-Site Request Forgery Vulnerability 74732 1032367 Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596. 20150520 Cisco Prime Central for HCS Multiple Cross-Site Request Forgery Vulnerabilities 74754 1032380 The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registration, which allows remote attackers to cause a denial of service (forwarding outage) via a crafted multicast packet, aka Bug ID CSCus74398. 20150520 Cisco Adaptive Security Appliance Protocol Independent Multicast Registration Vulnerability 74750 1032381 Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097. 20150529 Cisco Headend System Release UDP TFTP and DHCP Denial of Service Vulnerability 1032445 Cisco DTA Control System (DTACS) 4.0.0.9 and Cisco Headend System Release allow remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCus50642, CSCus50662, CSCus50625, CSCus50657, and CSCus68315. 20150529 Multiple Cisco Products TCP Flood Denial of Service Vulnerability 74916 1032445 Cisco Headend System Release allows remote attackers to read temporary script files or archive files, and consequently obtain sensitive information, via a crafted header in an HTTP request, aka Bug ID CSCus44909. 20150529 Cisco Headend System Release Archive File Download Vulnerability 1032445 The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022. 20150521 Cisco Access Control Server Representational State Transfer Application Programming Interface Denial of Service Vulnerability 1032387 Cisco Conductor for Videoscape 3.0 and Cisco Headend System Release allow remote attackers to inject arbitrary cookies via a crafted HTTP request, aka Bug ID CSCuh25408. 20150529 Cisco Conductor for Videoscape and Cisco Headend System Release HTTP Injection Vulnerability 1032447 The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786. 20150522 Cisco HCS Administrative Web Interface Arbitrary Command Execution Vulnerability Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800. 20150526 Cisco IP Phone 7861 Denial of Service Vulnerability 1032407 Cross-site scripting (XSS) vulnerability in Cisco TelePresence Video Communication Server (VCS) X8.5.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27635. 20150527 Cisco Telepresence Video Communication Server Cross-Site Scripting Vulnerability 1032421 SQL injection vulnerability in Cisco Unified Email Interaction Manager (EIM) and Unified Web Interaction Manager (WIM) 9.0(2) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu30028. 20150527 Cisco Unified Email Interaction Manager and Cisco Unified Web Interaction Manager SQL Injection Vulnerability 1032422 Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document, aka Bug ID CSCut95810. 20150527 Cisco Finesse XML Processing Denial of Service Vulnerability 1032423 The Posture module for Cisco Identity Services Engine (ISE), as distributed in Cisco AnyConnect Secure Mobility Client 4.0(64), allows local users to gain privileges via unspecified commands, aka Bug ID CSCut05797. 20150527 Cisco Identity Services Engine Privilege Escalation Vulnerability 1032424 Cisco Wireless LAN Controller (WLC) devices with software 7.4(1.1) allow remote attackers to cause a denial of service (wireless-networking outage) via crafted TCP traffic on the local network, aka Bug ID CSCug67104. 20150527 Cisco Wireless LAN Controller TCP Denial of Service Vulnerability 1032419 The web framework in Cisco Identity Services Engine (ISE) 1.2(1.901) and 1.3(0.722) does not properly implement session handlers, which allows remote attackers to obtain sensitive information by reading web pages, as demonstrated by MnT reports, aka Bug ID CSCuq23140. 20150527 Cisco Identity Services Engine Information Disclosure Vulnerability 74864 1032420 The web-based user interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCus97452. 20150529 Cisco Unified MeetingPlace XML Processing Information Disclosure Vulnerability 1032448 Cross-site request forgery (CSRF) vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the authentication of arbitrary users. 20150601 Cisco Headend Digital Broadband Delivery System Cross-Site Request Forgery Vulnerability 1032446 The IKEv1 implementation in Cisco ASA Software 7.x, 8.0.x, 8.1.x, and 8.2.x before 8.2.2.13 allows remote authenticated users to bypass XAUTH authentication via crafted IKEv1 packets, aka Bug ID CSCus47259. 20150602 Cisco Adaptive Security Appliance XAUTH Bypass Vulnerability 1032473 Cisco AnyConnect Secure Mobility Client before 3.1(8009) and 4.x before 4.0(2052) on Linux does not properly implement unspecified internal functions, which allows local users to obtain root privileges via crafted vpnagent options, aka Bug ID CSCus86790. 20150602 Cisco AnyConnect Secure Mobility Client Privilege Escalation Vulnerability 74954 1032472 Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) for Microsoft Outlook allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCuu51400. 20150602 Cisco Unified MeetingPlace Microsoft Outlook Reflected Cross-Site Scripting Vulnerability 1032470 Cisco Unified MeetingPlace 8.6(1.2) does not properly validate session IDs in http URLs, which allows remote attackers to obtain sensitive session information via a crafted URL, aka Bug ID CSCuu60338. 20150602 Cisco Unified MeetingPlace Session ID Information Disclosure Vulnerability 1032471 Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to read arbitrary files via a crafted resource request, aka Bug ID CSCus95603. 20150603 Cisco Unified MeetingPlace Arbitrary File Download Vulnerability 1032481 Cisco ONS 15454 System Software 10.30 and 10.301 allows remote attackers to cause a denial of service (tNetTask CPU consumption or card reset) via a flood of (1) IP or (2) Ethernet traffic, aka Bug ID CSCus57263. 20150603 Cisco ONS 15454 System Software Denial of Service Vulnerability 1032483 Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in the Management Center component in Cisco FireSIGHT System Software 6.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug IDs CSCus93566, CSCut31557, and CSCut47196. 20150603 Cisco FireSIGHT Management Center XSS and HTML Injection Vulnerabilities 1032482 Cisco Edge 300 software 1.0 and 1.1 on Edge 340 devices allows local users to obtain root privileges via unspecified commands, aka Bug ID CSCur18132. 20150605 Cisco Edge 340 Privilege Escalation Vulnerability The Device Work Center (DWC) component in Cisco Prime Network Control System (NCS) 2.1(0.0.85), 2.2(0.0.58), and 2.2(0.0.69) does not properly implement AAA roles, which allows remote authenticated users to bypass intended access restrictions and execute commands via a login session, aka Bug ID CSCur27371. 20150609 Cisco Prime Network Control System Unauthorized Configuration Vulnerability 1032541 Cisco IOS XR 4.0.1 through 4.2.0 for CRS-3 Carrier Routing System allows remote attackers to cause a denial of service (NPU ASIC scan and line-card reload) via crafted IPv6 extension headers, aka Bug ID CSCtx03546. 20150611 Cisco IOS XR Software Crafted IPv6 Packet Denial of Service Vulnerability 1032563 CRLF injection vulnerability in Cisco TelePresence TC 6.x before 6.3.4 and 7.x before 7.3.3 on Integrator C SX20 devices allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL, aka Bug ID CSCut79341. 20150605 Cisco TelePresence SX20 HTTP Response Splitting Vulnerability 1032511 The IKE implementation in the WS-IPSEC-3 service module in Cisco IOS 12.2 on Catalyst 6500 devices allows remote authenticated users to cause a denial of service (device reload) by sending a crafted message during IPsec tunnel setup, aka Bug ID CSCur70505. 20150608 Cisco Catalyst 6500 Series Switches IPsec Tunnel Handling Denial of Service Vulnerability 1032517 Cisco TelePresence Video Communication Server (VCS) X8.5RC4 allows remote attackers to cause a denial of service (CPU consumption or device outage) via a crafted SDP parameter-negotiation request in an SDP session during a SIP connection, aka Bug ID CSCut42422. 20150609 Cisco TelePresence Video Communication Server SDP Over SIP Denial of Service Vulnerability 1032540 Cisco FireSIGHT System Software 5.3.1.3 and 6.0.0 allows remote authenticated users to delete an arbitrary user's dashboard via a modified VPN deletion request in a management session, aka Bug ID CSCut67078. 20150609 Cisco FireSIGHT Management Center Dashboard Deletion Vulnerability 1032542 Cross-site scripting (XSS) vulnerability in Cisco Application and Content Networking System (ACNS) 5.5(9) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCuu70650. 20150609 Cisco Application and Content Networking System URL Page Return Cross-Site Scripting Vulnerability 1032539 The banner (aka MOTD) implementation in Cisco NX-OS 4.1(2)E1(1f) on Nexus 4000 devices, 5.2(1)SV3(2.1) on Nexus 1000V devices, 6.0(2)N2(2) on Nexus 5000 devices, 6.2(11) on MDS 9000 devices, 6.2(12) on Nexus 7000 devices, 7.0(3) on Nexus 9000 devices, and 7.2(0)ZN(99.67) on Nexus 3000 devices allows remote attackers to cause a denial of service (login process reset) via an unspecified terminal-session request during TELNET session setup, aka Bug IDs CSCuo10554, CSCuu75466, CSCuu75471, CSCuu75484, CSCuu75498, CSCuu77170, and CSCuu77182. 20150610 Cisco Nexus and Cisco Multilayer Director Switches MOTD Telnet Login Reset Vulnerability 1032561 1032562 telnetd in Cisco IOS XR 5.0.1 on Network Convergence System 6000 devices allows remote attackers to cause a denial of service (device reload) via a malformed TELNET packet, aka Bug ID CSCuq31566. 20150610 Cisco IOS XR telnetd Packet Processing Denial of Service Vulnerability 1032560 drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux distributions, allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory via unspecified vectors. SUSE-SU-2015:0658 SUSE-SU-2015:1478 SUSE-SU-2015:1592 SUSE-SU-2015:1611 73921 https://bugzilla.novell.com/show_bug.cgi?id=917830 osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file. FEDORA-2015-4549 FEDORA-2015-4482 FEDORA-2015-4687 openSUSE-SU-2015:0486 SUSE-SU-2015:0487 73114 https://bugzilla.suse.com/show_bug.cgi?id=901643 GLSA-201603-02 Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323 and CVE-2010-5324. 20150407 [CVE-2015-0779]: Novell ZenWorks Configuration Management remote code execution https://github.com/rapid7/metasploit-framework/pull/5096 https://raw.githubusercontent.com/pedrib/PoC/master/generic/zenworks_zcm_rce.txt 36964 https://www.novell.com/support/kb/doc.php?id=7016419 SQL injection vulnerability in the GetReRequestData method of the GetStoredResult class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors. 74284 1032166 http://www.zerodayinitiative.com/advisories/ZDI-15-147 https://www.novell.com/support/kb/doc.php?id=7016431 Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload and execute arbitrary files via unspecified vectors. 74291 http://www.zerodayinitiative.com/advisories/ZDI-15-151 https://www.novell.com/support/kb/doc.php?id=7016431 SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors. 72808 http://www.zerodayinitiative.com/advisories/ZDI-15-148 https://www.novell.com/support/kb/doc.php?id=7016431 The FileViewer class in Novell ZENworks Configuration Management (ZCM) allows remote authenticated users to read arbitrary files via the filename variable. 1032166 http://www.zerodayinitiative.com/advisories/ZDI-15-150 https://www.novell.com/support/kb/doc.php?id=7016431 Rtrlet.class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable. 74289 1032166 http://www.zerodayinitiative.com/advisories/ZDI-15-149 https://www.novell.com/support/kb/doc.php?id=7016431 com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders via the dirname variable. 74288 http://www.zerodayinitiative.com/advisories/ZDI-15-152 https://www.novell.com/support/kb/doc.php?id=7016431 Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary code via unspecified vectors. 74290 1032166 http://www.zerodayinitiative.com/advisories/ZDI-15-153 https://www.novell.com/support/kb/doc.php?id=7016431 XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI. 93972 https://download.novell.com/Download?buildid=QgHXVOxv310~ ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_uuid.map. [opensuse-bugs] 20150619 [Bug 935338] dracut uses hardcoded /tmp/dracut_block_uuid.map filename - symlink attack [opensuse-bugs] 20150619 [Bug 935338] VUL-0: CVE-2015-0794: dracut: uses hardcoded /tmp/dracut_block_uuid.map filename - symlink attack openSUSE-SU-2015:2022 Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699. http://www.zerodayinitiative.com/advisories/ZDI-15-340/ https://www.netiq.com/support/kb/doc.php?id=7016656 In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service. https://bugzilla.suse.com/show_bug.cgi?id=941099 https://github.com/openSUSE/open-build-service/commit/474a3db19498765f0118ba3dbc0b1cc90b0097fc GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file. SUSE-SU-2015:0921 SUSE-SU-2015:0978 RHSA-2015:0988 RHSA-2015:1012 DSA-3225 DSA-3260 DSA-3264 http://www.mozilla.org/security/announce/2015/mfsa2015-47.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html https://bugzilla.mozilla.org/show_bug.cgi?id=1080995 GLSA-201512-07 https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7 The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy. http://www.mozilla.org/security/announce/2015/mfsa2015-43.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1032029 https://bugzilla.mozilla.org/show_bug.cgi?id=1147597 GLSA-201512-10 The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows man-in-the-middle attackers to bypass an intended X.509 certificate-verification step for an SSL server by specifying that server in the uri-host field of an Alt-Svc HTTP/2 response header. openSUSE-SU-2015:0677 http://www.mozilla.org/security/announce/2015/mfsa2015-44.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1032030 USN-2557-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1148328 GLSA-201512-10 The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2012-2808. http://www.mozilla.org/security/announce/2015/mfsa2015-41.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 https://bugzilla.mozilla.org/show_bug.cgi?id=1110212 Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818. openSUSE-SU-2015:0677 SUSE-SU-2015:0704 openSUSE-SU-2015:0892 openSUSE-SU-2015:1266 RHSA-2015:0766 RHSA-2015:0771 DSA-3211 DSA-3212 http://www.mozilla.org/security/announce/2015/mfsa2015-40.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 73455 1031996 1032000 USN-2550-1 USN-2552-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1146339 GLSA-201512-10 Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods. openSUSE-SU-2015:0677 http://www.mozilla.org/security/announce/2015/mfsa2015-42.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 USN-2550-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1124898 GLSA-201512-10 37958 The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document. openSUSE-SU-2015:0677 http://www.mozilla.org/security/announce/2015/mfsa2015-39.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 USN-2550-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1134561 GLSA-201512-10 The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element. openSUSE-SU-2015:0677 http://www.mozilla.org/security/announce/2015/mfsa2015-39.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 USN-2550-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1134560 GLSA-201512-10 The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content. openSUSE-SU-2015:0677 http://www.mozilla.org/security/announce/2015/mfsa2015-38.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 USN-2550-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1135511 GLSA-201512-10 The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content. openSUSE-SU-2015:0677 http://www.mozilla.org/security/announce/2015/mfsa2015-38.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 USN-2550-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1099437 GLSA-201512-10 The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638. openSUSE-SU-2015:0677 SUSE-SU-2015:0704 openSUSE-SU-2015:0892 openSUSE-SU-2015:1266 RHSA-2015:0766 RHSA-2015:0771 DSA-3211 DSA-3212 http://www.mozilla.org/security/announce/2015/mfsa2015-37.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 73457 1031996 1032000 USN-2550-1 USN-2552-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1111834 GLSA-201512-10 The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays, which might allow remote attackers to cause a denial of service (memory corruption) via unspecified vectors. openSUSE-SU-2015:0677 http://www.mozilla.org/security/announce/2015/mfsa2015-36.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 USN-2550-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1109552 GLSA-201512-10 Mozilla Firefox before 37.0 on OS X does not ensure that the cursor is visible, which allows remote attackers to conduct clickjacking attacks via a Flash object in conjunction with DIV elements associated with layered presentation, and crafted JavaScript code that interacts with an IMG element. http://www.mozilla.org/security/announce/2015/mfsa2015-35.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 https://bugzilla.mozilla.org/show_bug.cgi?id=1125013 GLSA-201512-10 The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation. openSUSE-SU-2015:0677 http://www.mozilla.org/security/announce/2015/mfsa2015-34.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 USN-2550-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1132468 GLSA-201512-10 Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain. openSUSE-SU-2015:0677 http://www.mozilla.org/security/announce/2015/mfsa2015-32.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 USN-2550-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1128126 GLSA-201512-10 Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted MP3 file. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0677 SUSE-SU-2015:0704 openSUSE-SU-2015:0892 openSUSE-SU-2015:1266 RHSA-2015:0766 RHSA-2015:0771 DSA-3211 DSA-3212 http://www.mozilla.org/security/announce/2015/mfsa2015-31.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 73463 1031996 1032000 USN-2550-1 USN-2552-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1106596 GLSA-201512-10 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. openSUSE-SU-2015:0677 SUSE-SU-2015:0704 http://www.mozilla.org/security/announce/2015/mfsa2015-30.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 1031996 1032000 USN-2550-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1005991 https://bugzilla.mozilla.org/show_bug.cgi?id=1111327 https://bugzilla.mozilla.org/show_bug.cgi?id=1116306 https://bugzilla.mozilla.org/show_bug.cgi?id=1127012 https://bugzilla.mozilla.org/show_bug.cgi?id=1130150 https://bugzilla.mozilla.org/show_bug.cgi?id=1132342 https://bugzilla.mozilla.org/show_bug.cgi?id=1133909 https://bugzilla.mozilla.org/show_bug.cgi?id=1136397 https://bugzilla.mozilla.org/show_bug.cgi?id=1137624 https://bugzilla.mozilla.org/show_bug.cgi?id=1138391 GLSA-201512-10 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. openSUSE-SU-2015:0677 SUSE-SU-2015:0704 openSUSE-SU-2015:0892 openSUSE-SU-2015:1266 RHSA-2015:0766 RHSA-2015:0771 DSA-3211 DSA-3212 http://www.mozilla.org/security/announce/2015/mfsa2015-30.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 73466 1031996 1032000 USN-2550-1 USN-2552-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1036515 https://bugzilla.mozilla.org/show_bug.cgi?id=1137326 https://bugzilla.mozilla.org/show_bug.cgi?id=1138199 GLSA-201512-10 Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js. openSUSE-SU-2015:0677 SUSE-SU-2015:0704 openSUSE-SU-2015:0892 openSUSE-SU-2015:1266 RHSA-2015:0766 RHSA-2015:0771 DSA-3211 DSA-3212 http://www.mozilla.org/security/announce/2015/mfsa2015-33.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 73461 1031996 1032000 USN-2550-1 USN-2552-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1144991 GLSA-201512-10 37958 The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR 31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine the cases in which bounds checking may be safely skipped during JIT compilation and heap access, which allows remote attackers to read or write to unintended memory locations, and consequently execute arbitrary code, via crafted JavaScript. openSUSE-SU-2015:0567 SUSE-SU-2015:0593 SUSE-SU-2015:0630 openSUSE-SU-2015:0636 RHSA-2015:0718 DSA-3201 http://www.mozilla.org/security/announce/2015/mfsa2015-29.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 73263 1031958 USN-2538-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1145255 GLSA-201504-01 Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving SVG hash navigation. openSUSE-SU-2015:0567 SUSE-SU-2015:0593 SUSE-SU-2015:0630 openSUSE-SU-2015:0636 RHSA-2015:0718 DSA-3201 http://www.mozilla.org/security/announce/2015/mfsa2015-28.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 73265 1031959 USN-2538-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1144988 GLSA-201504-01 The UITour::onPageEvent function in Mozilla Firefox before 36.0 does not ensure that an API call originates from a foreground tab, which allows remote attackers to conduct spoofing and clickjacking attacks by leveraging access to a UI Tour web site. openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-26.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72759 1031791 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1079554 GLSA-201504-01 Mozilla Firefox before 36.0 does not properly restrict transitions of JavaScript objects from a non-extensible state to an extensible state, which allows remote attackers to bypass a Caja Compiler sandbox protection mechanism or a Secure EcmaScript sandbox protection mechanism via a crafted web site. openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-27.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72757 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1125389 GLSA-201504-01 Mozilla Firefox before 36.0 allows user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions. openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-25.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72758 1031791 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1111960 GLSA-201504-01 The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to read arbitrary files via crafted JavaScript code. openSUSE-SU-2015:0404 SUSE-SU-2015:0412 SUSE-SU-2015:0446 SUSE-SU-2015:0447 openSUSE-SU-2015:0448 openSUSE-SU-2015:0567 openSUSE-SU-2015:1266 openSUSE-SU-2015:0570 RHSA-2015:0265 RHSA-2015:0266 RHSA-2015:0642 DSA-3174 DSA-3179 http://www.mozilla.org/security/announce/2015/mfsa2015-24.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 72756 1031791 1031792 USN-2505-1 USN-2506-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1110557 GLSA-201504-01 Multiple use-after-free vulnerabilities in OpenType Sanitiser, as used in Mozilla Firefox before 36.0, might allow remote attackers to trigger problematic Developer Console information or possibly have unspecified other impact by leveraging incorrect macro expansion, related to the ots::ots_gasp_parse function. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-23.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72754 1031791 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1098497 https://github.com/khaledhosny/ots/commit/003c62d28ae438aa8943cb31535563397f838a2c GLSA-201504-01 The mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 36.0 allows remote attackers to cause a denial of service (out-of-bounds write of zero values, and application crash) via vectors that trigger use of DrawTarget and the Cairo library for image drawing. openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-22.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72753 1031791 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1095925 GLSA-201504-01 Stack-based buffer underflow in the mozilla::MP3FrameParser::ParseBuffer function in Mozilla Firefox before 36.0 allows remote attackers to obtain sensitive information from process memory via a malformed MP3 file that improperly interacts with memory allocation during playback. openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-21.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72751 1031791 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1092370 GLSA-201504-01 The nsTransformedTextRun::SetCapitalization function in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read of heap memory) via a crafted Cascading Style Sheets (CSS) token sequence that triggers a restyle or reflow operation. openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-20.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72750 1031791 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1092363 GLSA-201504-01 Heap-based buffer overflow in the mozilla::gfx::CopyRect function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to obtain sensitive information from uninitialized process memory via a malformed SVG graphic. openSUSE-SU-2015:0404 SUSE-SU-2015:0412 SUSE-SU-2015:0446 SUSE-SU-2015:0447 openSUSE-SU-2015:0448 openSUSE-SU-2015:0567 openSUSE-SU-2015:1266 openSUSE-SU-2015:0570 RHSA-2015:0265 RHSA-2015:0266 RHSA-2015:0642 DSA-3174 DSA-3179 http://www.mozilla.org/security/announce/2015/mfsa2015-19.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 72755 1031791 1031792 USN-2505-1 USN-2506-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1117304 GLSA-201504-01 Double free vulnerability in the nsXMLHttpRequest::GetResponse function in Mozilla Firefox before 36.0, when a nonstandard memory allocator is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted JavaScript code that makes an XMLHttpRequest call with zero bytes of data. <a href="http://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free</a> openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-18.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72744 1031791 https://bugzilla.mozilla.org/show_bug.cgi?id=1030667 https://bugzilla.mozilla.org/show_bug.cgi?id=988675 GLSA-201504-01 Buffer overflow in libstagefright in Mozilla Firefox before 36.0 allows remote attackers to execute arbitrary code via a crafted MP4 video that is improperly handled during playback. openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-17.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72741 1031791 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1128939 GLSA-201504-01 The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copying an unspecified string to a shader's compilation log, which allows remote attackers to cause a denial of service (application crash) via crafted WebGL content. openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-14.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72745 1031791 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1110488 GLSA-201504-01 Use-after-free vulnerability in the mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted content that is improperly handled during IndexedDB index creation. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0404 SUSE-SU-2015:0412 SUSE-SU-2015:0446 SUSE-SU-2015:0447 openSUSE-SU-2015:0448 openSUSE-SU-2015:0567 openSUSE-SU-2015:1266 openSUSE-SU-2015:0570 RHSA-2015:0265 RHSA-2015:0266 RHSA-2015:0642 DSA-3174 DSA-3179 http://www.mozilla.org/security/announce/2015/mfsa2015-16.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 72746 1031791 1031792 USN-2505-1 USN-2506-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1130541 GLSA-201504-01 Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . (dot) character, which allows man-in-the-middle attackers to bypass the HPKP and HSTS protection mechanisms by constructing a URL with this character and leveraging access to an X.509 certificate for a domain with this character. openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-13.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72752 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1065909 GLSA-201504-01 Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the Maintenance Service is not used, allow local users to gain privileges via a Trojan horse DLL in (1) the current working directory or (2) a temporary directory, as demonstrated by bcrypt.dll. <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> openSUSE-SU-2015:0567 openSUSE-SU-2015:1266 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-12.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72747 1031791 1031792 https://bugzilla.mozilla.org/show_bug.cgi?id=945192 GLSA-201504-01 The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window. openSUSE-SU-2015:0404 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-15.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72743 1031791 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1098314 GLSA-201504-01 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. openSUSE-SU-2015:0404 SUSE-SU-2015:0412 SUSE-SU-2015:0446 SUSE-SU-2015:0447 openSUSE-SU-2015:0570 http://www.mozilla.org/security/announce/2015/mfsa2015-11.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 72748 1031791 1031792 USN-2505-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1072760 https://bugzilla.mozilla.org/show_bug.cgi?id=1092947 https://bugzilla.mozilla.org/show_bug.cgi?id=1114058 https://bugzilla.mozilla.org/show_bug.cgi?id=1114569 https://bugzilla.mozilla.org/show_bug.cgi?id=1118894 https://bugzilla.mozilla.org/show_bug.cgi?id=1119019 https://bugzilla.mozilla.org/show_bug.cgi?id=1122387 https://bugzilla.mozilla.org/show_bug.cgi?id=1125734 https://bugzilla.mozilla.org/show_bug.cgi?id=1127206 https://bugzilla.mozilla.org/show_bug.cgi?id=1127246 GLSA-201504-01 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. openSUSE-SU-2015:0404 SUSE-SU-2015:0412 SUSE-SU-2015:0446 SUSE-SU-2015:0447 openSUSE-SU-2015:0448 openSUSE-SU-2015:0567 openSUSE-SU-2015:1266 openSUSE-SU-2015:0570 RHSA-2015:0265 RHSA-2015:0266 RHSA-2015:0642 DSA-3174 DSA-3179 http://www.mozilla.org/security/announce/2015/mfsa2015-11.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 72742 1031791 1031792 USN-2505-1 USN-2506-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1096138 https://bugzilla.mozilla.org/show_bug.cgi?id=1107009 https://bugzilla.mozilla.org/show_bug.cgi?id=1111243 https://bugzilla.mozilla.org/show_bug.cgi?id=1111248 https://bugzilla.mozilla.org/show_bug.cgi?id=1115776 https://bugzilla.mozilla.org/show_bug.cgi?id=1117406 https://bugzilla.mozilla.org/show_bug.cgi?id=1119579 https://bugzilla.mozilla.org/show_bug.cgi?id=1123882 https://bugzilla.mozilla.org/show_bug.cgi?id=1124018 https://bugzilla.mozilla.org/show_bug.cgi?id=1128196 GLSA-201504-01 Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file. DSA-3206 [oss-security] 20150322 Dulwich security issue The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id from a keyserver to verify print plugin downloads. FEDORA-2015-11723 FEDORA-2015-11916 [oss-security] 20150529 [CVE-2015-0839] hp-plugin binary driver verification 74913 USN-2699-1 https://bugs.launchpad.net/hplip/+bug/1432516 https://bugzilla.redhat.com/show_bug.cgi?id=1227252 The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc). FEDORA-2015-6974 openSUSE-SU-2015:1058 DSA-3217 USN-2566-1 The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file. http://forums.wesnoth.org/viewtopic.php?t=41870 http://forums.wesnoth.org/viewtopic.php?t=41872 FEDORA-2015-6108 FEDORA-2015-6280 FEDORA-2015-6295 DSA-3218 Format string vulnerability in Movable Type Pro, Open Source, and Advanced before 5.2.13 and Pro and Advanced 6.0.x before 6.0.8 allows remote attackers to execute arbitrary code via vectors related to localization of templates. DSA-3227 1032153 https://movabletype.org/news/2015/04/movable_type_608_and_5213_released_to_close_security_vulnera.html django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors. DSA-3230 https://github.com/jamesturk/django-markupfield/blob/master/CHANGELOG nbd-server.c in Network Block Device (nbd-server) before 3.11 does not properly handle signals, which allows remote attackers to cause a denial of service (deadlock) via unspecified vectors. openSUSE-SU-2015:0994 [Nbd] 20150507 [PATCH] nbd-server: fix unsafe signal handling http://sourceforge.net/projects/nbd/files/nbd/3.11/ DSA-3271 [oss-security] 20150507 CVE-2015-0847 in nbd-server USN-2676-1 Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image. FEDORA-2015-9674 FEDORA-2015-14848 FEDORA-2015-14847 openSUSE-SU-2015:1132 openSUSE-SU-2015:1134 openSUSE-SU-2015:1212 RHSA-2015:1917 DSA-3302 [oss-security] 20150601 CVE-2015-0848 - Heap overflow on libwmf0.2-7 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 74923 1032771 USN-2670-1 GLSA-201602-03 The Git plugin for FusionForge before 6.0rc4 allows remote attackers to execute arbitrary code via an unspecified parameter when creating a secondary Git repository. DSA-3275 https://fusionforge.org/forum/forum.php?forum_id=41 XMLTooling-C before 1.5.5, as used in OpenSAML-C and Shibboleth Service Provider (SP), does not properly handle integer conversion exceptions, which allows remote attackers to cause a denial of service (crash) via schema-invalid XML data. http://shibboleth.net/community/advisories/secadv_20150721.txt DSA-3321 76134 https://git.shibboleth.net/view/?p=cpp-xmltooling.git;a=commitdiff;h=2d795c731e6729309044607154978696a87fd900 Multiple integer underflows in PluginPCX.cpp in FreeImage 3.17.0 and earlier allow remote attackers to cause a denial of service (heap memory corruption) via vectors related to the height and width of a window. FEDORA-2015-decbab7c9f FEDORA-2015-992342e82f FEDORA-2015-16105 FEDORA-2015-16104 FEDORA-2015-16106 DSA-3392 [oss-security] 20150828 CVE-2015-0852 [FreeImage] Integer overflow in PluginPCX.cpp 1034077 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=797165 GLSA-201701-68 https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shell" menu item while in the directory trunk/$(xeyes). http://pysvn.tigris.org/issues/show_bug.cgi?id=202 [oss-security] 20150913 CVE-2015-0853: insecure use of os.system() in svn-workbench https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798863 https://bugs.launchpad.net/ubuntu/+source/svn-workbench/+bug/1495268 https://bugzilla.redhat.com/show_bug.cgi?id=1262928 App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that is mishandled during a "Show in Folder" action. https://bugs.launchpad.net/shutter/+bug/1495163 The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path. [oss-security] 20151223 pitivi: CVE-2015-0855: Insecure use of os.system() 97283 https://bugs.launchpad.net/ubuntu/+source/pitivi/+bug/1495272 https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2 daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme. FEDORA-2015-9f996ea146 [oss-security] 20151014 CVE-2015-0856: sddm does not prevent access to the KDE crash handler 77099 https://github.com/sddm/sddm/commit/4cfed6b0a625593fb43876f04badc4dd99799d86 https://github.com/sddm/sddm/wiki/0.13.0-Release-Announcement Cool Projects TarDiff allows remote attackers to execute arbitrary commands via shell metacharacters in the name of a (1) tar file or (2) file within a tar file. DSA-3562 https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=9bd6a07bc204472ac27242cea16f89943b43003a https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=a18e8df51511df276e61dbccdbe1714fc53af965 Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory. DSA-3562 https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=9bd6a07bc204472ac27242cea16f89943b43003a The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokeping_cgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments. DSA-3405 Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow. DSA-3407 USN-2820-1 https://anonscm.debian.org/cgit/dpkg/dpkg.git/commit/dpkg-deb/extract.c?id=e65aa3db04eb908c9507d5d356a95cedb890814d https://blog.fuzzing-project.org/30-Stack-overflows-and-out-of-bounds-read-in-dpkg-Debian.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798324 GLSA-201612-07 model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records. DSA-3425 http://www.tryton.org/posts/security-release-for-issue5167.html https://bugs.tryton.org/issue5167 Multiple cross-site scripting (XSS) vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) message details when a message is unqueued, such as headers or arguments; (2) policy names, which are not properly handled when viewing policies; (3) details for AMQP network clients, such as the version; allow remote authenticated administrators to inject arbitrary web script or HTML via (4) user names, (5) the cluster name; or allow RabbitMQ cluster administrators to (6) modify unspecified content. http://www.rabbitmq.com/news.html#2015-01-08T10:14:05+0100 GALAXY Apps (aka Samsung Apps, Samsung Updates, or com.sec.android.app.samsungapps) before 14120405.03.012 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code. https://www.nowsecure.com/blog/2015/01/26/samsung-account-and-galaxy-apps-technical-breakdown-cve-2015-0863-and-cve-2015-0864/ Samsung Account (AKA com.osp.app.signin) before 1.6.0069 and 2.x before 2.1.0069 allows man-in-the-middle attackers to obtain sensitive information and execute arbitrary code. 97207 https://www.nowsecure.com/blog/2015/01/26/samsung-account-and-galaxy-apps-technical-breakdown-cve-2015-0863-and-cve-2015-0864/ Multiple cross-site scripting (XSS) vulnerabilities in Zoho ManageEngine SupportCenter Plus 7.9 before hotfix 7941 allow remote attackers to inject arbitrary web script or HTML via the (1) fromCustomer, (2) username, or (3) password parameter to HomePage.do. 20150128 Two XSS Vulnerabilities in SupportCenter Plus 72349 https://forums.manageengine.com/topic/security-update-for-supportcenter-plus https://www.htbridge.com/advisory/HTB23247 Directory traversal vulnerability in SYNCK GRAPHICA Download Log CGI 3.0 and earlier allows remote attackers to read arbitrary files via a crafted filename. JVN#88559134 JVNDB-2015-000006 http://www.synck.com/blogs/news/weblog_1420694040.html Unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromuku(bu2)BBS before 2.91 allows remote attackers to execute arbitrary code by uploading an executable file. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> JVN#94502417 JVNDB-2015-000008 http://www.t-okada.com/cgi-bin/sb2_data/sb2_data_news.cgi?action=data_list&cat=16#495 I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests. JVN#27142693 JVNDB-2015-000009 http://www.iodata.jp/support/information/2015/np-bbrm/ Cross-site scripting (XSS) vulnerability in hb.cgi in Nishishi Factory Fumy News Clipper 2.x before 2.5.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://jvn.jp/en/jp/JVN33735535/995592/index.html JVN#33735535 JVNDB-2015-000010 http://www.nishishi.com/cgi/newsclip/20150130.html Cross-site scripting (XSS) vulnerability in Mrs. Shiromuku Perl CGI shiromuku(u1)GUESTBOOK 1.62 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://jvn.jp/en/jp/JVN17480391/995116/index.html JVN#17480391 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Cross-site scripting (XSS) vulnerability in Homepage Decorator PerlTreeBBS 2.30 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. JVN#96155055 Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from encrypted communications via a crafted certificate. JVN#14522790 JVNDB-2015-000015 72597 The Ogaki Kyoritsu Bank Smartphone Passbook application 1.0.0 for Android creates a log file containing input data from the user, which allows attackers to obtain sensitive information by reading a file. JVN#48659722 JVNDB-2015-000016 http://www.okb.co.jp/okdirect/sp_passbook/information01.html Multiple cross-site scripting (XSS) vulnerabilities in the print_language_selectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. JVN#18387086 JVNDB-2015-000017 https://github.com/sauruscms/Saurus-CMS-Community-Edition/commit/1bc272874a86eaab99dccd00b29177423fd83877 Unrestricted file upload vulnerability in app/lib/mlf.pl in C-BOARD Moyuku before 1.03b3 allows remote attackers to execute arbitrary code by uploading a file with a \0 character in its name. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> JVN#73261710 JVNDB-2015-000018 http://sourceforge.jp/projects/cb-moyuku/news/ Directory traversal vulnerability in CREAR AL-Mail32 before 1.13d allows remote attackers to write to arbitrary files via a crafted filename of an attachment. JVN#77294617 JVNDB-2015-000020 http://www.almail.com/vulnerability.html CREAR AL-Mail32 before 1.13d allows remote attackers to cause a denial of service (application crash) via a (1) CON, (2) AUX, or (3) NUL device name in the filename of an attachment. JVN#55365709 JVNDB-2015-000021 http://www.almail.com/vulnerability.html Buffer overflow in CREAR AL-Mail32 before 1.13d allows remote attackers to execute arbitrary code via a long filename of an attachment. JVN#93318392 JVNDB-2015-000022 http://www.almail.com/vulnerability.html CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a response. <a href="http://cwe.mitre.org/data/definitions/93.html" target="_blank">CWE-93: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a> JVN#64455813 JVNDB-2015-000019 Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php and includes/init_includes/init_sanitize.php. http://jvn.jp/en/jp/JVN44544694/281242/index.html JVN#44544694 JVNDB-2015-000027 https://github.com/zencart-ja/zc-v1-series/commit/022949bd09444d7e58703cc537dbbd5744c381b8 SYNCK GRAPHICA Mailform Pro CGI 4.1.4 and 4.1.5, when the mailauth module is enabled, does not properly send e-mail messages, which allows remote attackers to execute arbitrary code via unspecified vectors. http://jvn.jp/en/jp/JVN30135729/995637/index.html JVN#30135729 JVNDB-2015-000026 http://www.synck.com/blogs/news/weblog_1424791052.html Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character. <a href="http://cwe.mitre.org/data/definitions/428.html">CWE-428: Unquoted Search Path or Element</a> http://jvn.jp/vu/JVNVU99205169/index.html VU#632140 1031825 http://www.support.toshiba.com/sscontent?contentId=4007185 http://www.support.toshiba.com/sscontent?contentId=4007187 checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username. http://checkpw.sourceforge.net/checkpw/changes.txt http://jvn.jp/en/jp/JVN34790526/995575/index.html JVN#34790526 JVNDB-2015-000032 DSA-3192 Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent. <a href="http://cwe.mitre.org/data/definitions/190.html">CWE-190: Integer Overflow or Wraparound</a> JVN#77718330 JVNDB-2015-000033 FEDORA-2015-3120 FEDORA-2015-3032 FEDORA-2015-2994 http://www.mindrot.org/projects/jBCrypt/news/rel04.html https://bugzilla.mindrot.org/show_bug.cgi?id=2097 npppd in the PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 Fuji routers 1.00 through 3.30, SEIL/X1 routers 3.50 through 4.70, SEIL/X2 routers 3.50 through 4.70, and SEIL/B1 routers 3.50 through 4.70 allows remote attackers to cause a denial of service (infinite loop and device hang) via a crafted SSTP packet. JVN#63949115 JVNDB-2015-000031 http://www.seil.jp/support/security/a01541.html KENT-WEB Clip Board before 4.1 allows remote attackers to delete arbitrary files via unspecified vectors. JVN#62298871 JVNDB-2015-000028 http://www.kent-web.com/bbs/clipbbs.html KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article. JVN#88862608 JVNDB-2015-000024 http://www.kent-web.com/bbs/joyful.html The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors. JVN#55063777 JVNDB-2015-000030 https://wordpress.org/plugins/google-captcha/changelog/ Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Simple Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://jvn.jp/en/jp/JVN63687798/995638/index.html JVN#63687798 JVNDB-2015-000034 Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Image Album allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://jvn.jp/en/jp/JVN09871547/995638/index.html JVN#09871547 JVNDB-2015-000035 Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Relay Novel allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://jvn.jp/en/jp/JVN91016415/995638/index.html JVN#91016415 JVNDB-2015-000036 SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors. JVN#30832515 JVNDB-2015-000037 https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/ Cross-site request forgery (CSRF) vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 (aka Not Found) HTTP status codes. JVN#87204433 JVNDB-2015-000038 https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/ Multiple cross-site scripting (XSS) vulnerabilities in eXtplorer before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://extplorer.net/news/16 JVN#97099798 JVNDB-2015-000039 futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors. http://jvn.jp/en/jp/JVN39175666/221504/index.html JVN#39175666 JVNDB-2015-000041 http://www.futomi.com/library/info/2015/20150319.html The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter. JVN#86448949 JVNDB-2015-000042 DSA-3536 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html 74423 https://en.osdn.jp/projects/terasoluna/wiki/StrutsPatch2-EN https://security.netapp.com/advisory/ntap-20180629-0006/ Cross-site scripting (XSS) vulnerability in schedule.cgi in Nishishi Factory Fumy Teacher's Schedule Board 1.10 through 2.21 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. http://jvn.jp/en/jp/JVN74547976/995592/index.html JVN#74547976 JVNDB-2015-000043 http://www.nishishi.com/cgi/ftsb/20150321.html Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. JVN#97281747 JVNDB-2015-000044 https://wpvulndb.com/vulnerabilities/7872 The Semper Fi All in One SEO Pack plugin before 2.2.6 for WordPress does not consider the presence of password protection during generation of the Meta Description field, which allows remote attackers to obtain sensitive information by reading HTML source code. JVN#75615300 JVNDB-2015-000046 http://semperfiwebdesign.com/blog/all-in-one-seo-pack/all-in-one-seo-pack-release-history/ Buffer overflow in Saitoh Kikaku Maruo Editor 8.51 and earlier allows remote attackers to execute arbitrary code via a crafted .hmbook file. http://jvn.jp/en/jp/JVN58784309/294291/index.html JVN#58784309 JVNDB-2015-000048 The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information via a man-in-the-middle attack. JVN#68819526 JVNDB-2015-000049 Cross-site request forgery (CSRF) vulnerability in bBlog allows remote attackers to hijack the authentication of arbitrary users. JVN#71903938 JVNDB-2015-000047 http://sourceforge.net/projects/bblog/ 1032041 Directory traversal vulnerability in Lhaplus before 1.70 allows remote attackers to write to arbitrary files via a crafted archive. http://jvn.jp/en/jp/JVN02527990/414318/index.html JVN#02527990 JVNDB-2015-000050 http://www7a.biglobe.ne.jp/~schezo/ Buffer overflow in Lhaplus before 1.70 allows remote attackers to execute arbitrary code via a crafted archive. http://jvn.jp/en/jp/JVN12329472/414318/index.html JVN#12329472 JVNDB-2015-000051 http://www7a.biglobe.ne.jp/~schezo/ Cross-site scripting (XSS) vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to inject arbitrary web script or HTML via a crafted filename. http://dounokouno.com/2015/04/20/transmitmail-%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6/ JVN#26860747 JVNDB-2015-000054 Directory traversal vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to read arbitrary files via vectors related to attachment handling. http://dounokouno.com/2015/04/20/transmitmail-%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7%E3%81%AB%E3%81%A4%E3%81%84%E3%81%A6/ JVN#41653647 JVNDB-2015-000055 EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors. http://jvn.jp/en/jp/JVN67520407/995657/index.html JVN#67520407 JVNDB-2015-000060 Cross-site scripting (XSS) vulnerability in EasyCTF before 1.4 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. http://jvn.jp/en/jp/JVN07538357/995657/index.html JVN#07538357 JVNDB-2015-000061 EasyCTF before 1.4 does not validate the session ID, which allows remote attackers to obtain access via a crafted HTTP request. http://jvn.jp/en/jp/JVN96439865/995657/index.html JVN#96439865 JVNDB-2015-000062 Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename. JVN#20133698 JVNDB-2015-000063 http://support.maildealer.jp/announce/150511.php SQL injection vulnerability in graph.php in Cacti before 0.8.6f allows remote authenticated users to execute arbitrary SQL commands via the local_graph_id parameter, a different vulnerability than CVE-2007-6035. JVN#18957556 JVNDB-2015-000064 http://www.cacti.net/release_notes_0_8_6f.php Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php. http://packetstormsecurity.com/files/129826/Kajona-CMS-4.6-Cross-Site-Scripting.html 20150106 Reflecting XSS vulnerability in CMS Kajona v. 4.6 http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-01.html https://github.com/kajona/kajonacms/commit/563d39c327606232e480602f7b36ea6cb31bc6f7 https://www.kajona.de/de/News/newsdetails.Security-update-to-module-system.newsDetail.22ac42054aa88a07826c.html Cross-site scripting (XSS) vulnerability in the administrative backend in Sefrengo before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the searchterm parameter to backend/main.php. http://forum.sefrengo.org/index.php?showtopic=3360 http://packetstormsecurity.com/files/129825/Sefrengo-CMS-1.6.0-Cross-Site-Scripting.html 20150106 Reflecting XSS vulnerability in CMS Sefrengo v.1.6.0 http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2014-06.html Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php. http://forum.sefrengo.org/index.php?showtopic=3360 http://packetstormsecurity.com/files/129824/Sefrengo-CMS-1.6.0-SQL-Injection.html 20150106 SQL-Injection in administrative Backend of Sefrengo CMS v.1.6.0 http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-04.html Cross-site request forgery (CSRF) vulnerability in the Banner Effect Header plugin 1.2.6 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the banner_effect_email parameter in the BannerEffectOptions page to wp-admin/options-general.php. http://packetstormsecurity.com/files/129804/WordPress-Banner-Effect-Header-1.2.6-XSS-CSRF.html bannereffect-wp-bannereffectemail-xss(99613) bannereffect-wp-bannereffectemail-csrf(99614) XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html 20150112 Re: McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure 20150106 McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure 61922 1031519 macafee-cve20150921-info-disc(99950) https://gist.github.com/brandonprry/692e553975bf29aeaf2c https://kc.mcafee.com/corporate/index?page=content&id=SB10095 McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password. http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html 20150112 Re: McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure 20150106 McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure 72298 1031519 macafee-cve20150922-info-disc(99949) https://gist.github.com/brandonprry/692e553975bf29aeaf2c https://kc.mcafee.com/corporate/index?page=content&id=SB10095 The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named in the xslt parameter, related to an XML External Entity (XXE) issue. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> VU#377644 Ceragon FibeAir IP-10 bridges have a default password for the root account, which makes it easier for remote attackers to obtain access via a (1) HTTP, (2) SSH, (3) TELNET, or (4) CLI session. VU#936356 The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname. VU#110652 Labtech before 100.237 on Linux uses world-writable permissions for root-executed scripts, which allows local users to gain privileges by modifying a script file. VU#637068 libhtp 0.5.15 allows remote attackers to cause a denial of service (NULL pointer dereference). 73117 https://redmine.openinfosecfoundation.org/issues/1272 time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authentication and obtain administrative access by leveraging a cookie received in an HTTP response. VU#522460 The web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a100 has a hardcoded administrative password, which makes it easier for remote attackers to obtain access via an HTTP session. VU#522460 Ektron Content Management System (CMS) 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1, when the Saxon XSLT parser is used, allows remote attackers to execute arbitrary code via a crafted XSLT document, related to a "resource injection" issue. VU#377644 The ANTlabs InnGate firmware on IG 3100, IG 3101, InnGate 3.00 E, InnGate 3.01 E, InnGate 3.02 E, InnGate 3.10 E, InnGate 3.01 G, and InnGate 3.10 G devices does not require authentication for rsync sessions, which allows remote attackers to read or write to arbitrary files via TCP traffic on port 873. http://blog.cylance.com/spear-team-cve-2015-0932 http://www.antlabs.com/index.php?option=com_content&view=article&id=195:rsync-remote-file-system-access-vulnerability-cve-2015-0932&catid=54:advisories&Itemid=133 VU#930956 http://www.wired.com/2015/03/big-vulnerability-hotel-wi-fi-router-puts-guests-risk/ Absolute path traversal vulnerability in ShareLaTeX 0.1.3 and earlier, when the paranoid openin_any setting is omitted, allows remote authenticated users to read arbitrary files via a \include command. VU#302668 Common LaTeX Service Interface (CLSI) before 0.1.3, as used in ShareLaTeX before 0.1.3, allows remote authenticated users to execute arbitrary code via ` (backtick) characters in a filename. VU#302668 Bomgar Remote Support before 15.1.1 allows remote attackers to execute arbitrary PHP code via crafted serialized data to unspecified PHP scripts. VU#978652 74460 39958 Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key. http://packetstormsecurity.com/files/131259/Ceragon-FibeAir-IP-10-SSH-Private-Key-Exposure.html http://packetstormsecurity.com/files/131260/Ceragon-FibeAir-IP-10-SSH-Private-Key-Exposure.html 20150401 Ceragon FibeAir IP-10 SSH Private Key Exposure (CVE-2015-0936) 73696 https://gist.github.com/todb-r7/5d86ecc8118f9eeecc15 https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=0ahUKEwjs47SGp47UAhVF5iYKHYGLDQkQFggoMAE&url=https%3A%2F%2Fwww.rapid7.com%2Fdb%2Fmodules%2Fexploit%2Flinux%2Fssh%2Fceragon_fibeair_known_privkey&usg=AFQjCNFZiZcWj47cpqPX-AbfpsW0DL4yYw Cross-site scripting (XSS) vulnerability in search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. VU#274244 https://bto.bluecoat.com/security-advisory/sa94 search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to bypass intended access restrictions, and list or read arbitrary documents, by providing matching keywords in conjunction with a crafted parameter. VU#274244 https://bto.bluecoat.com/security-advisory/sa94 The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files. VU#894897 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-6742, CVE-2015-6743, CVE-2015-6744, CVE-2015-6745, CVE-2015-6746, CVE-2015-6747. Reason: This candidate originally combined multiple issues that have different vulnerability types and other complex abstraction issues. Notes: All CVE users should reference CVE-2015-6742, CVE-2015-6743, CVE-2015-6744, CVE-2015-6745, CVE-2015-6746, and CVE-2015-6747 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream. 20150727 Multiple unresolved vulnerabilities in Basware Banking/Maksuliikenne https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html Cross-site scripting (XSS) vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter. VU#924124 https://blog.x-cart.com/5-1-11-released.html X-Cart before 5.1.11 allows remote authenticated users to read or delete address data of arbitrary accounts via a modified (1) update or (2) remove request. VU#924124 https://blog.x-cart.com/5-1-11-released.html ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-0955. Reason: This candidate is a duplicate of CVE-2016-0955. Notes: All CVE users should reference CVE-2016-0955 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. <a href="https://cwe.mitre.org/data/definitions/295.html">CWE-295: Improper Certificate Validation</a> VU#534407 https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/ https://techlib.barracuda.com/BWF/UpdateSSLCerts https://www.barracuda.com/support/techalerts Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship. VU#534407 https://blog.barracuda.com/2015/04/28/barracuda-delivers-updated-ssl-inspection-feature/ https://techlib.barracuda.com/BWF/UpdateSSLCerts https://www.barracuda.com/support/techalerts Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp. VU#697316 Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 8.2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and the image/jpeg content type, a different vulnerability than CVE-2013-3590. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> VU#697316 SearchBlox before 8.2 allows remote attackers to obtain sensitive information via a pretty=true action to the _cluster/health URI. VU#697316 Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users. VU#697316 The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates. http://suricata-ids.org/2015/05/06/suricata-2-0-8-available/ DSA-3254 Pearson ProctorCache before 2015.1.17 uses the same hardcoded password across different customers' installations, which allows remote attackers to modify test metadata or cause a denial of service (test disruption) by leveraging knowledge of this password. VU#626420 Buffer overflow in the png_read_IDAT_data function in pngrutil.c in libpng before 1.5.21 and 1.6.x before 1.6.16 allows context-dependent attackers to execute arbitrary code via IDAT data with a large width, a different vulnerability than CVE-2014-9495. APPLE-SA-2016-03-21-5 [png-mng-announce] 20141222 libpng-1.5.21 and 1.6.16 are available http://tfpwn.com/files/libpng_heap_overflow_1.6.15.txt [oss-security] 20150109 Re: CVE Request: libpng 1.6.15 Heap Overflow [oss-security] 20150110 Re: CVE Request: libpng 1.6.15 Heap Overflow http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html https://support.apple.com/HT206167 Untrusted search path vulnerability in ZTE Datacard MF19 0V1.0.0B04 allows local users to gain privilege by modifying the 'Ucell Internet' directory to reference a malicious mms_dll_r.dll or mediaplayerdll.dll. http://packetstormsecurity.com/files/129808/ZTE-Datacard-MF19-Privilege-Escalation-DLL-Hijacking.html Cross-site scripting (XSS) vulnerability in Inductive Automation Ignition 7.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01 Network Vision IntraVue before 2.3.0a14 on Windows allows remote attackers to execute arbitrary OS commands via unspecified vectors. https://ics-cert.us-cert.gov/advisories/ICSA-15-057-01 Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Elipse E3 4.5.232 through 4.6.161 allow local users to gain privileges via a Trojan horse DLL in an unspecified directory. NOTE: this may overlap CVE-2015-2264. <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> https://ics-cert.us-cert.gov/advisories/ICSA-15-069-04A Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet. https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03 Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request. https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03 The SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to bypass authentication and read or write to arbitrary database fields via unspecified vectors. https://ics-cert.us-cert.gov/advisories/ICSA-15-069-03 Buffer overflow in an unspecified DLL in Schneider Electric Pelco DS-NVs before 7.8.90 allows remote attackers to execute arbitrary code via unspecified vectors. http://download.schneider-electric.com/files?p_File_Id=755516404&p_File_Name=SEVD-2015-065-01+Pelco+DS-NVs+Video+Mgmt+SW.pdf https://ics-cert.us-cert.gov/advisories/ICSA-15-071-01 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none. Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root, and consequently obtain administrative login access, via a crafted pathname. Further research has revealed that this vulnerability allows authenticated shell access as an administrator. The score has been updated to properly reflect this. 20150422 CVE-2015-0984 SCADA - Gaining remote shell on Honeywell Falcon XLWEB https://ics-cert.us-cert.gov/advisories/ICSA-15-076-02 https://www.outpost24.com/hacking-industrial-control-systems-case-study-falcon/ Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that modify the default user's password via a GET request. https://ics-cert.us-cert.gov/advisories/ICSA-15-076-01 Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) get command. http://www.moxa.com/support/download.aspx?d_id=2114 73960 http://www.zerodayinitiative.com/advisories/ZDI-15-392 https://ics-cert.us-cert.gov/advisories/ICSA-15-097-01 Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request. https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01 Omron CX-One CX-Programmer before 9.6 uses a reversible format for password storage in project source-code files, which makes it easier for local users to obtain sensitive information by reading a file. https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01 PACTware 4.1 SP3 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers an internal error. https://ics-cert.us-cert.gov/advisories/ICSA-15-176-02 Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory. <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> https://ics-cert.us-cert.gov/advisories/ICSA-15-090-02 Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information. https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01 Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors. https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01 Inductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01 Inductive Automation Ignition 7.7.2 allows remote authenticated users to bypass a brute-force protection mechanism by using different session ID values in a series of HTTP requests. https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01 Inductive Automation Ignition 7.7.2 uses MD5 password hashes, which makes it easier for context-dependent attackers to obtain access via a brute-force attack. https://ics-cert.us-cert.gov/advisories/ICSA-15-090-01 Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 rely on a hardcoded cleartext password to control read access to Project files and Project Configuration files, which makes it easier for local users to obtain sensitive information by discovering this password. http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02 https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack. http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02 https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 transmit cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network. http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02 https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 store cleartext OPC User credentials in a configuration file, which allows local users to obtain sensitive information by reading this file. http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-01 http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-054-02 https://ics-cert.us-cert.gov/advisories/ICSA-15-085-01 Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCMS before 1.3 allows remote attackers to execute arbitrary code via the StrRtspPath parameter. 74966 http://zerodayinitiative.com/advisories/ZDI-15-120/ https://ics-cert.us-cert.gov/advisories/ICSA-15-153-02 Remote file upload vulnerability in mailcwp v1.99 wordpress plugin http://www.vapidlabs.com/advisory.php?v=138 Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin 96554 http://www.vapidlabs.com/advisory.php?v=139 Open Proxy in filedownload v1.4 wordpress plugin 97100 http://www.vapidlabs.com/advisory.php?v=140 Blind SQL Injection in filedownload v1.4 wordpress plugin 97106 http://www.vapidlabs.com/advisory.php?v=140 XSS in filedownload v1.4 wordpress plugin 97107 http://www.vapidlabs.com/advisory.php?v=140 Remote file download vulnerability in candidate-application-form v1.0 wordpress plugin 97108 http://www.vapidlabs.com/advisory.php?v=142 Remote file download vulnerability in recent-backups v0.7 wordpress plugin 97125 http://www.vapidlabs.com/advisory.php?v=144 Remote file download vulnerability in wptf-image-gallery v1.03 http://www.vapidlabs.com/advisory.php?v=148 Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 http://www.vapidlabs.com/advisory.php?v=149 Open proxy in Wordpress plugin google-adsense-and-hotel-booking v1.05 http://www.vapidlabs.com/advisory.php?v=151 Remote file download in simple-image-manipulator v1.0 wordpress plugin 94563 http://www.vapidlabs.com/advisory.php?v=147 Blind SQL Injection in wordpress plugin dukapress v2.5.9 94567 http://www.vapidlabs.com/advisory.php?v=152 Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin 94495 http://www.vapidlabs.com/advisory.php?v=154 Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1 94497 http://www.vapidlabs.com/advisory.php?v=153 Multiple stack-based buffer overflows in IniNet embeddedWebServer (aka eWebServer) before 2.02 allow remote attackers to execute arbitrary code via a long field in an HTTP request. https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02 IniNet embeddedWebServer (aka eWebServer) before 2.02 mishandles URL encoding, which allows remote attackers to write to or delete files via a crafted string. <a href="https://cwe.mitre.org/data/definitions/177.html">CWE-177: Improper Handling of URL Encoding (Hex Encoding)</a> https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02 Directory traversal vulnerability in IniNet embeddedWebServer (aka eWebServer) before 2.02 allows remote attackers to read arbitrary files via a crafted pathname. https://ics-cert.us-cert.gov/advisories/ICSA-15-293-02 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. IniNet embeddedWebServer (aka eWebServer) before 2.02 for Windows CE uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information via unspecified vectors. https://ics-cert.us-cert.gov/advisories/ICSA-15-293-01 A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible. https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01 A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible. https://ics-cert.us-cert.gov/advisories/ICSA-15-120-01 SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input. http://community.emerson.com/process/emerson-exchange/operateandmanage/deltav/deltav_security/b/securitynotificationblog/archive/2015/04/16/dsn15003-2-ams-device-management-sql-injection-vulnerability 74774 https://ics-cert.us-cert.gov/advisories/ICSA-15-111-01 Schneider Electric InduSoft Web Studio before 7.1.3.5 Patch 5 and Wonderware InTouch Machine Edition through 7.1 SP3 Patch 4 use cleartext for project-window password storage, which allows local users to obtain sensitive information by reading a file. http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2015-100-01 https://gcsresource.invensys.com/support/docs/_securitybulletins/Security_bulletin_LFSEC00000110.pdf https://ics-cert.us-cert.gov/advisories/ICSA-15-211-01 Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt credentials, which allows local users to obtain sensitive information by reading a file and conducting a decryption attack. https://ics-cert.us-cert.gov/advisories/ICSA-15-132-02 https://rockwellautomation.custhelp.com/app/answers/detail/a_id/700915 Hospira LifeCare PCA Infusion System before 7.0 has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors. http://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm446809.htm https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01A Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless capacity in a clinical setting. Hospira has developed a new version of the PCS Infusion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access. https://ics-cert.us-cert.gov/advisories/ICSA-15-125-01 OSIsoft PI AF 2.6 and 2.7 and PI SQL for AF 2.1.2.19 do not ensure that the PI SQL (AF) Trusted Users group lacks the Everyone account, which allows remote authenticated users to bypass intended command restrictions via SQL statements. https://ics-cert.us-cert.gov/advisories/ICSA-15-132-01 https://techsupport.osisoft.com/Troubleshooting/Alerts/AL00280 A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version. https://ics-cert.us-cert.gov/advisories/ICSA-15-141-01 Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash cards, which makes it easier for local users to obtain sensitive information by reading a file. https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01 Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ManageEngine ADManager Plus before 6.2 Build 6270 allow remote attackers to inject arbitrary web script or HTML via the (1) technicianSearchText parameter to the Help Desk Technician page or (2) rolesSearchText parameter to the Help Desk Roles. http://packetstormsecurity.com/files/130737/Manage-Engine-AD-Audit-Manager-Plus-Cross-Site-Scripting.html 20150310 Reflected cross-site scripting(XSS) Vulnerability in Manage Engine AD Audit Manager Plus Admin Panel(Build 6270) The version checking subroutine in percona-toolkit before 2.2.13 and xtrabackup before 2.2.9 was vulnerable to silent HTTP downgrade attacks and Man In The Middle attacks in which the server response could be modified to allow the attacker to respond with modified command payload and have the client return additional running configuration information leading to an information disclosure of running configuration of MySQL. https://bugs.launchpad.net/percona-toolkit/+bug/1408375 https://www.percona.com/blog/2015/05/06/percona-security-advisory-cve-2015-1027/ Multiple cross-site scripting (XSS) vulnerabilities in D-Link DSL-2730B router (rev C1) with firmware GE_1.01 allow remote authenticated users to inject arbitrary web script or HTML via the (1) domainname parameter to dnsProxy.cmd (DNS Proxy Configuration Panel); the (2) brName parameter to lancfg2get.cgi (Lan Configuration Panel); the (3) wlAuthMode, (4) wl_wsc_reg, or (5) wl_wsc_mode parameter to wlsecrefresh.wl (Wireless Security Panel); or the (6) wlWpaPsk parameter to wlsecurity.wl (Wireless Password Viewer). 35747 35750 35751 http://www.xlabs.com.br/blog/?p=339 The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache. http://puppetlabs.com/security/cve/cve-2015-1029 Memory leak in the rfc2553_connect_to function in jbsocket.c in Privoxy before 3.0.22 allows remote attackers to cause a denial of service (memory consumption) via a large number of requests that are rejected because the socket limit is reached. [oss-security] 20150110 Re: CVE Request for Privoxy Version: 3.0.22 http://www.privoxy.org/announce.txt Multiple use-after-free vulnerabilities in Privoxy before 3.0.22 allow remote attackers to have unspecified impact via vectors related to (1) the unmap function in list.c or (2) "two additional unconfirmed use-after-free complaints made by Coverity scan." NOTE: some of these details are obtained from third party information. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> DSA-3133 [oss-security] 20150110 Re: CVE Request for Privoxy Version: 3.0.22 http://www.privoxy.org/announce.txt Cross-site scripting (XSS) vulnerability in Kiwix before 0.9.1, when using kiwix-serve, allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to /search. http://packetstormsecurity.com/files/130007/Kiwix-Cross-Site-Scripting.html http://sourceforge.net/p/kiwix/bugs/763/ http://sourceforge.net/p/kiwix/kiwix/ci/d1af5f0375c6db24d4071acf4806735725fd206e 20150118 CVE-2015-1032 Kiwix Cross-Site Scripting Vulnerability p7zip 9.20.1 allows remote attackers to write to arbitrary files via a symlink attack in an archive. FEDORA-2015-fadaa9953e FEDORA-2015-d5cc306730 openSUSE-SU-2015:1162 DSA-3289 [oss-security] 20150111 Re: CVE request for directory traversal flaw in p7zip http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html 71890 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774660 https://bugzilla.redhat.com/show_bug.cgi?id=1179505 p7zip-cve20151038-symlink(99970) Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter. [oss-security] 20150111 Re: CVE request 71931 https://github.com/ZF-Commons/ZfcUser/commit/baf0e460 https://github.com/ZF-Commons/ZfcUser/issues/550 Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lrealname field in the editProfile form to index.php/home/profile; the (2) data[title] or (3) data[description] field in the addQuickItem form to index.php; the (4) "note text" field in the saveNote form to index.php/areas; or the (5) titleBEObject or (6) tagsArea field in the updateForm form to index.php/documents/view. http://packetstormsecurity.com/files/129865/CMS-BEdita-3.4.0-Cross-Site-Scripting.html 20150108 Multiple persistent XSS vulnerabilites in CMS BEdita v. 3.4.0 [oss-security] 20150111 Re: CVE Request -- CMS BEdita v. 3.4.0 -- Multiple stored XSS vulnerabilities http://sroesemann.blogspot.de/2014/12/sroeadv-2014-10.html 71949 https://github.com/bedita/bedita/issues/566 Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e107_files/ file path in the QUERY_STRING. http://packetstormsecurity.com/files/129872/CMS-e107-1.0.4-Cross-Site-Scripting.html 20150109 Reflecting XSS vulnerability in CMS e107 v. 1.0.4 http://sroesemann.blogspot.de/2014/12/sroeadv-2014-05.html http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2014-05.html [oss-security] 20150111 Re: CVE Request -- CMS e107 v.1.0.4 -- Reflecting XSS vulnerability in filemanager functionality 71977 e107-filemanager-xss(99898) https://github.com/e107inc/e107v1/issues/2 The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> http://packetstormsecurity.com/files/130142/Mantis-BugTracker-1.2.19-Open-Redirect.html 20150128 CVE-2015-1042 - Mantis BugTracker 1.2.19 - URL Redirection to Untrusted Site ('Open Redirect') [oss-security] 20150110 Re: CVE-2014-6316: URL redirection issue in MantisBT [oss-security] 20150111 Re: Re: CVE-2014-6316: URL redirection issue in MantisBT 1031633 https://www.mantisbt.org/bugs/view.php?id=17997 The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors. 72337 1031644 http://www.vmware.com/security/advisories/VMSA-2015-0001.html vmware-cve20151043-dos(100934) vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allows attackers to cause a host OS denial of service via unspecified vectors. 72336 1031645 1031646 http://www.vmware.com/security/advisories/VMSA-2015-0001.html vmware-cve20151044-dos(100935) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message. 76932 1033720 http://www.vmware.com/security/advisories/VMSA-2015-0007.html Open redirect vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices with firmware before 4.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-597212.pdf The web server on Siemens SCALANCE X-200IRT switches with firmware before 5.2.0 allows remote attackers to hijack sessions via unspecified vectors. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-954136.pdf Cross-site scripting (XSS) vulnerability in F5 BIG-IP Application Security Manager (ASM) before 11.6 allows remote attackers to inject arbitrary web script or HTML via the Response Body field when creating a new user account. http://packetstormsecurity.com/files/129911/F5-BIG-IP-Application-Security-Manager-ASM-XSS.html 20150113 [Corrected] Stored XSS Vulnerability in F5 BIG-IP Application Security Manager 20150113 [Corrected] Stored XSS Vulnerability in F5 BIG-IP Application Security Manager 1031551 f5bigip-responsebody-xss(99907) Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> FEDORA-2015-0717 FEDORA-2015-0726 71925 https://www.drupal.org/node/2402779 https://www.drupal.org/node/2403351 Cross-site scripting (XSS) vulnerability in the poll archive in PHPKIT 1.6.6 (Build 160014) allows remote attackers to inject arbitrary web script or HTML via the result parameter to upload_files/pk/include.php. http://packetstormsecurity.com/files/129917/CMS-PHPKit-WCMS-1.6.6-Cross-Site-Scripting.html 20150112 Reflecting XSS vulnerability in CMS PHPKit WCMS v. 1.6.6 http://sroesemann.blogspot.de/2014/12/sroeadv-2014-07.html http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2014-07.html 72001 Cross-site scripting (XSS) vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/file_manager/file_manager/editfile. http://packetstormsecurity.com/files/129916/CMS-Croogo-2.2.0-Cross-Site-Scripting.html 20150112 Reflecting XSS vulnerability in CMS Croogo v.2.2.0 http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-02.html http://sroesemann.blogspot.de/2015/01/sroeadv-2015-02.html 71999 https://blog.croogo.org/blog/croogo-221-released croogo-filemanagereditfile-xss(99890) https://github.com/croogo/croogo/issues/599 Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the Game Content field in Add Game. http://codecanyon.net/item/crea8social-php-social-networking-platform-v31/9211270 http://codecanyon.net/item/crea8social-php-social-networking-platform-v31/9211270/support http://packetstormsecurity.com/files/129816/Crea8Social-2.0-Cross-Site-Scripting.html 35691 crea8social-game-xss(99615) SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the order_by parameter in a GalleryBox action to wp-admin/admin-ajax.php. 20150112 Wordpress Photo Gallery 1.2.7 unauthenticated SQL injection 72015 Cross-site scripting (XSS) vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary web script or HTML via the url parameter to general/status.html and possibly other pages. http://packetstormsecurity.com/files/129841/Brother-MFC-J4410DW-Cross-Site-Scripting.html 20150107 Brother MFC Administration Reflected Cross-Site Scripting 71911 mfcj4410dw-url-xss(99906) Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value. 35679 bootstrapcms-usersettings-xss(99627) Multiple cross-site scripting (XSS) vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data[Category][title] parameter to admin/categories/add, (2) data[Field][title] parameter to admin/fields/ajax_fields/, (3) name property in a basicInfo JSON object to admin/tools/create_theme, (4) data[Link][link_title] parameter to admin/links/links/add, or (5) data[ForumTopic][subject] parameter to forums/off-topic/new. http://packetstormsecurity.com/files/129812/AdaptCMS-3.0.3-Cross-Site-Scripting.html 35710 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5218.php adaptcms-multiple-data-xss(99617) Unrestricted file upload vulnerability in admin/files/add in AdaptCMS 3.0.3 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in /app/webroot/uploads. http://packetstormsecurity.com/files/129814/AdaptCMS-3.0.3-Remote-Command-Execution.html 35710 http://zeroscience.mk/en/vulnerabilities/ZSL-2015-5220.php adaptcms-appwebrootuploads-file-upload(99616) Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> http://packetstormsecurity.com/files/129813/AdaptCMS-3.0.3-HTTP-Referer-Header-Open-Redirect.html 35710 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5219.php adaptcms-referer-open-redirect(99618) IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling. APPLE-SA-2015-03-09-1 APPLE-SA-2015-03-09-2 APPLE-SA-2015-03-09-3 73004 1031864 https://support.apple.com/HT204413 https://support.apple.com/HT204423 https://support.apple.com/HT204426 https://support.apple.com/kb/HT204563 MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem locations via a crafted app. APPLE-SA-2015-03-09-1 APPLE-SA-2015-03-09-2 1031864 https://support.apple.com/HT204423 https://support.apple.com/HT204426 CoreTelephony in Apple iOS before 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a Class 0 SMS message. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> APPLE-SA-2015-03-09-1 1031864 https://support.apple.com/HT204423 Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process. APPLE-SA-2015-03-09-1 1031864 https://support.apple.com/HT204423 Multiple buffer overflows in iCloud Keychain in Apple iOS before 8.2 and Apple OS X through 10.10.2 allow man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream during keychain recovery. APPLE-SA-2015-03-09-1 APPLE-SA-2015-03-09-3 73007 1031864 https://support.apple.com/HT204413 https://support.apple.com/HT204423 https://support.apple.com/kb/HT204563 Off-by-one error in IOAcceleratorFamily in Apple OS X through 10.10.2 allows attackers to execute arbitrary code in a privileged context via a crafted app. APPLE-SA-2015-03-09-3 1031869 https://support.apple.com/HT204413 Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1637. APPLE-SA-2015-04-08-2 APPLE-SA-2015-03-09-1 APPLE-SA-2015-03-09-2 APPLE-SA-2015-03-09-3 73009 1031829 1031830 https://freakattack.com/ https://support.apple.com/HT204413 https://support.apple.com/HT204423 https://support.apple.com/HT204426 https://support.apple.com/HT204659 https://support.apple.com/kb/HT204870 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 openSUSE-SU-2016:0915 1031936 USN-2937-1 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 openSUSE-SU-2016:0915 1031936 USN-2937-1 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 openSUSE-SU-2016:0915 1031936 USN-2937-1 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 APPLE-SA-2015-03-17-1 openSUSE-SU-2016:0915 1031936 USN-2937-1 https://support.apple.com/HT204560 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL. APPLE-SA-2015-04-08-3 APPLE-SA-2015-03-17-1 1031936 https://support.apple.com/HT204560 https://support.apple.com/HT204661 AppleKeyStore in Apple iOS before 8.3 does not properly restrict a certain passcode-confirmation interface, which makes it easier for attackers to verify correct passcode guesses via a crafted app. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 The Audio Drivers subsystem in Apple iOS before 8.3 and Apple TV before 7.2 does not properly validate IOKit object metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032050 https://support.apple.com/HT204661 https://support.apple.com/HT204662 Directory traversal vulnerability in Backup in Apple iOS before 8.3 allows attackers to read arbitrary files via a crafted relative path. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 CFURL in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly validate URLs, which allows remote attackers to execute arbitrary code via a crafted web site. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 73984 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 CFNetwork in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle cookies during processing of redirects in HTTP responses, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 73984 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 CFNetwork in Apple iOS before 8.3 does not delete HTTP Strict Transport Security (HSTS) state information in response to a Safari history-clearing action, which allows attackers to obtain sensitive information by reading a history file. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 The CFNetwork Session component in Apple iOS before 8.3 and Apple OS X before 10.10.3 does not properly handle request headers during processing of redirects in HTTP responses, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 73984 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 NSXMLParser in Foundation in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 73983 1032050 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 FontParser in Apple iOS before 8.3 and Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 73984 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/kb/HT204870 IOAcceleratorFamily in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 73983 1032050 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HID device. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 IOHIDFamily in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 IOMobileFramebuffer in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 73983 1032050 https://support.apple.com/HT204661 https://support.apple.com/HT204662 iWork in Apple iOS before 8.3 and Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted iWork file. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 73984 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 Race condition in the setreuid system-call implementation in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service via a crafted app. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (out-of-bounds memory access) or obtain sensitive memory-content information via a crafted app. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 http://m00nbsd.net/garbage/Mac-OS-X_Fat-DoS.txt 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 36814 The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not properly handle TCP headers, which allows man-in-the-middle attackers to cause a denial of service via unspecified vectors. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 makes routing changes in response to ICMP_REDIRECT messages, which allows remote attackers to cause a denial of service (network outage) or obtain sensitive packet-content information via a crafted ICMP packet. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not properly determine whether an IPv6 packet had a local origin, which allows remote attackers to bypass an intended network-filtering protection mechanism via a crafted packet. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 The TCP implementation in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 does not properly implement the Urgent (aka out-of-band data) mechanism, which allows remote attackers to cause a denial of service via crafted packets. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 The QuickType feature in the Keyboards subsystem in Apple iOS before 8.3 allows physically proximate attackers to discover passcodes by reading the lock screen during use of a Bluetooth keyboard. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 The Lock Screen component in Apple iOS before 8.3 does not properly implement the erasure feature for incorrect passcode-authentication attempts, which makes it easier for physically proximate attackers to obtain access by making many passcode guesses. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 The Lock Screen component in Apple iOS before 8.3 does not properly enforce the limit on incorrect passcode-authentication attempts, which makes it easier for physically proximate attackers to obtain access by making many passcode guesses. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 NetworkExtension in Apple iOS before 8.3 stores credentials in VPN configuration logs, which makes it easier for physically proximate attackers to obtain sensitive information by reading a log file. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 The Podcasts component in Apple iOS before 8.3 and Apple TV before 7.2 allows remote attackers to discover unique identifiers by reading asset-download request data. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 73983 1032050 https://support.apple.com/HT204661 https://support.apple.com/HT204662 Safari in Apple iOS before 8.3 does not delete Recently Closed Tabs data in response to a history-clearing action, which allows attackers to obtain sensitive information by reading a history file. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, as used on iOS before 8.3 and other platforms, does not properly delete browsing-history data from the history.plist file, which allows attackers to obtain sensitive information by reading this file. APPLE-SA-2015-04-08-1 APPLE-SA-2015-04-08-3 1032047 https://support.apple.com/HT204658 https://support.apple.com/HT204661 The Sandbox Profiles component in Apple iOS before 8.3 allows attackers to read the (1) telephone number or (2) e-mail address of a recent contact via a crafted app. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 The Sandbox Profiles component in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to discover hardware identifiers via a crafted app. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 73983 1032050 https://support.apple.com/HT204661 https://support.apple.com/HT204662 The Telephony component in Apple iOS before 8.3 allows attackers to bypass a sandbox protection mechanism and access unintended telephone capabilities via a crafted app. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 The UIKit View component in Apple iOS before 8.3 displays unblurred application snapshots in the Task Switcher, which makes it easier for physically proximate attackers to obtain sensitive information by reading the device screen. APPLE-SA-2015-04-08-3 73978 1032050 https://support.apple.com/HT204661 The (1) setreuid and (2) setregid system-call implementations in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 do not properly perform privilege drops, which makes it easier for attackers to execute code with unintended user or group privileges via a crafted app. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204870 libnetcore in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (memory corruption and application crash) via a crafted configuration profile. APPLE-SA-2015-04-08-2 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032048 https://support.apple.com/HT204659 https://support.apple.com/HT204661 https://support.apple.com/HT204662 WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4. APPLE-SA-2015-04-08-1 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 73972 1032047 https://support.apple.com/HT204658 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4. APPLE-SA-2015-04-08-1 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 openSUSE-SU-2016:0915 73972 1032047 USN-2937-1 https://support.apple.com/HT204658 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4. APPLE-SA-2015-04-08-1 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 73972 1032047 https://support.apple.com/HT204658 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4. APPLE-SA-2015-04-08-1 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 openSUSE-SU-2016:0761 openSUSE-SU-2016:0915 73972 1032047 USN-2937-1 https://support.apple.com/HT204658 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 WebKit, as used in Apple iOS before 8.3 and Apple TV before 7.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-3 and APPLE-SA-2015-04-08-4. APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 1032050 https://support.apple.com/HT204661 https://support.apple.com/HT204662 WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4. APPLE-SA-2015-04-08-1 APPLE-SA-2015-04-08-3 APPLE-SA-2015-04-08-4 APPLE-SA-2015-06-30-6 73972 1032047 https://support.apple.com/HT204658 https://support.apple.com/HT204661 https://support.apple.com/HT204662 https://support.apple.com/kb/HT204949 The touch-events implementation in WebKit in Apple iOS before 8.3 allows remote attackers to trigger an association between a tap and an unintended web resource via a crafted web site. APPLE-SA-2015-04-08-3 1032050 https://support.apple.com/HT204661 WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors. APPLE-SA-2015-04-08-1 APPLE-SA-2015-04-08-3 1032047 https://support.apple.com/HT204658 https://support.apple.com/HT204661 The private-browsing implementation in WebKit in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 places browsing history into an index, which might allow local users to obtain sensitive information by reading index entries. APPLE-SA-2015-04-08-1 openSUSE-SU-2016:0915 1032047 USN-2937-1 https://support.apple.com/HT204658 The private-browsing implementation in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 allows attackers to obtain sensitive browsing-history information via vectors involving push-notification requests. APPLE-SA-2015-04-08-1 1032047 https://support.apple.com/HT204658 Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier for remote attackers to track users via a crafted web site. APPLE-SA-2015-04-08-1 APPLE-SA-2015-09-16-1 1032047 https://support.apple.com/HT204658 https://support.apple.com/HT205212 The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges via unspecified vectors. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 36692 fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1132, CVE-2015-1134, and CVE-2015-1135. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1132, CVE-2015-1133, and CVE-2015-1135. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1132, CVE-2015-1133, and CVE-2015-1134. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 Use-after-free vulnerability in CoreAnimation in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code by leveraging improper use of a mutex. <a href="http://cwe.mitre.org/data/definitions/416.html" rel="nofollow">CWE-416: Use After Free</a> APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 The NVIDIA graphics driver in Apple OS X before 10.10.3 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via an unspecified IOService userclient type. <a href="http://cwe.mitre.org/data/definitions/476.html" rel="nofollow">CWE-476: NULL Pointer Dereference</a> APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 Hypervisor in Apple OS X before 10.10.3 allows local users to cause a denial of service via unspecified vectors. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 ImageIO in Apple OS X before 10.10.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .sgi file. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 Buffer overflow in IOHIDFamily in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 The mach_vm_read functionality in the kernel in Apple OS X before 10.10.3 allows local users to cause a denial of service (system crash) via unspecified vectors. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 LaunchServices in Apple OS X before 10.10.3 allows local users to cause a denial of service (Finder crash) via crafted localization data. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 On multiple SR-IOV cars it is possible for VF's assigned to guests to send ethernet flow control pause frames via the PF. This includes Linux kernel ixgbe driver before commit f079fa005aae08ee0e1bc32699874ff4f02e11c1, the Linux Kernel i40e/i40evf driver before e7358f54a3954df16d4f87e3cad35063f1c17de5 and the DPDK before commit 3f12b9f23b6499ff66ec8b0de941fb469297e5d0, additionally Multiple vendor NIC firmware is affected. [oss-security] 20151203 CVE request -- Ethernet flow control vulnerability in SRIOV devices https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00046&languageid=en-fr https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-smolyar.pdf LaunchServices in Apple OS X before 10.10.3 allows local users to gain privileges via a crafted localized string, related to a "type confusion" issue. <a href="http://cwe.mitre.org/data/definitions/843.html" rel="nofollow">CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')</a> APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 Buffer overflow in the UniformTypeIdentifiers component in Apple OS X before 10.10.3 allows local users to gain privileges via a crafted Uniform Type Identifier. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 The Code Signing implementation in Apple OS X before 10.10.3 does not properly validate signatures, which allows local users to bypass intended access restrictions via a crafted bundle, a different vulnerability than CVE-2015-1146. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 The Code Signing implementation in Apple OS X before 10.10.3 does not properly validate signatures, which allows local users to bypass intended access restrictions via a crafted bundle, a different vulnerability than CVE-2015-1145. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 Screen Sharing in Apple OS X before 10.10.3 stores the password of a user in a log file, which might allow context-dependent attackers to obtain sensitive information by reading this file. APPLE-SA-2015-04-08-2 73982 1032048 https://support.apple.com/HT204659 Integer overflow in the simulator in Swift in Apple Xcode before 6.3 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact by triggering an incorrect result of a type conversion. APPLE-SA-2015-04-08-5 1032049 https://support.apple.com/HT204663 The Firewall component in Apple OS X Server before 4.1 uses an incorrect pathname in configuration files, which allows remote attackers to bypass network-access restrictions by sending packets for which custom-rule blocking was intended. APPLE-SA-2015-04-24-1 1032197 https://support.apple.com/HT204201 Wiki Server in Apple OS X Server before 4.1 allows remote attackers to bypass intended restrictions on Activity and People pages by connecting from an iPad client. APPLE-SA-2015-04-24-1 1032196 https://support.apple.com/HT204201 WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1153 and CVE-2015-1154. APPLE-SA-2015-06-30-1 APPLE-SA-2015-06-30-6 APPLE-SA-2015-05-06-1 APPLE-SA-2015-09-16-3 openSUSE-SU-2016:0761 http://support.apple.com/kb/HT204941 74525 1032270 https://support.apple.com/HT204826 https://support.apple.com/HT205221 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1154. APPLE-SA-2015-06-30-1 APPLE-SA-2015-06-30-6 APPLE-SA-2015-05-06-1 APPLE-SA-2015-09-16-3 openSUSE-SU-2016:0915 http://support.apple.com/kb/HT204941 74523 1032270 USN-2937-1 https://support.apple.com/HT204826 https://support.apple.com/HT205221 https://support.apple.com/kb/HT204949 WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1153. APPLE-SA-2015-06-30-6 APPLE-SA-2015-05-06-1 74526 1032270 https://support.apple.com/HT204826 https://support.apple.com/kb/HT204949 The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site. APPLE-SA-2015-06-30-1 APPLE-SA-2015-05-06-1 openSUSE-SU-2016:0761 openSUSE-SU-2016:0915 http://support.apple.com/kb/HT204941 74527 1032270 USN-2937-1 https://support.apple.com/HT204826 The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site. APPLE-SA-2015-06-30-1 APPLE-SA-2015-05-06-1 http://support.apple.com/kb/HT204941 74524 1032270 https://support.apple.com/HT204826 CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message. http://9to5mac.com/2015/05/27/how-to-fix-ios-text-message-bug-crash-reboot/ APPLE-SA-2015-06-30-1 APPLE-SA-2015-06-30-2 APPLE-SA-2015-09-16-3 http://support.apple.com/kb/HT204941 http://support.apple.com/kb/HT204942 http://www.ibtimes.co.uk/apple-ios-bug-sees-message-app-crash-iphone-reboot-simply-by-receiving-message-1503083 http://www.reddit.com/r/apple/comments/37e8c1/malicious_text_message/ http://www.reddit.com/r/apple/comments/37enow/about_the_latest_iphone_security_vulnerability/ http://www.reddit.com/r/explainlikeimfive/comments/37edde/eli5_how_that_text_you_can_send_to_friends_turns/ 75491 1032408 http://zanzebek.com/a-simple-text-message-can-ruin-any-iphone/ https://ghostbin.com/paste/zws9m https://support.apple.com/HT205221 The add_job function in scheduler/ipp.c in cupsd in CUPS before 2.0.3 performs incorrect free operations for multiple-value job-originating-host-name attributes, which allows remote attackers to trigger data corruption for reference-counted strings via a crafted (1) IPP_CREATE_JOB or (2) IPP_PRINT_JOB request, as demonstrated by replacing the configuration file and consequently executing arbitrary code. http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702 SUSE-SU-2015:1041 SUSE-SU-2015:1044 openSUSE-SU-2015:1056 RHSA-2015:1123 http://www.cups.org/blog.php?L1082 DSA-3283 VU#810572 75098 1032556 USN-2629-1 https://bugzilla.opensuse.org/show_bug.cgi?id=924208 https://bugzilla.redhat.com/show_bug.cgi?id=1221641 https://code.google.com/p/google-security-research/issues/detail?id=455 https://github.com/0x00string/oldays/blob/master/CVE-2015-1158.py GLSA-201510-07 https://www.cups.org/str.php?L4609 37336 41233 Cross-site scripting (XSS) vulnerability in the cgi_puts function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/. http://googleprojectzero.blogspot.in/2015/06/owning-internet-printing-case-study-in.html http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10702 SUSE-SU-2015:1041 SUSE-SU-2015:1044 openSUSE-SU-2015:1056 RHSA-2015:1123 http://www.cups.org/blog.php?L1082 DSA-3283 VU#810572 75106 1032556 USN-2629-1 https://bugzilla.opensuse.org/show_bug.cgi?id=924208 https://bugzilla.redhat.com/show_bug.cgi?id=1221642 https://code.google.com/p/google-security-research/issues/detail?id=455 GLSA-201510-07 https://www.cups.org/str.php?L4609 Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> http://nodesecurity.io/advisories/serve-static-open-redirect 72064 https://bugzilla.redhat.com/show_bug.cgi?id=1181917 nodejs-servestatic-open-redirect(99936) https://github.com/expressjs/serve-static/issues/26 RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors. http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html FEDORA-2015-4666 FEDORA-2015-4698 DSA-3176 Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication. http://packetstormsecurity.com/files/130053/CAS-Server-3.5.2-LDAP-Authentication-Bypass.html 20150121 CVE-2015-1169 - CAS Server 3.5.2 allows remote attackers to bypass LDAP authentication via crafted wildcards. https://github.com/Jasig/cas/commit/7de61b4c6244af9ff8e75a2c92a570f3b075309c https://github.com/Jasig/cas/pull/411 https://issues.jasig.org/browse/CAS-1429 The NVIDIA Display Driver R304 before 309.08, R340 before 341.44, R343 before 345.20, and R346 before 347.52 does not properly validate local client impersonation levels when performing a "kernel administrator check," which allows local users to gain administrator privileges via unspecified API calls. HPSBHF03271 SSRT101950 http://nvidia.custhelp.com/app/answers/detail/a_id/3634 1032013 https://support.lenovo.com/product_security/nvidia_windows_privilege https://support.lenovo.com/us/en/product_security/nvidia_windows_privilege Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file. http://packetstormsecurity.com/files/129992/simeditor-overflow.txt https://osandamalith.wordpress.com/2015/01/16/sim-editor-stack-based-buffer-overflow/ https://www.youtube.com/watch?v=tljbFpYtDTk Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> http://packetstormsecurity.com/files/130282/WordPress-Holding-Pattern-0.6-Shell-Upload.html 72546 https://wpvulndb.com/vulnerabilities/7784 Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 does not properly restrict access to the (1) Design Mode and (2) Debug Logger mode modules, which allows remote attackers to gain privileges via crafted "received parameters." http://packetstormsecurity.com/files/133147/UNIT4TETA-TETA-WEB-22.62.3.4-Authorization-Bypass.html 20150818 UNIT4TETA TETA WEB - Authorization Bypass vulnerability Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id. http://packetstormsecurity.com/files/133296/UNIT4TETA-TETA-WEB-22.62.3.4-Session-Fixation.html Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the layered_price_slider parameter. http://octogence.com/advisories/cve-2015-1175-xss-prestashop/ http://packetstormsecurity.com/files/130026/Prestashop-1.6.0.9-Cross-Site-Scripting.html 20150120 CVE-2015-1175-xss-prestashop prestashop-cve20151175-xss(100013) Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action. http://packetstormsecurity.com/files/130057/osTicket-1.9.4-Cross-Site-Scripting.html 20150122 CVE-2015-1176-xss-osticket 72276 https://github.com/osTicket/osTicket-1.8/pull/1639 https://github.com/osTicket/osTicket-1.8/releases/tag/v1.9.5 Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2. http://packetstormsecurity.com/files/130058/Exponent-CMS-2.3.2-Cross-Site-Scripting.html 20150122 CVE-2015-1177-xss-exponent 72274 Multiple cross-site scripting (XSS) vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) product_id or (2) category_id parameter. http://packetstormsecurity.com/files/130061/X-CART-e-Commerce-5.1.8-Cross-Site-Scripting.html 20150122 CVE-2015-1178-xss-x-cart-ecommerce 72275 Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter. http://packetstormsecurity.com/files/130062/Mango-Automation-SCADA-HMI-2.4.0-Cross-Site-Scripting.html 20150122 CVE-2015-1179-xss-mango-automation-scada Cross-site scripting (XSS) vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the pageId parameter to networktile/bullet. http://packetstormsecurity.com/files/130063/EventSentry-3.1.0-Cross-Site-Scripting.html 20150122 CVE-2015-1180-xss-eventsentry The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate. <a href="http://cwe.mitre.org/data/definitions/824.html">CWE-824: Access of Uninitialized Pointer</a> FEDORA-2015-0991 FEDORA-2015-1045 openSUSE-SU-2015:0186 DSA-3136 https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04 GLSA-201801-15 The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp. http://packetstormsecurity.com/files/130607/D-Link-DIR636L-Remote-Command-Injection.html http://packetstormsecurity.com/files/131465/D-Link-TRENDnet-NCC-Service-Command-Injection.html 20150302 CVE-2015-1187: D-Link DIR-636L Remote Command Injection - Incorrect Authentication http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10052 72848 https://github.com/darkarnium/secpub/tree/master/Multivendor/ncc2 The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors. 20150429 CVE-ID 2015-1188: Swisscom DSL Router Centro Grande (ADB) Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive. openSUSE-SU-2016:0650 openSUSE-SU-2016:0662 [oss-security] 20150118 Re: CVE request: pigz, kgb, pax: directory traversal 72109 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774978 https://github.com/madler/pigz/commit/fdad1406b3ec809f4954ff7cdf9e99eb18c2458f Absolute path traversal vulnerability in kgb 1.0b4 allows remote attackers to write to arbitrary files via a full pathname in a crafted archive. [oss-security] 20150118 Re: CVE request: pigz, kgb, pax: directory traversal 72111 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774989 Multiple directory traversal vulnerabilities in pax 1:20140703 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive. [oss-security] 20150118 Re: CVE request: pigz, kgb, pax: directory traversal https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774716 pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive. [oss-security] 20150118 Re: CVE request: pigz, kgb, pax: directory traversal https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774716 The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493. [openstack-announce] 20150120 [OSSA 2015-002.1] Glance v2 API unrestricted path traversal through filesystem:// scheme (CVE-2015-1195) ERRATA 1 [oss-security] 20150115 [OSSA 2015-002] Glance v2 API unrestricted path traversal through filesystem:// scheme [oss-security] 20150118 Re: [OSSA 2015-002] Glance v2 API unrestricted path traversal through filesystem:// scheme http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 71976 https://bugs.launchpad.net/ossa/+bug/1408663 GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file. http://git.savannah.gnu.org/cgit/patch.git/commit/?id=4e9269a5fc1fe80a1095a92593dd85db871e1fd3 openSUSE-SU-2015:0199 [oss-security] 20150118 Re: CVE request: directory traversal flaw in patch http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html 72074 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775227 https://bugzilla.redhat.com/show_bug.cgi?id=1182154 gnupatch-unspecified-symlink(99967) cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. <a href="http://cwe.mitre.org/data/definitions/61.html">CWE-61: UNIX Symbolic Link (Symlink) Following</a> http://advisories.mageia.org/MGASA-2015-0080.html MDVSA-2015:066 [oss-security] 20150108 Directory traversals in cpio and friends? [oss-security] 20150118 Re: CVE Request: cpio -- directory traversal 71914 USN-2906-1 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774669 [Bug-cpio] 20150108 cpio: directory traversal vulnerability via symlinks Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5. [oss-security] 20150118 Re: CVE Request: ha -- directory traversals 72103 Directory traversal vulnerability in ppmd 10.1-5. [oss-security] 20150118 Re: CVE Request: ppmd -- directory traversals Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file, which allows local users to bypass the intended access restrictions. [oss-security] 20150118 Re: CVE Request: pxz -- race condition in setting permissions 72101 pxz-cve20151200-sec-bypass(100207) Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the wp-slim-view-2 page to wp-admin/admin.php. https://wordpress.org/plugins/wp-slimstat/changelog/ https://wpvulndb.com/vulnerabilities/7744 Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/01/stable-update.html APPLE-SA-2015-09-16-1 APPLE-SA-2015-09-16-3 openSUSE-SU-2015:0441 62383 GLSA-201502-13 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 72288 1031623 USN-2476-1 https://code.google.com/p/chromium/issues/detail?id=327070 https://code.google.com/p/chromium/issues/detail?id=334448 https://code.google.com/p/chromium/issues/detail?id=410030 https://code.google.com/p/chromium/issues/detail?id=411026 https://code.google.com/p/chromium/issues/detail?id=411156 https://code.google.com/p/chromium/issues/detail?id=413530 https://code.google.com/p/chromium/issues/detail?id=422765 https://code.google.com/p/chromium/issues/detail?id=423899 https://code.google.com/p/chromium/issues/detail?id=425040 https://code.google.com/p/chromium/issues/detail?id=425151 https://code.google.com/p/chromium/issues/detail?id=428828 https://code.google.com/p/chromium/issues/detail?id=429134 https://code.google.com/p/chromium/issues/detail?id=429139 https://code.google.com/p/chromium/issues/detail?id=431187 https://code.google.com/p/chromium/issues/detail?id=431603 https://code.google.com/p/chromium/issues/detail?id=432209 https://code.google.com/p/chromium/issues/detail?id=434723 https://code.google.com/p/chromium/issues/detail?id=435514 https://code.google.com/p/chromium/issues/detail?id=435815 https://code.google.com/p/chromium/issues/detail?id=437655 https://code.google.com/p/chromium/issues/detail?id=438363 https://code.google.com/p/chromium/issues/detail?id=439319 https://code.google.com/p/chromium/issues/detail?id=440572 https://code.google.com/p/chromium/issues/detail?id=440913 https://code.google.com/p/chromium/issues/detail?id=441834 https://code.google.com/p/chromium/issues/detail?id=443274 https://code.google.com/p/chromium/issues/detail?id=443333 https://code.google.com/p/chromium/issues/detail?id=446076 https://code.google.com/p/chromium/issues/detail?id=449894 https://support.apple.com/HT205212 https://support.apple.com/HT205221 Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service (unpaged memory write and process crash) via a crafted MP4 file. https://bugs.chromium.org/p/chromium/issues/detail?id=444522 https://bugs.chromium.org/p/chromium/issues/detail?id=453979 https://gist.github.com/bittorrent3389/8fee7cdaa73d1d351ee9 Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file. https://bugs.chromium.org/p/chromium/issues/detail?id=444539 https://gist.github.com/bittorrent3389/8fee7cdaa73d1d351ee9 [debian-lts-announce] 20190206 [SECURITY] [DLA 1654-1] libav security update Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file. http://git.videolan.org/?p=ffmpeg.git;a=commit;h=3ebd76a9c57558e284e94da367dd23b435e6a6d0 https://bugs.chromium.org/p/chromium/issues/detail?id=444546 https://github.com/FFmpeg/FFmpeg/blob/n2.4.6/Changelog Use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in core/editing/VisibleSelection.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper handling of a shadow-root anchor. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/02/chrome-for-android-update.html http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html openSUSE-SU-2015:0441 RHSA-2015:0163 62917 62925 GLSA-201502-13 72497 1031709 USN-2495-1 https://code.google.com/p/chromium/issues/detail?id=447906 google-chrome-cve20151209-code-exec(100715) https://src.chromium.org/viewvc/blink?revision=188788&view=revision The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. http://googlechromereleases.blogspot.com/2015/02/chrome-for-android-update.html http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html openSUSE-SU-2015:0441 RHSA-2015:0163 62917 62925 GLSA-201502-13 72497 1031709 USN-2495-1 https://code.google.com/p/chromium/issues/detail?id=453979 google-chrome-cve20151210-sec-bypass(100716) https://src.chromium.org/viewvc/blink?revision=189365&view=revision The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android does not properly restrict the URI scheme during a ServiceWorker registration, which allows remote attackers to gain privileges via a filesystem: URI. http://googlechromereleases.blogspot.com/2015/02/chrome-for-android-update.html http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html openSUSE-SU-2015:0441 RHSA-2015:0163 62917 62925 GLSA-201502-13 72497 1031709 USN-2495-1 https://code.google.com/p/chromium/issues/detail?id=453982 https://codereview.chromium.org/889323002 google-chrome-cve20151211-priv-esc(100717) Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android allow attackers to cause a denial of service or possibly have other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/02/chrome-for-android-update.html http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html openSUSE-SU-2015:0441 RHSA-2015:0163 62917 62925 GLSA-201502-13 72497 1031709 USN-2495-1 https://code.google.com/p/chromium/issues/detail?id=427303 https://code.google.com/p/chromium/issues/detail?id=438365 https://code.google.com/p/chromium/issues/detail?id=445679 https://code.google.com/p/chromium/issues/detail?id=446459 https://code.google.com/p/chromium/issues/detail?id=451684 https://code.google.com/p/chromium/issues/detail?id=451918 https://code.google.com/p/chromium/issues/detail?id=455225 google-chrome-cve20151212-unspecified(100718) The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=448423 GLSA-201503-12 https://skia.googlesource.com/skia/+/6af314724f51ad79a640844536c667bb83de5690 Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a large count value, leading to an out-of-bounds write operation. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=445810 GLSA-201503-12 https://skia.googlesource.com/skia/+/23d432080cb8506bf8e371b1637ce8f2de9c0c05 The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=445809 GLSA-201503-12 Use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in bindings/core/v8/custom/V8WindowCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a frame detachment. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=454954 GLSA-201503-12 https://src.chromium.org/viewvc/blink?revision=189574&view=revision The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion." http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=456192 https://codereview.chromium.org/910683002 https://codereview.chromium.org/958543002 GLSA-201503-12 https://src.chromium.org/viewvc/blink?revision=189796&view=revision Multiple use-after-free vulnerabilities in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger movement of a SCRIPT element to different documents, related to (1) the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp and (2) the SVGScriptElement::didMoveToNewDocument function in core/svg/SVGScriptElement.cpp. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=456059 GLSA-201503-12 https://src.chromium.org/viewvc/blink?revision=189886&view=revision Integer overflow in the SkMallocPixelRef::NewAllocate function in core/SkMallocPixelRef.cpp in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted allocation of a large amount of memory during WebGL rendering. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=446164 GLSA-201503-12 https://skia.googlesource.com/skia/+/2ff257bd95c732b9cebc3aac03fbed72d6e6082a Use-after-free vulnerability in the GIFImageReader::parseData function in platform/image-decoders/gif/GIFImageReader.cpp in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted frame size in a GIF image. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=437651 GLSA-201503-12 https://src.chromium.org/viewvc/blink?revision=188423&view=revision Use-after-free vulnerability in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread, related to the shutdown function in web/WebKit.cpp. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=455368 GLSA-201503-12 https://src.chromium.org/viewvc/blink?revision=190021&view=revision https://src.chromium.org/viewvc/blink?revision=190035&view=revision Multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap implementation in content/browser/service_worker/service_worker_script_cache_map.cc in Google Chrome before 41.0.2272.76 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a ServiceWorkerContextWrapper::DeleteAndStartOver call, related to the NotifyStartedCaching and NotifyFinishedCaching functions. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=448082 https://codereview.chromium.org/798883005 GLSA-201503-12 Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger extraneous change events, as demonstrated by events for invalid input or input to read-only fields, related to the initializeTypeInParsing and updateType functions. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://chromium.googlesource.com/chromium/blink.git/+/de1fee41e2c1bbfea7a564ad81e0b511a462fe0b https://code.google.com/p/chromium/issues/detail?id=454231 GLSA-201503-12 The VpxVideoDecoder::VpxDecode function in media/filters/vpx_video_decoder.cc in the vpxdecoder implementation in Google Chrome before 41.0.2272.76 does not ensure that alpha-plane dimensions are identical to image dimensions, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted VPx video data. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=449958 https://codereview.chromium.org/858303002 GLSA-201503-12 PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 https://code.google.com/p/chromium/issues/detail?id=446033 GLSA-201503-12 The DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 41.0.2272.76 does not properly restrict what URLs are available as debugger targets, which allows remote attackers to bypass intended access restrictions via a crafted extension. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 https://code.google.com/p/chromium/issues/detail?id=456841 https://codereview.chromium.org/910053002 GLSA-201503-12 The DragImage::create function in platform/DragImage.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not initialize memory for image drawing, which allows remote attackers to have an unspecified impact by triggering a failed image decoding, as demonstrated by an image for which the default orientation cannot be used. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=450389 GLSA-201503-12 https://src.chromium.org/viewvc/blink?revision=189585&view=revision https://src.chromium.org/viewvc/blink?revision=189816&view=revision The RenderCounter::updateCounter function in core/rendering/RenderCounter.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not force a relayout operation and consequently does not initialize memory for a data structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted Cascading Style Sheets (CSS) token sequence. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=444707 GLSA-201503-12 https://src.chromium.org/viewvc/blink?revision=188180&view=revision net/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 (aka Proxy Authentication Required) HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=431504 https://codereview.chromium.org/769043003 GLSA-201503-12 The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h in Blink, as used in Google Chrome before 41.0.2272.76, has a name conflict with the AudioContext class, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that adds an AudioContext event listener and triggers "type confusion." http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 72901 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=449610 GLSA-201503-12 https://src.chromium.org/viewvc/blink?revision=189006&view=revision Multiple unspecified vulnerabilities in Google Chrome before 41.0.2272.76 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html RHSA-2015:0627 USN-2521-1 https://code.google.com/p/chromium/issues/detail?id=383777 https://code.google.com/p/chromium/issues/detail?id=404300 https://code.google.com/p/chromium/issues/detail?id=406871 https://code.google.com/p/chromium/issues/detail?id=421499 https://code.google.com/p/chromium/issues/detail?id=426762 https://code.google.com/p/chromium/issues/detail?id=429379 https://code.google.com/p/chromium/issues/detail?id=429679 https://code.google.com/p/chromium/issues/detail?id=433078 https://code.google.com/p/chromium/issues/detail?id=437636 https://code.google.com/p/chromium/issues/detail?id=438364 https://code.google.com/p/chromium/issues/detail?id=438638 https://code.google.com/p/chromium/issues/detail?id=439877 https://code.google.com/p/chromium/issues/detail?id=442756 https://code.google.com/p/chromium/issues/detail?id=445831 https://code.google.com/p/chromium/issues/detail?id=448056 https://code.google.com/p/chromium/issues/detail?id=449045 https://code.google.com/p/chromium/issues/detail?id=449049 https://code.google.com/p/chromium/issues/detail?id=449610 https://code.google.com/p/chromium/issues/detail?id=449777 https://code.google.com/p/chromium/issues/detail?id=450653 https://code.google.com/p/chromium/issues/detail?id=450654 https://code.google.com/p/chromium/issues/detail?id=451685 https://code.google.com/p/chromium/issues/detail?id=451753 https://code.google.com/p/chromium/issues/detail?id=451755 https://code.google.com/p/chromium/issues/detail?id=452324 https://code.google.com/p/chromium/issues/detail?id=452455 https://code.google.com/p/chromium/issues/detail?id=453126 https://code.google.com/p/chromium/issues/detail?id=453994 https://code.google.com/p/chromium/issues/detail?id=459115 https://code.google.com/p/chromium/issues/detail?id=460145 https://code.google.com/p/chromium/issues/detail?id=463349 GLSA-201503-12 Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation, a different vulnerability than CVE-2015-1212. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html https://code.google.com/p/chromium/issues/detail?id=456516 https://codereview.chromium.org/907793002 GLSA-201503-12 Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update.html openSUSE-SU-2015:0682 openSUSE-SU-2015:1887 RHSA-2015:0778 73484 1032012 USN-2556-1 https://code.google.com/p/chromium/issues/detail?id=469058 GLSA-201506-04 Race condition in gpu/command_buffer/service/gles2_cmd_decoder.cc in Google Chrome before 41.0.2272.118 allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact by manipulating OpenGL ES commands. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update.html openSUSE-SU-2015:0682 openSUSE-SU-2015:1887 RHSA-2015:0778 73486 1032012 USN-2556-1 https://code.google.com/p/chromium/issues/detail?id=468936 https://codereview.chromium.org/1016193003 GLSA-201506-04 The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 USN-2570-1 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=456518 GLSA-201506-04 https://src.chromium.org/viewvc/blink?revision=190980&view=revision The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 USN-2570-1 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=313939 GLSA-201506-04 https://src.chromium.org/viewvc/blink?revision=189527&view=revision Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 USN-2570-1 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=461191 https://codereview.chromium.org/1007123003 GLSA-201506-04 Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 USN-2570-1 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=445808 GLSA-201506-04 Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF. https://bugs.chromium.org/p/chromium/issues/detail?id=430891 https://bugs.chromium.org/p/chromium/issues/detail?id=457493 [debian-lts-announce] 20180719 [SECURITY] [DLA 1433-1] openjpeg2 security update gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 USN-2570-1 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=463599 https://codereview.chromium.org/978193003 GLSA-201506-04 Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 USN-2570-1 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=418402 https://codereview.chromium.org/628763003 https://codereview.chromium.org/660663002 https://codereview.chromium.org/717573004 https://codereview.chromium.org/868123002 GLSA-201506-04 The ReduceTransitionElementsKind function in hydrogen-check-elimination.cc in Google V8 before 4.2.77.8, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that leverages "type confusion" in the check-elimination optimization. <a href="https://cwe.mitre.org/data/definitions/843.html">CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')</a> http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 USN-2570-1 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=460917 https://codereview.chromium.org/1000893003 https://codereview.chromium.org/1019033004 GLSA-201506-04 Use-after-free vulnerability in the MutationObserver::disconnect function in core/dom/MutationObserver.cpp in the DOM implementation in Blink, as used in Google Chrome before 42.0.2311.135, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an attempt to unregister a MutationObserver object that is not currently registered. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_28.html openSUSE-SU-2015:0853 RHSA-2015:0921 DSA-3242 74389 1032234 USN-2582-1 https://code.google.com/p/chromium/issues/detail?id=453279 GLSA-201506-04 https://src.chromium.org/viewvc/blink?revision=192655&view=revision The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 USN-2570-1 DSA-3238 1032209 https://chromium.googlesource.com/chromium/src/net/+/2359906c4fdfa9d44b045755d23fe5327c10e010 https://code.google.com/p/chromium/issues/detail?id=455215 GLSA-201506-04 Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=444957 https://codereview.chromium.org/831283002 GLSA-201506-04 Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 USN-2570-1 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=437399 GLSA-201506-04 The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive information from local files via a crafted (1) http or (2) https web site. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=429838 https://codereview.chromium.org/917313004 GLSA-201506-04 The FileSystem API in Google Chrome before 40.0.2214.91 allows remote attackers to bypass the SafeBrowsing for Executable Files protection mechanism by creating a .exe file in a temporary filesystem and then referencing this file with a filesystem:http: URL. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=380663 GLSA-201506-04 Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.90 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html openSUSE-SU-2015:0748 openSUSE-SU-2015:1887 RHSA-2015:0816 USN-2570-1 DSA-3238 1032209 https://code.google.com/p/chromium/issues/detail?id=389595 https://code.google.com/p/chromium/issues/detail?id=400339 https://code.google.com/p/chromium/issues/detail?id=403665 https://code.google.com/p/chromium/issues/detail?id=424957 https://code.google.com/p/chromium/issues/detail?id=430533 https://code.google.com/p/chromium/issues/detail?id=436564 https://code.google.com/p/chromium/issues/detail?id=439992 https://code.google.com/p/chromium/issues/detail?id=442670 https://code.google.com/p/chromium/issues/detail?id=444198 https://code.google.com/p/chromium/issues/detail?id=445305 https://code.google.com/p/chromium/issues/detail?id=447889 https://code.google.com/p/chromium/issues/detail?id=448299 https://code.google.com/p/chromium/issues/detail?id=451058 https://code.google.com/p/chromium/issues/detail?id=451059 https://code.google.com/p/chromium/issues/detail?id=452794 https://code.google.com/p/chromium/issues/detail?id=456636 https://code.google.com/p/chromium/issues/detail?id=458776 https://code.google.com/p/chromium/issues/detail?id=458870 https://code.google.com/p/chromium/issues/detail?id=460939 https://code.google.com/p/chromium/issues/detail?id=462319 https://code.google.com/p/chromium/issues/detail?id=464594 https://code.google.com/p/chromium/issues/detail?id=465586 https://code.google.com/p/chromium/issues/detail?id=469082 https://code.google.com/p/chromium/issues/detail?id=469756 https://code.google.com/p/chromium/issues/detail?id=474254 https://code.google.com/p/chromium/issues/detail?id=476786 Multiple unspecified vulnerabilities in Google Chrome before 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_28.html openSUSE-SU-2015:0853 RHSA-2015:0921 DSA-3242 74389 1032234 USN-2582-1 https://code.google.com/p/chromium/issues/detail?id=453553 https://code.google.com/p/chromium/issues/detail?id=458191 https://code.google.com/p/chromium/issues/detail?id=473688 https://code.google.com/p/chromium/issues/detail?id=475749 https://code.google.com/p/chromium/issues/detail?id=481777 GLSA-201506-04 Use-after-free vulnerability in the SpeechRecognitionClient implementation in the Speech subsystem in Google Chrome before 43.0.2357.65 allows remote attackers to execute arbitrary code via a crafted document. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://blog.skylined.nl/20161123001.html http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 20161125 CVE-2015-1251: Chrome blink Speech&#194;&#38;shy;Recognition&#194;&#38;shy;Controller use-after-free details DSA-3267 20161123 CVE-2015-1251: Chrome blink Speech&Acirc;-Recognition&Acirc;-Controller use-after-free details 74723 1032375 http://zerodayinitiative.com/advisories/ZDI-15-236/ https://code.google.com/p/chromium/issues/detail?id=481015 GLSA-201506-04 common/partial_circular_buffer.cc in Google Chrome before 43.0.2357.65 does not properly handle wraps, which allows remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data, related to the PartialCircularBuffer::Write and PartialCircularBuffer::DoWrite functions. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=474029 https://codereview.chromium.org/1061053002 GLSA-201506-04 core/html/parser/HTMLConstructionSite.cpp in the DOM implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element, related to the insert and executeReparentTask functions. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=464552 GLSA-201506-04 https://src.chromium.org/viewvc/blink?revision=191807&view=revision core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=444927 GLSA-201506-04 https://src.chromium.org/viewvc/blink?revision=192658&view=revision Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=473253 https://codereview.chromium.org/1071063005 GLSA-201506-04 Use-after-free vulnerability in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document that leverages improper handling of a shadow tree for a use element. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=478549 https://codereview.chromium.org/1098913004 GLSA-201506-04 https://src.chromium.org/viewvc/blink?revision=194421&view=revision platform/graphics/filters/FEColorMatrix.cpp in the SVG implementation in Blink, as used in Google Chrome before 43.0.2357.65, does not properly handle an insufficient number of values in an feColorMatrix filter, which allows remote attackers to cause a denial of service (container overflow) or possibly have unspecified other impact via a crafted document. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=468519 GLSA-201506-04 https://src.chromium.org/viewvc/blink?view=rev&revision=193571 https://src.chromium.org/viewvc/blink?view=rev&revision=193911 Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html FEDORA-2015-15935 FEDORA-2015-15934 FEDORA-2015-15936 openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=450939 https://codereview.chromium.org/1106303002 GLSA-201506-04 PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=468167 GLSA-201506-04 Multiple use-after-free vulnerabilities in content/renderer/media/user_media_client_impl.cc in the WebRTC implementation in Google Chrome before 43.0.2357.65 allow remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that executes upon completion of a getUserMedia request. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=474370 https://codereview.chromium.org/1075833002 GLSA-201506-04 android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=466351 https://codereview.chromium.org/1011383005 https://codereview.chromium.org/1056743002 https://codereview.chromium.org/1077483002 platform/fonts/shaping/HarfBuzzShaper.cpp in Blink, as used in Google Chrome before 43.0.2357.65, does not initialize a certain width field, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=476647 GLSA-201506-04 https://src.chromium.org/viewvc/blink?revision=194541&view=revision The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=479162 https://codereview.chromium.org/1056103005 GLSA-201506-04 Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74723 1032375 https://code.google.com/p/chromium/issues/detail?id=481015 GLSA-201506-04 Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html openSUSE-SU-2015:0969 openSUSE-SU-2015:1877 DSA-3267 74727 1032375 https://code.google.com/p/chromium/issues/detail?id=413534 https://code.google.com/p/chromium/issues/detail?id=445741 https://code.google.com/p/chromium/issues/detail?id=448057 https://code.google.com/p/chromium/issues/detail?id=454157 https://code.google.com/p/chromium/issues/detail?id=458026 https://code.google.com/p/chromium/issues/detail?id=464642 https://code.google.com/p/chromium/issues/detail?id=464792 https://code.google.com/p/chromium/issues/detail?id=465426 https://code.google.com/p/chromium/issues/detail?id=467372 https://code.google.com/p/chromium/issues/detail?id=467644 https://code.google.com/p/chromium/issues/detail?id=474784 https://code.google.com/p/chromium/issues/detail?id=475070 https://code.google.com/p/chromium/issues/detail?id=476107 https://code.google.com/p/chromium/issues/detail?id=484270 https://code.google.com/p/chromium/issues/detail?id=485412 https://code.google.com/p/chromium/issues/detail?id=485419 https://code.google.com/p/chromium/issues/detail?id=489518 GLSA-201506-04 37766 content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests. http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html openSUSE-SU-2015:1146 openSUSE-SU-2015:1872 RHSA-2015:1188 DSA-3315 75333 1032731 USN-2652-1 https://code.google.com/p/chromium/issues/detail?id=464922 https://codereview.chromium.org/1129123004/ GLSA-201507-18 Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, and WebDOMFileSystem.cpp. http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html openSUSE-SU-2015:1146 openSUSE-SU-2015:1872 RHSA-2015:1188 DSA-3315 75334 1032731 USN-2652-1 https://code.google.com/p/chromium/issues/detail?id=497507 https://codereview.chromium.org/1174343003/ GLSA-201507-18 https://src.chromium.org/viewvc/blink?revision=196755&view=revision bindings/scripts/v8_types.py in Blink, as used in Google Chrome before 43.0.2357.130, does not properly select a creation context for a return value's DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code, as demonstrated by use of a data: URL. http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html openSUSE-SU-2015:1146 openSUSE-SU-2015:1872 RHSA-2015:1188 DSA-3315 75332 1032731 USN-2652-1 https://code.google.com/p/chromium/issues/detail?id=494640 GLSA-201507-18 https://src.chromium.org/viewvc/blink?revision=196373&view=revision The DecodeHSTSPreloadRaw function in net/http/transport_security_state.cc in Google Chrome before 43.0.2357.130 does not properly canonicalize DNS hostnames before making comparisons to HSTS or HPKP preload entries, which allows remote attackers to bypass intended access restrictions via a string that (1) ends in a . (dot) character or (2) is not entirely lowercase. http://googlechromereleases.blogspot.com/2015/06/chrome-stable-update.html openSUSE-SU-2015:1146 openSUSE-SU-2015:1872 RHSA-2015:1188 DSA-3315 75336 1032731 USN-2652-1 https://code.google.com/p/chromium/issues/detail?id=461481 https://codereview.chromium.org/1149753002 GLSA-201507-18 The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 DSA-3360 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75973 1033031 USN-2740-1 https://chromium.googlesource.com/chromium/deps/icu/+/f1ad7f9ba957571dc692ea3e187612c685615e19 https://code.google.com/p/chromium/issues/detail?id=444573 https://codereview.chromium.org/1157143002/ GLSA-201603-09 PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=446032 https://codereview.chromium.org/1226403008 GLSA-201603-09 Use-after-free vulnerability in the GPU process implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the continued availability of a GPUChannelHost data structure during Blink shutdown, related to content/browser/gpu/browser_gpu_channel_host_factory.cc and content/renderer/render_thread_impl.cc. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=451456 https://codereview.chromium.org/1128233004/ https://codereview.chromium.org/867553003/ GLSA-201603-09 Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in PDFium in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid JPEG2000 data in a PDF document. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=459215 https://pdfium.googlesource.com/pdfium/+/cddfde0cddbc8467e0d5fa04c30405ee257750fc GLSA-201603-09 Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous "Always open files of this type" choice, related to download_commands.cc and download_prefs.cc. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=461858 https://codereview.chromium.org/1165893004/ GLSA-201603-09 Cross-site scripting (XSS) vulnerability in org/chromium/chrome/browser/UrlUtilities.java in Google Chrome before 44.0.2403.89 on Android allows remote attackers to inject arbitrary web script or HTML via a crafted intent: URL, as demonstrated by a trailing alert(document.cookie);// substring, aka "Universal XSS (UXSS)." http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=462843 https://codereview.chromium.org/1059413004/ GLSA-201603-09 Use-after-free vulnerability in content/browser/indexed_db/indexed_db_backing_store.cc in the IndexedDB implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an abort action before a certain write operation. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=472614 https://codereview.chromium.org/1060613002/ GLSA-201603-09 Use-after-free vulnerability in the accessibility implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=479743 https://codereview.chromium.org/1144363004/ https://codereview.chromium.org/1151393006/ GLSA-201603-09 content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=482380 https://codereview.chromium.org/1150843002/ https://codereview.chromium.org/1156663004/ GLSA-201603-09 Integer overflow in the CJBig2_Image::expand function in fxcodec/jbig2/JBig2_Image.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via large height and stride values. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=483981 https://codereview.chromium.org/1237723002 https://codereview.chromium.org/1241493002 GLSA-201603-09 SkPictureShader.cpp in Skia, as used in Google Chrome before 44.0.2403.89, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging access to a renderer process and providing crafted serialized data. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=486947 https://codereview.chromium.org/1151663002 GLSA-201603-09 core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=487155 GLSA-201603-09 https://src.chromium.org/viewvc/blink?revision=196071&view=revision Multiple use-after-free vulnerabilities in fpdfsdk/src/javascript/Document.cpp in PDFium, as used in Google Chrome before 44.0.2403.89, allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted PDF document, related to the (1) Document::delay and (2) Document::DoFieldDelay functions. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=487928 https://pdfium.googlesource.com/pdfium/+/4ff7a4246c81a71b4f878e959b3ca304cd76ec8a GLSA-201603-09 Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 openSUSE-SU-2016:1441 SUSE-SU-2016:1508 SUSE-SU-2016:1512 openSUSE-SU-2016:1523 RHSA-2015:1499 DSA-3315 DSA-3318 http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html 75973 1033031 USN-2726-1 https://code.google.com/p/chromium/issues/detail?id=492052 https://codereview.chromium.org/1224303003 GLSA-201603-09 GLSA-201701-21 https://source.android.com/security/bulletin/2016-11-01.html https://www.tenable.com/security/tns-2016-20 The LocalFrame::isURLAllowed function in core/frame/LocalFrame.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly check for a page's maximum number of frames, which allows remote attackers to cause a denial of service (invalid count value and use-after-free) or possibly have unspecified other impact via crafted JavaScript code that makes many createElement calls for IFRAME elements. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=493243 GLSA-201603-09 https://src.chromium.org/viewvc/blink?revision=197139&view=revision The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=498982 GLSA-201603-09 https://src.chromium.org/viewvc/blink?revision=196971&view=revision Cross-site scripting (XSS) vulnerability in the V8ContextNativeHandler::GetModuleSystem function in extensions/renderer/v8_context_native_handler.cc in Google Chrome before 44.0.2403.89 allows remote attackers to inject arbitrary web script or HTML by leveraging the lack of a certain V8 context restriction, aka a Blink "Universal XSS (UXSS)." http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=504011 https://codereview.chromium.org/1231803002/ https://codereview.chromium.org/1235863003/ GLSA-201603-09 Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=419383 GLSA-201603-09 https://src.chromium.org/viewvc/blink?revision=195266&view=revision The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related issue to CVE-2015-1263. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=479162 https://codereview.chromium.org/1056103005 GLSA-201603-09 Multiple unspecified vulnerabilities in Google Chrome before 44.0.2403.89 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:1287 RHSA-2015:1499 DSA-3315 75973 1033031 https://code.google.com/p/chromium/issues/detail?id=512110 https://crbug.com/398235 https://crbug.com/401995 https://crbug.com/404462 https://crbug.com/458024 https://crbug.com/459898 https://crbug.com/460938 https://crbug.com/471990 https://crbug.com/477713 https://crbug.com/478575 https://crbug.com/484432 https://crbug.com/485855 https://crbug.com/486004 https://crbug.com/487286 https://crbug.com/491216 https://crbug.com/492448 https://crbug.com/492981 https://crbug.com/495682 https://crbug.com/504692 https://crbug.com/506749 https://crbug.com/507821 GLSA-201603-09 The Google V8 engine, as used in Google Chrome before 44.0.2403.89 and QtWebEngineCore in Qt before 5.5.1, allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted web site. http://code.qt.io/cgit/qt/qtwebengine.git/tree/dist/changes-5.5.1 http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html openSUSE-SU-2015:2368 http://www.nsfocus.net/index.php?act=advisory&do=view&adv_id=80 https://bugs.chromium.org/p/chromium/issues/detail?id=505374 https://codereview.chromium.org/1233453004 The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not check whether a node is expected, which allows remote attackers to bypass the Same Origin Policy or cause a denial of service (DOM tree corruption) via a web site with crafted JavaScript code and IFRAME elements. http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=516377 GLSA-201603-09 https://src.chromium.org/viewvc/blink?revision=200098&view=revision The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker. http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=522791 https://codereview.chromium.org/1307883002/ GLSA-201603-09 https://src.chromium.org/viewvc/blink?revision=201055&view=revision The DOM implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors. http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=524074 GLSA-201603-09 Use-after-free vulnerability in the SkMatrix::invertNonIdentity function in core/SkMatrix.cpp in Skia, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering the use of matrix elements that lead to an infinite result during an inversion calculation. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=492263 https://codereview.chromium.org/1188433011/ GLSA-201603-09 Multiple use-after-free vulnerabilities in the PrintWebViewHelper class in components/printing/renderer/print_web_view_helper.cc in Google Chrome before 45.0.2454.85 allow user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact by triggering nested IPC messages during preparation for printing, as demonstrated by messages associated with PDF documents in conjunction with messages about printer capabilities. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=502562 https://codereview.chromium.org/1228693002/ GLSA-201603-09 The UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc in Google Chrome before 45.0.2454.85 does not prevent display of Unicode LOCK characters in the omnibox, which makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages. http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=421332 https://codereview.chromium.org/1180393003/ https://codereview.chromium.org/1189553002/ GLSA-201603-09 The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google Chrome before 45.0.2454.85 does not properly consider a request's source before accepting the request, which allows remote attackers to bypass intended access restrictions via a crafted (1) app or (2) extension. http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=510802 https://codereview.chromium.org/1267183003/ GLSA-201603-09 The RuntimeEventRouter::OnExtensionUninstalled function in extensions/browser/api/runtime/runtime_api.cc in Google Chrome before 45.0.2454.85 does not ensure that the setUninstallURL preference corresponds to the URL of a web site, which allows user-assisted remote attackers to trigger access to an arbitrary URL via a crafted extension that is uninstalled. http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=518827 https://codereview.chromium.org/1282263002/ GLSA-201603-09 Use-after-free vulnerability in the shared-timer implementation in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging erroneous timer firing, related to ThreadTimers.cpp and Timer.cpp. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=416362 https://codereview.chromium.org/1153763005/ https://codereview.chromium.org/956333002/ https://codereview.chromium.org/959263002/ GLSA-201603-09 The FrameFetchContext::updateTimingInfoForIFrameNavigation function in core/loader/FrameFetchContext.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to obtain sensitive information via crafted JavaScript code that leverages a history.back call. http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=511616 https://github.com/w3c/resource-timing/issues/29 GLSA-201603-09 https://src.chromium.org/viewvc/blink?revision=199553&view=revision Multiple unspecified vulnerabilities in Google Chrome before 45.0.2454.85 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/09/stable-channel-update.html openSUSE-SU-2015:1586 openSUSE-SU-2015:1873 RHSA-2015:1712 DSA-3351 1033472 https://code.google.com/p/chromium/issues/detail?id=413706 https://code.google.com/p/chromium/issues/detail?id=482369 https://code.google.com/p/chromium/issues/detail?id=485413 https://code.google.com/p/chromium/issues/detail?id=498338 https://code.google.com/p/chromium/issues/detail?id=498475 https://code.google.com/p/chromium/issues/detail?id=502794 https://code.google.com/p/chromium/issues/detail?id=507018 https://code.google.com/p/chromium/issues/detail?id=508703 https://code.google.com/p/chromium/issues/detail?id=508705 https://code.google.com/p/chromium/issues/detail?id=517364 https://code.google.com/p/chromium/issues/detail?id=517906 https://code.google.com/p/chromium/issues/detail?id=526825 The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc. http://googlechromereleases.blogspot.com/2015/11/stable-channel-update.html openSUSE-SU-2015:2068 openSUSE-SU-2015:2069 RHSA-2015:1841 DSA-3415 77537 1034132 https://code.google.com/p/chromium/issues/detail?id=520422 https://codereview.chromium.org/1316803003 GLSA-201603-09 bindings/core/v8/V8DOMWrapper.h in Blink, as used in Google Chrome before 45.0.2454.101, does not perform a rethrow action to propagate information about a cross-context exception, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document containing an IFRAME element. http://googlechromereleases.blogspot.com/2015/09/stable-channel-update_24.html openSUSE-SU-2015:1719 openSUSE-SU-2015:1876 RHSA-2015:1841 DSA-3376 76844 1033683 USN-2757-1 https://code.google.com/p/chromium/issues/detail?id=530301 https://codereview.chromium.org/1339023002 GLSA-201603-09 object-observe.js in Google V8, as used in Google Chrome before 45.0.2454.101, does not properly restrict method calls on access-checked objects, which allows remote attackers to bypass the Same Origin Policy via a (1) observe or (2) getNotifier call. http://googlechromereleases.blogspot.com/2015/09/stable-channel-update_24.html openSUSE-SU-2015:1719 openSUSE-SU-2015:1876 RHSA-2015:1841 DSA-3376 76844 1033683 USN-2757-1 https://chromium.googlesource.com/v8/v8/+/9b0fb52b57021473aa813f3fb99ad7384a8b86f1 https://code.google.com/p/chromium/issues/detail?id=531891 GLSA-201603-09 McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted (1) 0x00224014 or (2) 0x0022c018 IOCTL call. http://packetstormsecurity.com/files/130177/McAfee-Data-Loss-Prevention-Endpoint-Privilege-Escalation.html 35953 http://www.greyhathacker.net/?p=818 mcafee-dlp-cve20151305-priv-esc(100602) https://kc.mcafee.com/corporate/index?page=content&id=SB10097 The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors. http://advisories.mageia.org/MGASA-2015-0085.html DSA-3134 MDVSA-2015:051 [oss-security] 20150120 Possible CVE request: sympa: vulnerability in the web interface 72277 https://www.sympa.org/security_advisories plasma-workspace before 5.1.95 allows remote attackers to obtain passwords via a Trojan horse Look and Feel package. [oss-security] 20150122 Re: KDE Plasma vulnerabilities: need CVE 72285 https://www.kde.org/info/security/advisory-20150122-1.txt kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked. [oss-security] 20150122 Re: KDE Plasma vulnerabilities: need CVE 72284 https://www.kde.org/info/security/advisory-20150122-2.txt XML external entity vulnerability in the Extended Computer Aided Test Tool (eCATT) in SAP NetWeaver AS ABAP 7.31 and earlier allows remote attackers to access arbitrary files via a crafted XML request, related to ECATT_DISPLAY_XMLSTRING_REMOTE, aka SAP Note 2016638. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> https://erpscan.io/advisories/erpscan-15-001-sap-netweaver-ecatt_display_xmlstring_remote-xxe/ https://erpscan.io/press-center/blog/sap-critical-patch-update-january-2015/ SQL injection vulnerability in SAP Adaptive Server Enterprise (Sybase ASE) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Note 2113333. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. https://erpscan.io/press-center/blog/sap-critical-patch-update-january-2015/ The Extended Application Services (XS) in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors, aka SAP Note 2098906. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. https://erpscan.io/press-center/blog/sap-critical-patch-update-january-2015/ The Dealer Portal in SAP ERP does not properly restrict access, which allows remote attackers to obtain sensitive information, gain privileges, and possibly have other unspecified impact via unknown vectors, aka SAP Note 2000401. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. https://erpscan.io/press-center/blog/sap-critical-patch-update-january-2015/ The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances. http://dnlongen.blogspot.com/2015/01/usaa-mobile-app-gives-away-your-account.html http://packetstormsecurity.com/files/130067/USAA-Mobile-App-Information-Disclosure.html 20150122 USAA mobile app gives away personal data; fix released Buffer overflow in the charset_to_intern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string, as demonstrated by converting a string from CP866 to UTF-8. http://www.conostix.com/pub/adv/CVE-2015-1315-Info-ZIP-unzip-Out-of-bounds_Write.txt [oss-security] 20150217 CVE-2015-1315 - Info-ZIP UnZip - Out-of-bounds Write USN-2502-1 https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/580961/comments/120 Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key. http://bazaar.launchpad.net/~juju-core/juju-core/trunk/revision/4119 Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code by deleting all WebContents while a RenderProcessHost instance still exists. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> USN-2556-1 https://bugs.launchpad.net/oxide/+bug/1431484 The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container). USN-2569-1 https://bugs.launchpad.net/ubuntu/%2Bsource/apport/%2Bbug/1438758 https://launchpad.net/apport/trunk/2.17.1 36782 43971 The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows physically proximate attackers to mount removable media while the screen is locked as demonstrated by inserting a USB thumb drive. USN-2741-1 https://bugs.launchpad.net/ubuntu/%2Bsource/unity/%2Bbug/1438870 The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versions prior to 1.9.2. https://launchpad.net/maas/+milestone/1.9.2 Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> USN-2570-1 Directory traversal vulnerability in the Ubuntu network-manager package for Ubuntu (vivid) before 0.9.10.0-4ubuntu15.1, Ubuntu 14.10 before 0.9.8.8-0ubuntu28.1, and Ubuntu 14.04 LTS before 0.9.8.8-0ubuntu7.1 allows local users to change the modem device configuration or read arbitrary files via a .. (dot dot) in the file name in a request to read modem device contexts (com.canonical.NMOfono.ReadImsiContexts). USN-2581-1 https://bugs.launchpad.net/ubuntu/%2Bsource/network-manager/%2Bbug/1449245 The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 as packaged in Ubuntu 15.04, before 1.1.1+bzr980-0ubuntu1.1 as packaged in Ubuntu 14.10, before 1.1.1-1ubuntu5.2 as packaged in Ubuntu 14.04 LTS, before 0.43+bzr805-0ubuntu10 as packaged in Ubuntu 12.04 LTS allows local users to obtain sensitive information, or access files with root permissions. 75221 USN-2648-1 Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges by leveraging incorrect handling of permissions when generating core dumps for setuid binaries. 74767 USN-2609-1 https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1452239 Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges. [oss-security] 20150521 CVE-2015-1325 apport race conditions / ubuntu local root 74769 USN-2609-1 37088 python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file. https://github.com/martinpitt/python-dbusmock/commit/4e7d0df9093 Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app. https://bazaar.launchpad.net/~phablet-team/content-hub/trunk/revision/212 The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration in which overlayfs is permitted in an arbitrary mount namespace. [oss-security] 20150616 CVE-2015-1328: incorrect permission checks in overlayfs, ubuntu local root 40688 75206 https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html https://security-tracker.debian.org/tracker/CVE-2015-1328 37292 Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code. http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1329.html 76174 USN-2677-1 unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vectors. http://metadata.ftp-master.debian.org/changelogs//main/u/unattended-upgrades/unattended-upgrades_0.86.1_changelog DSA-3297 1032738 USN-2657-1 lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*. openSUSE-SU-2019:1481 openSUSE-SU-2015:1315 DSA-3317 75999 USN-2675-1 https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1470842 https://github.com/lxc/lxc/commit/72cf81f6a3404e35028567db2c99a90406e9c6e6 https://service.ait.ac.at/security/2015/LxcSecurityAnalysis.html The oxide::JavaScriptDialogManager function in oxide-qt before 1.9.1 as packaged in Ubuntu 15.04 and Ubuntu 14.04 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a crafted website. http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1332.html 76710 USN-2735-1 https://launchpad.net/ubuntu/+source/oxide-qt/1.9.1-0ubuntu0.15.04.1 Memory leak in the __key_link_end function in security/keys/keyring.c in the Linux kernel before 4.1.4 allows local users to cause a denial of service (memory consumption) via many add_key system calls that refer to existing keys. http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 RHSA-2015:1778 RHSA-2015:1787 DSA-3329 http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4 [oss-security] 20150727 Security issue in Linux Kernel Keyring (CVE-2015-1333) http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 76050 USN-2687-1 USN-2688-1 USN-2689-1 USN-2690-1 USN-2691-1 https://bugzilla.redhat.com/show_bug.cgi?id=1245658 https://github.com/torvalds/linux/commit/ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 https://support.f5.com/csp/article/K05211147 attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape AppArmor or SELinux confinement by mounting a proc filesystem with a crafted (1) AppArmor profile or (2) SELinux label. openSUSE-SU-2019:1481 openSUSE-SU-2015:1315 openSUSE-SU-2015:1317 DSA-3317 75998 USN-2675-1 https://github.com/lxc/lxc/commit/5c3fcae78b63ac9dd56e36075903921bd9461f9e https://service.ait.ac.at/security/2015/LxcSecurityAnalysis.html lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source. FEDORA-2015-9f8f4b182a FEDORA-2015-211974138f FEDORA-2015-ebfe46536f openSUSE-SU-2019:1481 openSUSE-SU-2015:1717 DSA-3400 [oss-security] 20150929 Security issue in LXC (CVE-2015-1335) http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 76894 USN-2753-1 https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1476662 https://github.com/lxc/lxc/commit/592fd47a6245508b79fe6ac819fe6d3b2c1289be [lxc-devel] 20150929 LXC security issue - affects all supported releases The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use. http://packetstormsecurity.com/files/140759/Man-db-2.6.7.1-Privilege-Escalation.html http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1336.html http://www.halfdog.net/Security/2015/MandbSymlinkLocalRootPrivilegeEscalation/ [oss-security] 20151214 Re: User man Local Root Exploit/Linux Kernel setgid Directory Privilege Escalation/PAM Owner Check Weakness 79723 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840357 https://bugs.launchpad.net/ubuntu/+source/man-db/+bug/1482786 GLSA-201707-12 Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response. USN-2746-1 USN-2746-2 https://bugs.launchpad.net/ubuntu/%2Bsource/simplestreams/%2Bbug/1487004 kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log. http://packetstormsecurity.com/files/133723/Ubuntu-Apport-kernel_crashdump-Symlink.html 20150927 Apport kernel_crashdump symlink vulnerability exploitation http://www.halfdog.net/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities/ USN-2744-1 https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1492570 https://launchpad.net/apport/trunk/2.19 38353 Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact by opening /dev/cuse many times. http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2c5816b4beccc8ba709144539f6fdd764f8fa49c openSUSE-SU-2016:1008 SUSE-SU-2016:1707 [oss-security] 20160302 CVE-2015-1339: Linux Kernel: memory exhaustion via CUSE driver https://bugzilla.novell.com/show_bug.cgi?id=969356 https://bugzilla.redhat.com/show_bug.cgi?id=1314331 https://github.com/torvalds/linux/commit/2c5816b4beccc8ba709144539f6fdd764f8fa49c https://security-tracker.debian.org/tracker/CVE-2015-1339 LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice. https://github.com/lxc/lxd/commit/19c6961cc1012c8a529f20807328a9357f5034f4 Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path. https://launchpad.net/apport/trunk/2.19.2 https://usn.ubuntu.com/2782-1/ LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updating a cgroup. USN-2813-1 https://bugs.launchpad.net/ubuntu/+source/lxcfs/+bug/1508481 https://github.com/lxc/lxcfs/commit/a8b6c3e0537e90fba3c55910fd1b7229d54a60a7 All versions of unity-scope-gdrive logs search terms to syslog. https://bugs.launchpad.net/ubuntu/+source/unity-scope-gdrive/+bug/1509076 The do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges by writing a pid to the tasks file. USN-2813-1 https://bugs.launchpad.net/ubuntu/+source/lxcfs/+bug/1512854 https://github.com/lxc/lxcfs/commit/8ee2a503e102b1a43ec4d83113dc275ab20a869a The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option. http://debbugs.gnu.org/cgi/bugreport.cgi?bug=19563 http://git.savannah.gnu.org/cgit/grep.git/commit/?id=83a95bd8c8561875b948cadd417c653dbe7ef2e2 openSUSE-SU-2015:0243 RHSA-2015:1447 [oss-security] 20150122 Re: CVE request: grep heap buffer overrun http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 72281 Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/01/stable-update.html RHSA-2015:0093 62383 GLSA-201502-13 1031623 USN-2476-1 google-v8-cve20151346-code-exec(100361) Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter. https://github.com/osTicket/osTicket-1.8/commit/b38b3ca7235002137cc9ff74b3c24a4a78c9c2d1 https://github.com/osTicket/osTicket-1.8/releases/tag/v1.9.5.1 Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a denial of service (crash or reset to factory default) via a malformed frame to the wireless interface. http://www.arubanetworks.com/support/alerts/aruba-psa-2015-001.txt named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit, or daemon crash) by triggering an incorrect trust-anchor management scenario in which no key is ready for use. http://advisories.mageia.org/MGASA-2015-0082.html APPLE-SA-2015-09-16-4 FEDORA-2015-2543 FEDORA-2015-2548 SUSE-SU-2015:1205 openSUSE-SU-2015:1326 openSUSE-SU-2015:1250 SSRT101976 RHSA-2015:0672 MDVSA-2015:054 MDVSA-2015:165 USN-2503-1 https://bugzilla.redhat.com/show_bug.cgi?id=1193820 https://kb.isc.org/article/AA-01235 https://kb.juniper.net/JSA10783 https://kc.mcafee.com/corporate/index?page=content&id=SB10116 GLSA-201510-01 https://support.apple.com/HT205219 The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program. [linux-kernel] 20150117 [RFC PATCH RESEND] vfs: Move security_inode_killpriv() after permission checks [oss-security] 20150124 Re: CVE Request: Linux kernel - Denial of service in notify_change for xattrs. 76075 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=770492 https://bugzilla.redhat.com/show_bug.cgi?id=1185139 Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. <a href="http://cwe.mitre.org/data/definitions/416.html" rel="nofollow">CWE-416: Use After Free</a> http://git.php.net/?p=php-src.git;a=commit;h=777c39f4042327eac4b63c7ee87dc1c7a09a3115 APPLE-SA-2015-09-30-3 [oss-security] 20150124 Re: CVE Request: PHP RHSA-2015:1053 RHSA-2015:1066 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 71929 https://bugs.php.net/bug.php?id=68677 GLSA-201606-10 https://support.apple.com/HT205267 The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name. <a href="http://cwe.mitre.org/data/definitions/476.html" rel="nofollow">CWE-476: NULL Pointer Dereference</a> http://git.php.net/?p=php-src.git;a=commit;h=124fb22a13fafa3648e4e15b4f207c7096d8155e APPLE-SA-2015-09-30-3 SSRT102066 [oss-security] 20150124 Re: CVE Request: PHP RHSA-2015:1053 MDVSA-2015:079 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 71932 https://bugs.php.net/bug.php?id=68741 GLSA-201606-10 https://support.apple.com/HT205267 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it cannot be considered a security issue in the originally named product because of that product's specification. Notes: none. Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-234789.pdf Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 determines a user's privileges on the basis of project-file fields that lack integrity protection, which allows remote attackers to establish arbitrary authorization data via a modified file. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-234789.pdf Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allow context-dependent attackers to discover password hashes by reading (1) files or (2) security logs. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf The remote-management module in the (1) Multi Panels, (2) Comfort Panels, and (3) RT Advanced functionality in Siemens SIMATIC WinCC (TIA Portal) before 13 SP1 and in the (4) panels and (5) runtime functionality in SIMATIC WinCC flexible before 2008 SP3 Up7 does not properly encrypt credentials in transit, which makes it easier for remote attackers to determine cleartext credentials by sniffing the network and conducting a decryption attack. 72625 1036090 http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-526760.pdf http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-543623.pdf https://ics-cert.us-cert.gov/advisories/ICSA-16-161-02 Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h in PDFium, as used in Google Chrome before 40.0.2214.91, allow remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted PDF document, related to an "intra-object-overflow" issue, a different vulnerability than CVE-2015-1205. http://googlechromereleases.blogspot.com/2015/01/stable-update.html GLSA-201502-13 https://code.google.com/p/chromium/issues/detail?id=421196 https://code.google.com/p/chromium/issues/detail?id=449894 https://codereview.chromium.org/656463006 Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data that is improperly handled during text drawing, related to gpu/GrBitmapTextContext.cpp and gpu/GrDistanceFieldTextContext.cpp, a different vulnerability than CVE-2015-1205. http://googlechromereleases.blogspot.com/2015/01/stable-update.html GLSA-201502-13 https://code.google.com/p/chromium/issues/detail?id=416289 https://code.google.com/p/chromium/issues/detail?id=449894 https://codereview.chromium.org/636233008 platform/image-decoders/ImageFrame.h in Blink, as used in Google Chrome before 40.0.2214.91, does not initialize a variable that is used in calls to the Skia SkBitmap::setAlphaType function, which might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document, a different vulnerability than CVE-2015-1205. http://googlechromereleases.blogspot.com/2015/01/stable-update.html GLSA-201502-13 http://src.chromium.org/viewvc/blink?view=revision&revision=183296 https://code.google.com/p/chromium/issues/detail?id=411329 https://code.google.com/p/chromium/issues/detail?id=449894 Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot 4.7.2 allows remote attackers to execute arbitrary code via a long string in the maker element in an XML file. http://packetstormsecurity.com/files/130037/Exif-Pilot-4.7.2-Buffer-Overflow.html 35870 Cross-site scripting (XSS) vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/. http://packetstormsecurity.com/files/130066/articleFR-CMS-3.0.5-Cross-Site-Scripting.html 20150122 XSS vulnerability in articleFR CMS 3.0.5 http://www.itas.vn/news/itas-team-found-out-XSS-vulnerability-in-articlefr-cms-73.html SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/. 20150121 SQL injection vulnerability in articleFR CMS 3.0.5 35857 http://www.itas.vn/news/itas-team-found-out-a-sql-injection-vulnerability-in-articlefr-cms-72.html Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter. http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html 20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities 35846 [oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities 20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities pixarbay-wordpress-q-dir-traversal(100036) https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php https://wordpress.org/plugins/pixabay-images/changelog/ https://www.mogwaisecurity.de/advisories/MSA-2015-01.txt Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the image_user parameter. http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html 20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities 35846 [oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities 20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities 73931 pixarbay-wordpress-authorlink-xss(100039) https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php https://www.mogwaisecurity.de/advisories/MSA-2015-01.txt SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote attackers to execute arbitrary SQL commands via the lastcatbot parameter. http://packetstormsecurity.com/files/129990/CatBot-0.4.2-SQL-Injection.html 20150116 CatBot v0.4.2 (PHP) - SQL Injection Vulnerability 20150116 CatBot v0.4.2 (PHP) - SQL Injection Vulnerability http://www.vulnerability-lab.com/get_content.php?id=1408 catbot-index-sql-injection(100043) Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower (aka Ansible UI) before 2.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) order_by parameter to credentials/, (2) inventories/, (3) projects/, or (4) users/3/permissions/ in api/v1/ or the (5) next_run parameter to api/v1/schedules/. http://packetstormsecurity.com/files/129944/Ansible-Tower-2.0.2-XSS-Privilege-Escalation-Authentication-Missing.html 20150113 SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower 35786 20150113 SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower 72023 ansibletower-orderbynextrun-xss(99924) https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150113-1_Ansible-Tower_multiple-vulnerabilities_v10.txt SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter. [oss-security] 20150122 CVE requests for nodejs marked VBScript Content Injection and sequelize SQL Injection in Order https://github.com/sequelize/sequelize/pull/2919 https://nodesecurity.io/advisories/sequelize-sql-injection-order Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks via a vbscript tag in a link. <a href="http://cwe.mitre.org/data/definitions/184.html">CWE-184: Incomplete Blacklist</a> [oss-security] 20150122 CVE requests for nodejs marked VBScript Content Injection and sequelize SQL Injection in Order https://github.com/chjj/marked/issues/492 https://github.com/evilpacket/marked/commit/3c191144939107c45a7fa11ab6cb88be6694a1ba https://nodesecurity.io/advisories/marked_vbscript_injection Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in custom/uploads/. 20150122 Multiple stored/reflecting XSS- and SQLi-vulnerabilities and unrestricted file-upload in ferretCMS v. 1.0.4-alpha http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-10.html [oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload 72287 https://github.com/JRogaishio/ferretCMS/issues/63 SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote attackers to execute arbitrary SQL commands via the p parameter in an update action to admin.php. 20150122 Multiple stored/reflecting XSS- and SQLi-vulnerabilities and unrestricted file-upload in ferretCMS v. 1.0.4-alpha http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-10.html [oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload 72287 https://github.com/JRogaishio/ferretCMS/issues/63 Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request, (2) username in a login request, which is not properly handled when logging the event, or (3) page title in an insert action. 20150122 Multiple stored/reflecting XSS- and SQLi-vulnerabilities and unrestricted file-upload in ferretCMS v. 1.0.4-alpha http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-10.html [oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload 72287 https://github.com/JRogaishio/ferretCMS/issues/63 Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to hijack the authentication of administrators for requests that conduct (1) cross-site scripting (XSS), (2) SQL injection, or (3) unrestricted file upload attacks. [oss-security] 20150123 CVE-Request -- ferretCMS v.1.0.4-alpha -- Multiple reflecting/stored XSS- and SQLi-vulnerabilities, unrestricted file upload https://github.com/JRogaishio/ferretCMS/issues/63 pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not properly restrict access to the upload functionality, which allows remote attackers to write to arbitrary files. http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html 20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities 35846 [oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities 20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com. http://packetstormsecurity.com/files/130017/WordPress-Pixarbay-Images-2.3-XSS-Bypass-Upload-Traversal.html 20150120 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities 35846 [oss-security] 20150125 CVE request: MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities 20150119 MSA-2015-01: Wordpress Plugin Pixabay Images Multiple Vulnerabilities https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=1067992%40pixabay-images%2Ftrunk%2Fpixabay-images.php&old=926633%40pixabay-images%2Ftrunk%2Fpixabay-images.php The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file. http://www.webmin.com/changes.html http://www.webmin.com/security.html cmdlineopts.clp in grml-debootstrap in Debian 0.54, 0.68.x before 0.68.1, 0.7x before 0.78 is sourced without checking that the local directory is writable by non-root users. http://cve.killedkenny.io/cve/CVE-2015-1378 [oss-security] 20150127 Re: CVE or not: 2x grml-debootstrap https://github.com/grml/grml-debootstrap/issues/59 https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1378.html https://security-tracker.debian.org/tracker/CVE-2015-1378/ The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash). http://www.dest-unreach.org/socat/ [oss-security] 20150127 Re: Socat security advisory 6 - Possible DoS with fork [oss-security] 20150406 Socat security advisory 6 - Possible DoS with fork (update: CVE-Id: CVE-2015-1379; fix for version 2) 72321 https://bugzilla.redhat.com/show_bug.cgi?id=1185711 jcc.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (abort) via a crafted chunk-encoded body. http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.197&view=markup openSUSE-SU-2015:0230 [oss-security] 20150126 CVE request for Privoxy [oss-security] 20150127 Re: CVE request for Privoxy http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html 72355 Multiple unspecified vulnerabilities in pcrs.c in Privoxy before 3.0.23 allow remote attackers to cause a denial of service (segmentation fault or memory consumption) via unspecified vectors. http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.197&view=markup http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/pcrs.c?r1=1.46&r2=1.47 openSUSE-SU-2015:0230 DSA-3145 [oss-security] 20150126 CVE request for Privoxy [oss-security] 20150127 Re: CVE request for Privoxy parsers.c in Privoxy before 3.0.23 allows remote attackers to cause a denial of service (invalid read and crash) via vectors related to an HTTP time header. http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/ChangeLog?revision=1.197&view=markup http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/parsers.c?r1=1.297&r2=1.298 openSUSE-SU-2015:0230 DSA-3145 [oss-security] 20150126 CVE request for Privoxy [oss-security] 20150127 Re: CVE request for Privoxy Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search key. 20150128 Wordpress Geo Mashup plugin <= 1.8.2 XSS vulnerability [oss-security] 20150127 Re: CVE request: XSS in search functionality for Geo Mashup Wordpress plugin https://wordpress.org/plugins/geo-mashup/changelog/ Cross-site scripting (XSS) vulnerability in the Banner Effect Header plugin before 1.2.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the banner_effect_divid parameter in the BannerEffectOptions page to wp-admin/options-general.php. 20150201 Banner Effect Header Security Advisory - XSS Vulnerability - CVE-2015-1384 20150131 Banner Effect Header Security Advisory - XSS Vulnerability - CVE-2015-1384 https://wordpress.org/plugins/banner-effect-header/changelog/ https://www.netsparker.com/cve-2015-1384-xss-vulnerability-in-banner-effect-header/ Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php. http://packetstormsecurity.com/files/130155/Blubrry-PowerPress-6.0-Cross-Site-Scripting.html 20150130 Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385 20150129 Blubrry PowerPress Security Advisory - XSS Vulnerability - CVE-2015-1385 72362 https://wordpress.org/plugins/powerpress/changelog/ https://www.netsparker.com/cve-2015-1385-xss-vulnerability-in-blubrry-powerpress/ Directory traversal vulnerability in unshield 1.0-1. [oss-security] 20150127 Re: unshield directory traversal https://bugzilla.redhat.com/show_bug.cgi?id=1185717 The "RAP console" feature in ArubaOS 5.x through 6.2.x, 6.3.x before 6.3.1.15, and 6.4.x before 6.4.2.4 on Aruba access points in Remote Access Point (AP) mode allows remote attackers to execute arbitrary commands via unspecified vectors. http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-004.txt Cross-site scripting (XSS) vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote attackers to inject arbitrary web script or HTML via the username parameter to tips/tipsLoginSubmit.action. http://packetstormsecurity.com/files/132060/Aruba-ClearPass-Policy-Manager-6.4-Cross-Site-Scripting.html 20150527 ClearPass Policy Manager Stored XSS http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt https://github.com/cmaruti/reports/blob/master/aruba_clearpass.pdf 37172 Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors. http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt SQL injection vulnerability in the Photo Gallery plugin before 1.2.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the asc_or_desc parameter in a create gallery request in the galleries_bwg page to wp-admin/admin.php. 20150128 [CVE-2015-1393] Photo Gallery (Wordpress Plugin) - SQL Injection in Version 1.2.8 https://plugins.trac.wordpress.org/changeset/1074134/photo-gallery Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name. FEDORA-2015-1165 FEDORA-2015-1134 [oss-security] 20150127 Re: CVE Request: patch: directory traversal via file rename 72846 USN-2651-1 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775873 https://bugzilla.redhat.com/show_bug.cgi?id=1184490 https://git.savannah.gnu.org/cgit/patch.git/commit/?id=17953b5893f7c9835f0dd2a704ba04e0371d2cbd https://savannah.gnu.org/bugs/?44059 SQL injection vulnerability in the getCsvFile function in the Mage_Adminhtml_Block_Widget_Grid class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary SQL commands via the popularity[field_expr] parameter when the popularity[from] or popularity[to] parameter is set. http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/ http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability 1032194 https://blog.sucuri.net/2015/04/magento-shoplift-supee-5344-exploits-in-the-wild.html Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files. http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/ http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability 1032194 PHP remote file inclusion vulnerability in the fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allows remote administrators to execute arbitrary PHP code via a URL in unspecified vectors involving the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files. http://blog.checkpoint.com/2015/04/20/analyzing-magento-vulnerability/ http://magento.com/blog/technical/critical-security-advisory-remote-code-execution-rce-vulnerability 1032194 SQL injection vulnerability in search.php in NPDS Revolution 13 allows remote attackers to execute arbitrary SQL commands via the query parameter. http://packetstormsecurity.com/files/130179/NPDS-CMS-Revolution-13-SQL-Injection.html http://websecgeeks.com/npds-cms-sql-injection/ http://www.npds.org/viewtopic.php?topic=26189&forum=12 http://www.npds.org/viewtopic.php?topic=26233&forum=12 Improper Authentication vulnerability in the "LDAP / SSO Authentication" (ig_ldap_sso_auth) extension 2.0.0 for TYPO3. [oss-security] 20150111 CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 [oss-security] 20150127 Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 71981 Cross-site scripting (XSS) vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-002/ [oss-security] 20150111 CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 [oss-security] 20150127 Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 71984 SQL injection vulnerability in the Content Rating extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-002/ [oss-security] 20150111 CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 [oss-security] 20150127 Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 71984 Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-003/ [oss-security] 20150111 CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 [oss-security] 20150127 Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 71985 SQL injection vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-003/ [oss-security] 20150111 CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 [oss-security] 20150127 Re: CVE request: TYPO3-EXT-SA-2015-001, TYPO3-EXT-SA-2015-002, TYPO3-EXT-SA-2015-003 71985 Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory. <a href="http://cwe.mitre.org/data/definitions/190.html">CWE-190: Integer Overflow or Wraparound</a> DSA-3175 72777 1031798 https://kc.mcafee.com/corporate/index?page=content&id=SB10107 FreeBSD-SA-15:04 https://www.pfsense.org/security/advisories/pfSense-SA-15_02.igmp.asc The bsdinstall installer in FreeBSD 10.x before 10.1 p9, when configuring full disk encrypted ZFS, uses world-readable permissions for the GELI keyfile (/boot/encryption.key), which allows local users to obtain sensitive key information by reading the file. http://packetstormsecurity.com/files/131338/FreeBSD-10.x-ZFS-encryption.key-Disclosure.html 20150407 FreeBSD 10.x ZFS encryption.key disclosure (CVE-2015-1415) 1032042 FreeBSD-SA-15:08 Larry Wall's patch; patch in FreeBSD 10.2-RC1 before 10.2-RC1-p1, 10.2 before 10.2-BETA2-p2, and 10.1 before 10.1-RELEASE-p16; Bitrig; GNU patch before 2.2.5; and possibly other patch variants allow remote attackers to execute arbitrary shell commands via a crafted patch file. [oss-security] 20150730 CVE-2015-1416: vulnerability in patch(1) [oss-security] 20150801 Re: CVE-2015-1416: vulnerability in patch(1) [oss-security] 20150801 Re: CVE-2015-1416: vulnerability in patch(1) [oss-security] 20150802 Re: CVE-2015-1416: vulnerability in patch(1) 76116 1033110 FreeBSD-SA-15:14 The inet module in FreeBSD 10.2x before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1x before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and 8.x before 8.4-STABLE, 8.4-RELEASE-p35 on systems with VNET enabled and at least 16 VNET instances allows remote attackers to cause a denial of service (mbuf consumption) via multiple concurrent TCP connections. 76112 1033111 FreeBSD-SA-15:15 The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program. http://rachelbythebay.com/w/2018/04/05/bangpatch/ 76236 1033188 https://bugs.debian.org/894667 https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig FreeBSD-SA-15:18 Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing. SUSE-SU-2015:0136 openSUSE-SU-2015:0079 Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function. SUSE-SU-2015:1224 openSUSE-SU-2015:1382 SUSE-SU-2015:1478 SUSE-SU-2015:1592 SUSE-SU-2015:1611 [linux-kernel] 20150128 [PATCH v2] vfs: read file_handle only once in handle_to_path DSA-3170 [oss-security] 20150129 CVE-2015-1420 - Linux kernel fs/fhandle.c race condition 72357 USN-2660-1 USN-2661-1 USN-2665-1 USN-2667-1 https://bugzilla.redhat.com/show_bug.cgi?id=1187534 Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=600ddd6825543962fb807884169e57b580dba208 SUSE-SU-2015:0832 SUSE-SU-2015:1478 RHSA-2015:0726 RHSA-2015:0751 RHSA-2015:0782 RHSA-2015:0864 RHSA-2015:1082 DSA-3170 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.8 [oss-security] 20150129 Re: CVE request -- Linux kernel - net: sctp: slab corruption from use after free on INIT collisions 72356 1032172 USN-2541-1 USN-2542-1 USN-2545-1 USN-2546-1 USN-2562-1 USN-2563-1 https://bugzilla.redhat.com/show_bug.cgi?id=1196581 https://github.com/torvalds/linux/commit/600ddd6825543962fb807884169e57b580dba208 Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php. http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html 35767 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php geckocms-index-dialog-xss(99977) Multiple SQL injection vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote administrators to execute arbitrary SQL commands via the (1) jak_delete_log[] or (2) ssp parameter to admin/index.php. http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html 35767 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php geckocms-index-sql-injection(99976) Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php. http://packetstormsecurity.com/files/129929/Gecko-CMS-2.2-2.3-CSRF-XSS-SQL-Injection.html 35767 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5222.php geckocms-newuser-csrf(99974) Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node. http://puppetlabs.com/security/cve/cve-2015-1426 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script. http://packetstormsecurity.com/files/130368/Elasticsearch-1.3.7-1.4.2-Sandbox-Escape-Command-Execution.html http://packetstormsecurity.com/files/130784/ElasticSearch-Unauthenticated-Remote-Code-Execution.html http://www.elasticsearch.com/blog/elasticsearch-1-4-3-1-3-8-released/ 20150211 Elasticsearch vulnerability CVE-2015-1427 72585 RHSA-2017:0868 elasticsearch-cve20151427-command-exec(100850) https://www.elastic.co/community/security/ Multiple SQL injection vulnerabilities in Sefrengo before 1.6.2 allow (1) remote attackers to execute arbitrary SQL commands via the sefrengo cookie in a login to backend/main.php or (2) remote authenticated users to execute arbitrary SQL commands via the value_id parameter in a save_value action to backend/main.php. 35972 http://www.itas.vn/news/itas-team-found-out-multiple-sql-injection-vulnerabilities-in-sefrengo-cms-v1-6-1-74.html 20150202 Sefrengo CMS v1.6.1 - Multiple SQL Injection Vulnerabilities https://github.com/sefrengo-cms/sefrengo-1.x/commit/0b1edd4b22a47743eff7cfaf884ba2a4e06e15eb https://github.com/sefrengo-cms/sefrengo-1.x/commit/22c0d16bfd715631ed317cc990785ccede478f07 Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter. http://www.cybelesoft.com/blog/index.php/cybele-software-inc-security-bulletin-2 https://www.perspectiverisk.com/security-advisory-thinfinity-remote-desktop-workstation-directory-traversal/ Buffer overflow in xymon 4.3.17-1. [oss-security] 20150131 Re: CVE request: Xymon Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite." [oss-security] 20150131 Re: CVE request: phpbb3 CSRF and CSS injection 72405 phpbb3-cve20151431-xss(100670) https://github.com/phpbb/phpbb/commit/eaeb88133f1f028fa06f0ebe5639668436fd469e https://github.com/phpbb/phpbb/pull/3316 GLSA-201701-25 https://tracker.phpbb.com/browse/PHPBB3-13531 https://wiki.phpbb.com/Release_Highlights/3.0.13 The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors. [oss-security] 20150131 Re: CVE request: phpbb3 CSRF and CSS injection 72399 phpbb3-cve20151432-csrf(100671) https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449 https://github.com/phpbb/phpbb/pull/3311 GLSA-201701-25 https://tracker.phpbb.com/browse/PHPBB3-13526 https://wiki.phpbb.com/Release_Highlights/3.0.13 program/lib/Roundcube/rcube_washtml.php in Roundcube before 1.0.5 does not properly quote strings, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the style attribute in an email. FEDORA-2015-1772 openSUSE-SU-2015:0286 http://roundcube.net/news/2015/01/24/security-update-1.0.5/ http://trac.roundcube.net/changeset/786aa0725/github http://trac.roundcube.net/ticket/1490227 [oss-security] 20150131 CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5 [oss-security] 20150131 Re: CVE request: Roundcube cross-site scripting vulnerability fixed in 1.0.5 72401 Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php. http://mylittleforum.net/forum/index.php?id=8182 http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html 20150211 Multiple Vulnerabilities in my little forum 72575 mylittleforum-cve20151434-sql-injection(100855) https://www.htbridge.com/advisory/HTB23248 Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php. http://mylittleforum.net/forum/index.php?id=8182 http://packetstormsecurity.com/files/130356/My-Little-Forum-2.3.3-Cross-Site-Scripting-SQL-Injection.html 20150211 Multiple Vulnerabilities in my little forum 72582 mylittleforum-cve20151435-xss(100856) https://www.htbridge.com/advisory/HTB23248 Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the (1) easingslider_manage_customizations or (2) easingslider_edit_sliders page to wp-admin/admin.php. http://packetstormsecurity.com/files/130355/WordPress-Easing-Slider-2.2.0.6-Cross-Site-Scripting.html 20150211 Two Reflected XSS Vulnerabilities in Easing Slider WordPress Plugin 72572 wp-easingslider-cve20151436-xss(100861) https://wordpress.org/plugins/easing-slider/changelog/ https://www.htbridge.com/advisory/HTB23249 Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbitrary web script or HTML via the flag parameter to (1) result_of_get_changed_status.asp or (2) error_page.htm. http://packetstormsecurity.com/files/130187/Asus-RT-N10-Plus-Cross-Site-Scripting.html 20150129 Reflected XSS vulnarbility in Asus RT-N10 Plus Router 20150129 Unauthenticated Reflected XSS vulnarbility in Asus RT-N10 Plus router 20150203 CVE-2015-1437 XSS In ASUS Router. 72369 asus-rtn10-errorpage-xss(100563) asus-rtn10-resultstatus-xss(100566) Heap-based buffer overflow in Panda Security Kernel Memory Access Driver 1.0.0.13 allows attackers to execute arbitrary code with kernel privileges via a crafted size input for allocated kernel paged pool and allocated non-paged pool buffers. http://packetstormsecurity.com/files/132682/Panda-Security-1.0.0.13-Arbitrary-Code-Execution.html 20151231 CVE-2015-1438 - Panda Security Multiple Products Arbitrary Code Execution 20151231 CVE-2015-1438 - Arbitrary Code Execution [PSKMAD.sys] In Panda Security - Multiple Products 75715 https://tools.cisco.com/security/center/viewAlert.x?alertId=39908 https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-1438/ SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://piwigo.org/forum/viewtopic.php?id=25016 http://piwigo.org/releases/2.5.6 http://piwigo.org/releases/2.6.5 http://piwigo.org/releases/2.7.3 72400 SQL injection vulnerability in views/zero_transact_user.php in the administrative backend in ZeroCMS 1.3.3, 1.3.2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the user_id parameter in a Modify Account action. NOTE: The article_id parameter to zero_view_article.php vector is already covered by CVE-2014-4034. http://packetstormsecurity.com/files/130192/ZeroCMS-1.3.3-SQL-Injection.html 20150201 SQL injection vulnerabilities in zerocms <= v.1.3.3 [oss-security] 20150201 CVE-Request -- Zerocms <= v. 1.3.3 -- SQL injection vulnerabilities [oss-security] 20150201 Re: CVE-Request -- Zerocms <= v. 1.3.3 -- SQL injection vulnerabilities http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-14.html http://sroesemann.blogspot.de/2015/01/sroeadv-2015-13.html http://sroesemann.blogspot.de/2015/02/addition-for-advisory-sroeadv-2015-14.html 72398 The httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allows remote attackers to execute arbitrary code. [oss-security] 20150131 RCE, XSS and HTTP header injection in fli4l web interface http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt [oss-security] 20150201 Re: RCE, XSS and HTTP header injection in fli4l web interface Multiple cross-site scripting (XSS) vulnerabilities in the web administration frontend in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30 allow remote attackers to inject arbitrary web script or HTML via the (1) conntrack.cgi, (2) index.cgi, (3) log_syslog.cgi, (4) problems.cgi, (5) status.cgi, (6) status_network.cgi, or (7) status_system.cgi script in admin/. [oss-security] 20150131 RCE, XSS and HTTP header injection in fli4l web interface [oss-security] 20150201 Re: RCE, XSS and HTTP header injection in fli4l web interface http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt fli4l-cve20151444-xss(100610) HTTP header injection in the httpd package in fli4l before 3.10.1 and 4.0 before 2015-01-30. [oss-security] 20150131 RCE, XSS and HTTP header injection in fli4l web interface http://www.fli4l.de/fileadmin/fli4l/security/advisory-FFL-1113.txt [oss-security] 20150201 Re: RCE, XSS and HTTP header injection in fli4l web interface The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to bypass authentication and perform administrative actions via unspecified vectors. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf Buffer overflow in the integrated web server on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to execute arbitrary code via unspecified vectors. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-753139.pdf SQL injection vulnerability in Restaurant Biller allows remote attackers to execute arbitrary SQL commands via the cid parameter in a category action to index.php. http://packetstormsecurity.com/files/130122/Restaurantbiller-SQL-Injection-Shell-Upload.html Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiOS 5.0 Patch 7 build 4457 allow remote authenticated users to inject arbitrary web script or HTML via the (1) WTP Name or (2) WTP Active Software Version field in a CAPWAP Join request. 20150129 Fortinet FortiOS Multiple Vulnerabilities http://www.fortiguard.com/advisory/FG-IR-15-002/ http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf 72383 The Control and Provisioning of Wireless Access Points (CAPWAP) daemon in Fortinet FortiOS 5.0 Patch 7 build 4457 allows remote attackers to cause a denial of service (locked CAPWAP Access Controller) via a large number of ClientHello DTLS messages. 20150129 Fortinet FortiOS Multiple Vulnerabilities http://www.fortiguard.com/advisory/FG-IR-15-002/ http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf 72383 The qm class in Fortinet FortiClient 5.2.3.091 for Android uses a hardcoded encryption key of FoRtInEt!AnDrOiD, which makes it easier for attackers to obtain passwords and possibly other sensitive data by leveraging the key to decrypt data in the Shared Preferences. 20150129 Fortinet FortiClient Multiple Vulnerabilities http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiClient_Multiple_Vulnerabilities.pdf 72383 Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software updates, via a crafted certificate. https://bto.bluecoat.com/security-advisory/sa89 Fortinet FortiAuthenticator 3.0.0 has a password of (1) slony for the slony PostgreSQL user and (2) www-data for the www-data PostgreSQL user, which makes it easier for remote attackers to obtain access via unspecified vectors. http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html http://www.fortiguard.com/advisory/FG-IR-15-003/ http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf 72378 Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/. http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html http://www.fortiguard.com/advisory/FG-IR-15-003/ http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf 72378 Fortinet FortiAuthenticator 3.0.0 allows local users to read arbitrary files via the -f flag to the dig command. http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html http://www.fortiguard.com/advisory/FG-IR-15-003/ http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf 72378 fortinetfortiauthenticator-dig-info-disc(100560) Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcore_enable_shell_access and executing the "shell" command. http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf 72378 fortinetfortiauthenticator-shell-sec-bypass(100559) Cross-site scripting (XSS) vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/scep/. http://packetstormsecurity.com/files/130156/Fortinet-FortiAuthenticator-XSS-Disclosure-Bypass.html http://www.fortiguard.com/advisory/FG-IR-15-003/ http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiAuthenticator_Multiple_Vulnerabilities.pdf 72378 fortinetfortiauthenticator-scep-xss(100561) Huawei Quidway switches with firmware before V200R005C00SPC300 allows remote attackers to gain privileges via a crafted packet. http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-411975.htm ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted (1) Yoda's crypter or (2) mew packer file, related to a "heap out of bounds condition." http://blog.clamav.net/2015/01/clamav-0986-has-been-released.html FEDORA-2015-1437 FEDORA-2015-1461 openSUSE-SU-2015:0285 SUSE-SU-2015:0298 1031672 GLSA-201512-08 ClamAV before 0.98.6 allows remote attackers to have unspecified impact via a crafted upx packer file, related to a "heap out of bounds condition." http://blog.clamav.net/2015/01/clamav-0986-has-been-released.html FEDORA-2015-1437 FEDORA-2015-1461 openSUSE-SU-2015:0285 SUSE-SU-2015:0298 1031672 GLSA-201512-08 ClamAV before 0.98.6 allows remote attackers to cause a denial of service (crash) via a crafted petite packer file, related to an "incorrect compiler optimization." http://blog.clamav.net/2015/01/clamav-0986-has-been-released.html FEDORA-2015-1437 FEDORA-2015-1461 openSUSE-SU-2015:0285 SUSE-SU-2015:0298 GLSA-201512-08 RT (aka Request Tracker) before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL. http://blog.bestpractical.com/2015/02/security-vulnerabilities-in-rt.html FEDORA-2015-4666 FEDORA-2015-4698 DSA-3176 The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=df4d92549f23e1c037e83323aff58a21b3de7fe0 openSUSE-SU-2015:1382 SUSE-SU-2015:1488 SUSE-SU-2015:1489 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.8 [oss-security] 20150203 Re: CVE request -- Linux kernel - net: DoS due to routing packets to too many different dsts/too fast 72435 1036763 USN-2545-1 USN-2546-1 USN-2562-1 USN-2563-1 https://bugzilla.redhat.com/show_bug.cgi?id=1183744 https://github.com/torvalds/linux/commit/df4d92549f23e1c037e83323aff58a21b3de7fe0 Multiple SQL injection vulnerabilities in Translations in Fork CMS before 3.8.6 allow remote authenticated users to execute arbitrary SQL commands via the (1) language[] or (2) type[] parameter to private/en/locale/index. http://packetstormsecurity.com/files/130242/Fork-CMS-3.8.5-SQL-Injection.html http://www.fork-cms.com/blog/detail/fork-3.8.6-released 20150204 [CVE-2015-1467] Fork CMS - SQL Injection in Version 3.8.5 forkcms-cve20151467-sql-injection(100668) time.htm in the web interface on SerVision HVG Video Gateway devices with firmware through 2.2.26a100 allows remote authenticated users to gain privileges by leveraging a cookie received in an HTTP response, a different vulnerability than CVE-2015-0929 and CVE-2015-0930. VU#522460 SQL injection vulnerability in userprofile.lib.php in Pragyan CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to the default URI. http://pastebin.com/ip2gGYuS 20150203 SQL injection vulnerability in Pragyan CMS v.3.0 [oss-security] 20150203 Re: CVE-Request -- Pragyan CMS v.3.0 -- SQL injection vulnerability http://sroesemann.blogspot.de/2015/01/sroeadv-2015-11.html http://sroesemann.blogspot.de/2015/02/advisory-for-sroeadv-2015-11.html https://github.com/delta/pragyan/commit/c93bc100ec93fc78940fbdca9b6b009101858309 https://github.com/delta/pragyan/issues/206 The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during memory allocation, which allows context-dependent attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long line containing wide characters that are improperly handled in a wscanf call. [oss-security] 20150203 Re: CVE request: heap buffer overflow in glibc swscanf http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html 20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 72428 USN-2519-1 20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series 20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X GLSA-201602-02 https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06 [libc-alpha] 20150206 The GNU C Library version 2.21 is now available The ADDW macro in stdio-common/vfscanf.c in the GNU C Library (aka glibc or libc6) before 2.21 does not properly consider data-type size during a risk-management decision for use of the alloca function, which might allow context-dependent attackers to cause a denial of service (segmentation violation) or overwrite memory locations beyond the stack boundary via a long line containing wide characters that are improperly handled in a wscanf call. [oss-security] 20150203 Re: CVE request: heap buffer overflow in glibc swscanf http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 72499 USN-2519-1 https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06 Multiple integer overflows in the GraphicBuffer::unflatten function in platform/frameworks/native/libs/ui/GraphicBuffer.cpp in Android through 5.0 allow attackers to gain privileges or cause a denial of service (memory corruption) via vectors that trigger a large number of (1) file descriptors or (2) integer values. http://packetstormsecurity.com/files/130778/Google-Android-Integer-Oveflow-Heap-Corruption.html 20150311 [CVE-2015-1474]Integer overflow leading to heap corruption while unflattening GraphicBuffer 72788 1031875 https://android.googlesource.com/platform/frameworks/native/+/38803268570f90e97452cd9a30ac831661829091 https://www.blackhat.com/docs/us-15/materials/us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege.pdf Multiple cross-site scripting (XSS) vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) category parameter to forum.php or the (3) page or (4) order parameter to (a) board_entry.php or (b) forum_entry.php. http://packetstormsecurity.com/files/130220/My-Little-Forum-2.3.3-2.2-1.7-Cross-Site-Scripting.html 20150203 My Little Forum Multiple XSS Security Vulnerabilities http://tetraph.com/security/xss-vulnerability/my-little-forum-multiple-xss-security-vulnerabilities/ mylittleforum-multiple-xss(100616) Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the (1) productbycat parameter to product.php, or (2) username or (3) password parameter to __admin/index.php. http://packetstormsecurity.com/files/130073/ecommerceMajor-SQL-Injection.html 35878 SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewad task to classifieds/offerring-ads. http://packetstormsecurity.com/files/130093/JClassifiedsManager-Cross-Site-Scripting-SQL-Injection.html 35911 Cross-site scripting (XSS) vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the view parameter to /classifieds. http://packetstormsecurity.com/files/130093/JClassifiedsManager-Cross-Site-Scripting-SQL-Injection.html 35911 SQL injection vulnerability in reports/CreateReportTable.jsp in ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to execute arbitrary SQL commands via the site parameter. http://packetstormsecurity.com/files/130079/ManageEngine-ServiceDesk-9.0-SQL-Injection.html 35890 http://www.manageengine.com/products/service-desk/readme-9.0.html http://www.rewterz.com/vulnerabilities/manageengine-servicedesk-sql-injection-vulnerability 72299 ZOHO ManageEngine ServiceDesk Plus (SDP) before 9.0 build 9031 allows remote authenticated users to obtain sensitive ticket information via a (1) getTicketData action to servlet/AJaxServlet or a direct request to (2) swf/flashreport.swf, (3) reports/flash/details.jsp, or (4) reports/CreateReportTable.jsp. http://packetstormsecurity.com/files/130081/ManageEngine-ServiceDesk-Plus-9.0-Privilege-Escalation.html 35904 http://www.manageengine.com/products/service-desk/readme-9.0.html http://www.rewterz.com/vulnerabilities/manageengine-servicedesk-plus-user-privileges-management-vulnerability 20150122 Fwd: REWTERZ-20140103 - ManageEngine ServiceDesk Plus User Privileges Management Vulnerability 72302 Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account. http://packetstormsecurity.com/files/129944/Ansible-Tower-2.0.2-XSS-Privilege-Escalation-Authentication-Missing.html 20150113 SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower 35786 20150113 SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150113-1_Ansible-Tower_multiple-vulnerabilities_v10.txt Ansible Tower (aka Ansible UI) before 2.0.5 allows remote attackers to bypass authentication and obtain sensitive information via a websocket connection to socket.io/1/. http://packetstormsecurity.com/files/129944/Ansible-Tower-2.0.2-XSS-Privilege-Escalation-Authentication-Missing.html 20150113 SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower 35786 20150113 SEC Consult SA-20150113-1 :: Privilege Escalation & XSS & Missing Authentication in Ansible Tower https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20150113-1_Ansible-Tower_multiple-vulnerabilities_v10.txt Symantec NetBackup OpsCenter 7.6.0.2 through 7.6.1 on Linux and UNIX allows remote attackers to execute arbitrary JavaScript code via unspecified vectors. 72737 1031831 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150302_00 Unquoted Windows search path vulnerability in the agent in Symantec Workspace Streaming (SWS) 6.1 before SP8 MP2 HF7 and 7.5 before SP1 HF4, when AppMgrService.exe is configured as a service, allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory, as demonstrated by program.exe. <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> 73925 1032133 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150410_00 Cross-site request forgery (CSRF) vulnerability in the administration console in the Enforce Server in Symantec Data Loss Prevention (DLP) before 12.5.2 allows remote attackers to hijack the authentication of administrators. 75289 1032710 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150622_00 The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote attackers to bypass authentication via a crafted password-reset action that triggers a new administrative session. 76074 1033165 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150730_00 37812 The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to write to arbitrary files, and consequently obtain administrator privileges, via a crafted filename. 76094 1033165 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150730_00 37812 An unspecified action handler in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via unknown vectors. 76077 1033165 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150730_00 The management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to gain privileges via unspecified vectors. 76078 1033165 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150730_00 37812 Directory traversal vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via a relative pathname in a client installation package. 76081 1033165 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150730_00 SQL injection vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. 76079 1033165 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150730_00 Untrusted search path vulnerability in the client in Symantec Endpoint Protection 12.1 before 12.1-RU6-MP1 allows local users to gain privileges via a Trojan horse DLL in a client install package. 76083 1033165 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20150730_00 Directory traversal vulnerability in the min_get_slash_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6.8, 2.7.x before 2.7.5, and 2.8.x before 2.8.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter, as demonstrated by reading PHP scripts. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48980 http://git.moodle.org/gw?p=moodle.git;a=commit;h=af9a7937cc085f96bdbc4724cadec6eeae0242fc [oss-security] 20150204 CVE request for Moodlee MDL-48980 Security: Always clean the result from min_get_slash_argument [oss-security] 20150209 Moodle security issue made public https://moodle.org/mod/forum/discuss.php?d=279956 The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an mfbfw[*] parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfw[padding] parameter and exploited in the wild in February 2015. http://blog.sucuri.net/2015/02/zero-day-in-the-fancybox-for-wordpress-plugin.html 36087 [oss-security] 20150205 Re: CVE request for Zero-day in the Fancybox-for-WordPress Plugin 72506 https://plugins.trac.wordpress.org/changeset/1082625/ https://wordpress.org/plugins/fancybox-for-wordpress/changelog/ https://wordpress.org/support/topic/possible-malware-2 Multiple stack-based buffer overflows in Motorola Scanner SDK allow remote attackers to execute arbitrary code via a crafted string to the Open method in (1) IOPOSScanner.ocx or (2) IOPOSScale.ocx. http://www.zerodayinitiative.com/advisories/ZDI-15-033/ http://www.zerodayinitiative.com/advisories/ZDI-15-034/ https://portal.motorolasolutions.com/Support/US-EN/Resolution?solutionId=87666 Motorola Scanner SDK uses weak permissions for (1) CoreScanner.exe, (2) rsmdriverproviderservice.exe, and (3) ScannerService.exe, which allows local users to gain privileges via unspecified vectors. http://www.zerodayinitiative.com/advisories/ZDI-15-035/ http://www.zerodayinitiative.com/advisories/ZDI-15-036/ http://www.zerodayinitiative.com/advisories/ZDI-15-037/ https://portal.motorolasolutions.com/Support/US-EN/Resolution?solutionId=87666 radexecd.exe in Persistent Systems Radia Client Automation (RCA) 7.9, 8.1, 9.0, and 9.1 allows remote attackers to execute arbitrary commands via a crafted request to TCP port 3465. http://packetstormsecurity.com/files/130459/HP-Client-Automation-Command-Injection.html 36169 36206 72612 http://www.zerodayinitiative.com/advisories/ZDI-15-038/ https://support.accelerite.com/hc/en-us/articles/203659814-Accelerite-releases-solutions-and-best-practices-to-enhance-the-security-for-RBAC-and-Remote-Notify-features 40491 Persistent Systems Radia Client Automation does not properly restrict access to certain request, which allows remote attackers to (1) enumerate user accounts via a getUsers request, (2) assign a role to a user account via an addAssigneesToRole request, (3) remove a role from a user account via a removeAssigneesFromRole request, or (4) have other unspecified impact. http://www.zerodayinitiative.com/advisories/ZDI-15-039/ https://radiasupport.accelerite.com/hc/en-us/articles/203659814-Accelerite-releases-solutions-and-best-practices-to-enhance-the-security-for-RBAC-and-Remote-Notify-features The ActiveMQ Broker in Samsung Security Manager (SSM) before 1.31 allows remote attackers to delete arbitrary files, and consequently cause a denial of service, via a DELETE request. http://www.zerodayinitiative.com/advisories/ZDI-15-041/ samsung-security-cve20151499-dos(100918) Multiple stack-based buffer overflows in the TSUnicodeGraphEditorControl in SolarWinds Server and Application Monitor (SAM) allow remote attackers to execute arbitrary code via unspecified vectors to (1) graphManager.load or (2) factory.load. http://www.zerodayinitiative.com/advisories/ZDI-15-042/ http://www.zerodayinitiative.com/advisories/ZDI-15-044/ The factory.loadExtensionFactory function in TSUnicodeGraphEditorControl in SolarWinds Server and Application Monitor (SAM) allow remote attackers to execute arbitrary code via a UNC path to a crafted binary. http://www.zerodayinitiative.com/advisories/ZDI-15-043/ Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the file parameter to a webmail/client/skins/default/css/css.php page or .../. (dot dot dot slash dot) in the (2) script or (3) style parameter to webmail/old/calendar/minimizer/index.php. http://packetstormsecurity.com/files/147505/IceWarp-Mail-Server-Directory-Traversal.html 44587 https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-001/?fid=5614 Multiple cross-site scripting (XSS) vulnerabilities in FancyFon FAMOC before 3.17.4 allow remote attackers to inject arbitrary web script or HTML via the (1) LoginForm[username] to ui/system/login or the (2) order or (3) myorgs to index.php. http://packetstormsecurity.com/files/130119/FancyFon-FAMOC-3.16.5-Cross-Site-Scripting.html famoc-index-xss(100410) https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2014-011.txt SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username. http://packetstormsecurity.com/files/130194/SIPhone-Enterprise-PBX-SQL-Injection.html siphonepbx-username-sql-injection(100582) Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow (1) remote attackers to execute arbitrary SQL commands via the device ID REST parameter (PATH_INFO) to /ajax.php or (2) remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php. http://packetstormsecurity.com/files/130117/FancyFon-FAMOC-3.16.5-SQL-Injection.html 20150127 [SYSS-2014-010] FancyFon FAMOC - SQL Injection https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2014-010.txt The dwall.sys driver in SoftSphere DefenseWall Personal Firewall 3.24 allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted 0x00222000, 0x00222004, 0x00222008, 0x0022200c, or 0x00222010 IOCTL call. 36052 Cross-site scripting (XSS) vulnerability in Polycom RealPresence CloudAXIS Suite before 1.7.0 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. http://adrianhayter.com/exploits.php SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filter_level parameter in a "Refresh photo set" action in the batch_manager page to admin.php. http://packetstormsecurity.com/files/130440/Piwigo-2.7.3-SQL-Injection.html http://piwigo.org/forum/viewtopic.php?id=25179 http://piwigo.org/releases/2.7.4 20150218 [CVE-2015-1517] Piwigo - SQL Injection in Version 2.7.3 72664 SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before 2.3.0 allows remote attackers to execute arbitrary SQL commands via the search_terms parameter. http://packetstormsecurity.com/files/130322/Radexscript-CMS-2.2.0-SQL-Injection.html 20150212 Radexscript CMS 2.2.0 - SQL Injection vulnerability 36023 http://www.itas.vn/news/itas-team-found-out-a-sql-injection-vulnerability-in-redaxscript-2-2-0-cms-75.html 20150209 Radexscript CMS 2.2.0 - SQL Injection vulnerability analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read if NDEBUG; otherwise assertion failure) via a crafted DNP3 packet. https://github.com/bro/bro/commit/6cedd67c381ff22fde653adf02ee31caf66c81a0 analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read) via a crafted DNP3 packet. https://github.com/bro/bro/commit/6cedd67c381ff22fde653adf02ee31caf66c81a0 The media_server component in Android allows remote attackers to cause a denial of service via a crafted application. 76666 https://www.blackhat.com/docs/us-15/materials/us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege.pdf Integer overflow in IAudioPolicyService.cpp in Android allows local users to gain privileges via a crafted application, aka Android Bug ID 19261727. 76665 https://android.googlesource.com/platform/frameworks/av/+/6dc6c38%5E%21/ https://www.blackhat.com/docs/us-15/materials/us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege.pdf Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482. https://android.googlesource.com/platform/frameworks/native/+/7dcd0ec9c91688cfa3f679804ba6e132f9811254 https://android.googlesource.com/platform/system/core/+/e8c62fb484151f76ab88b1d5130f38de24ac8c14 [android-security-updates] 20150909 Nexus Security Bulletin (September 2015) https://www.blackhat.com/docs/us-15/materials/us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege.pdf Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors. 76663 https://android.googlesource.com/platform/frameworks/av/+/b9096dc https://www.blackhat.com/docs/us-15/materials/us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege.pdf Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (system_server crash) or obtain sensitive system_server memory-content information via a crafted application that leverages improper unmarshalling of bitmaps, aka internal bug 19666945. https://android.googlesource.com/platform/frameworks/base/+/d44e5bde18a41beda39d49189bef7f2ba7c8f3cb [android-security-updates] 20150812 Nexus Security Bulletin (August 2015) Integer overflow in IHDCP.cpp in the media_server component in Android allows remote attackers to execute arbitrary code via a crafted application. 76670 https://android.googlesource.com/platform/frameworks/av/+/c82e31a7039a03dca7b37c65b7890ba5c1e18ced%5E%21/#F0 https://www.blackhat.com/docs/us-15/materials/us-15-Gong-Fuzzing-Android-System-Services-By-Binder-Call-To-Escalate-Privilege.pdf Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496. http://packetstormsecurity.com/files/134131/Libstagefright-Integer-Overflow-Check-Bypass.html http://www.huawei.com/en/psirt/security-advisories/hw-448928 76052 1033094 http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-448928.htm https://android.googlesource.com/platform/frameworks/av/+/2434839bbd168469f80dd9a22f1328bc81046398 [android-security-updates] 20150812 Nexus Security Bulletin (August 2015) 38124 Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493. http://www.huawei.com/en/psirt/security-advisories/hw-448928 76052 1033094 http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-448928.htm https://android.googlesource.com/platform/frameworks/av/+/5e751957ba692658b7f67eb03ae5ddb2cd3d970c [android-security-updates] 20150812 Nexus Security Bulletin (August 2015) The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an Intent with a (1) FLAG_GRANT_READ_URI_PERMISSION or (2) FLAG_GRANT_WRITE_URI_PERMISSION flag, as demonstrated by bypassing intended restrictions on reading contacts, aka internal bug 19618745. https://android.googlesource.com/platform/frameworks/base/+/0b98d304c467184602b4c6bce76fda0b0274bc07 [android-security-updates] 20150812 Nexus Security Bulletin (August 2015) The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> APPLE-SA-2015-04-08-2 openSUSE-SU-2015:1325 DSA-3209 MDVSA-2015:073 MDVSA-2015:074 http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=c32e74763f77675b9e144126e375977ed6dc562c http://www.openldap.org/its/?findid=8027 [oss-security] 20150207 Re: CVE request: two OpenLDAP DoS issues http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html 72519 1032399 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776988 openldap-cve20151545-dos(100937) https://support.apple.com/HT204659 Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control. <a href="http://cwe.mitre.org/data/definitions/415.html">CWE - CWE-415: Double Free</a> APPLE-SA-2015-04-08-2 openSUSE-SU-2015:1325 62787 http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commit;h=2f1a2dd329b91afe561cd06b872d09630d4edb6a http://www.openldap.org/its/?findid=8046 [oss-security] 20150207 Re: CVE request: two OpenLDAP DoS issues https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776991 openldap-cve20151546-dos(100938) https://support.apple.com/HT204659 The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif. [oss-security] 20150124 Multiple vulnerabilities in LibTIFF and associated tools [oss-security] 20150207 Re: Multiple vulnerabilities in LibTIFF and associated tools RHSA-2016:1546 RHSA-2016:1547 DSA-3467 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html 73438 GLSA-201701-16 mini_httpd 1.21 and earlier allows remote attackers to obtain sensitive information from process memory via an HTTP request with a long protocol string, which triggers an incorrect response size calculation and an out-of-bounds read. http://itinsight.hu/en/posts/articles/2015-01-23-mini-httpd/ 73450 Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allows remote administrators to execute arbitrary files via unspecified vectors. http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.4 allows remote administrators to read arbitrary files via unspecified vectors. http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-006.txt kgb-bot 1.33-2 allows remote attackers to cause a denial of service (crash). [oss-security] 20150207 Re: kgb-bot can be crashed by some network traffic https://bugzilla.redhat.com/show_bug.cgi?id=1186590 Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9, 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators. http://framework.zend.com/security/advisory/ZF2015-01 Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs. http://downloads.asterisk.org/pub/security/AST-2015-001.html 20150128 AST-2015-001: File descriptor leak when incompatible codecs are offered 20150128 AST-2015-001: File descriptor leak when incompatible codecs are offered 1031661 Multiple cross-site request forgery (CSRF) vulnerabilities in administrator.php in Epignosis eFront Open Source Edition before 3.6.15.3 build 18022 allow remote attackers to hijack the authentication of administrators for requests that (1) delete modules via the delete_module parameter, (2) deactivate modules via the deactivate_module parameter, (3) activate modules via the activate_module parameter, (4) delete users via the delete_user parameter, (5) deactivate users via the deactivate_user parameter, (6) activate users via the activate_user parameter, (7) activate themes via the set_theme parameter, (8) deactivate themes via the set_theme parameter, (9) delete themes via the delete parameter, (10) deactivate events (user registration or email activation) via the deactivate_notification parameter, (11) activate events via the activate_notification parameter, (12) delete events via the delete_notification parameter, (13) deactivate language settings via the deactivate_language parameter, (14) activate language settings via the activate_language parameter, (15) delete language settings via the delete_language parameter, or (16) activate or deactivate the autologin feature for a user via a crafted maintenance request. 20150208 Multiple CSRF vulnerabilities in eFront v. 3.6.15.2 (CE) [oss-security] 20150208 CVE-Request -- eFront v. 3.6.15.2 build 18021 (Community Edition) -- Multiple CSRF vulnerabilities [oss-security] 20150208 [Re: CVE-Request -- eFront v. 3.6.15.2 build 18021 (Community Edition) -- Multiple CSRF vulnerabilities http://sroesemann.blogspot.de/2015/01/sroeadv-2015-09.html http://www.efrontlearning.net/download 72533 efront-cve20151559-csrf(100735) SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php. http://packetstormsecurity.com/files/132607/Merethis-Centreon-2.5.4-SQL-Injection-Remote-Command-Execution.html 20150708 Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution https://forge.centreon.com/projects/centreon/repository/revisions/d14f213b9c60de1bad0b464fd6403c828cf12582 https://github.com/centreon/centreon/commit/668a928f34dc0f67723d3db138c042eb7f979f28#diff-f69d4a3d3d177d024c22419357c1f4f4 The escape_command function in include/Administration/corePerformance/getStats.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon 19.10.0) uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via shell metacharacters in the ns_id parameter. http://packetstormsecurity.com/files/132607/Merethis-Centreon-2.5.4-SQL-Injection-Remote-Command-Execution.html 20150708 Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution https://forge.centreon.com/projects/centreon/repository/revisions/387dffdd051dbc7a234e1138a9d06f3089bb55bb https://github.com/centreon/centreon/commit/a78c60aad6fd5af9b51a6d5de5d65560ea37a98a#diff-27550b563fa8d660b64bca871a219cb1 Multiple cross-site scripting (XSS) vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search parameter to admin/user_management.php, (2) data_search parameter to /admin/profile_data.php, or (3) filter parameter to error_log.php. 20150127 Reflecting XSS vulnerabilities in CMS Saurus v. 4.7 (CE) http://sroesemann.blogspot.de/2015/01/report-for-advisory-sroeadv-2015-05.html http://sroesemann.blogspot.de/2015/01/sroeadv-2015-05.html [oss-security] 20150128 CVE-Request -- Saurus CMS v.4.7 (Community Edition, released: 12.08.2014) -- Multiple reflecting XSS vulnerabilities https://github.com/sauruscms/Saurus-CMS-Community-Edition/commit/8dec044d0fdabcb9b04e58037623385a97b0d288 The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged. FEDORA-2015-3944 [oss-security] 20150129 Xen Security Advisory 118 - arm: vgic: incorrect rate limiting of guest triggered logging 72766 1031663 http://xenbits.xen.org/xsa/advisory-118.html Cross-site scripting (XSS) vulnerability in style-underground/search in Plain Black WebGUI 7.10.29 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field. 20150120 WebGUI 7.10.29 stable version Cross site scripting vulnerability http://secupent.com/exploit/WebGUI-7.10.29-XSS.txt Cross-site scripting (XSS) vulnerability in the online help in Hitachi Device Manager, Tiered Storage Manager, Replication Manager, and Global Link Manager before 8.1.2-00, and Compute Systems Manager before 7.6.1-08 and 8.x before 8.1.2-00, as used in Hitachi Command Suite, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS15-001/index.html Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 7.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www.dnnsoftware.com/platform/manage/security-center Cross-site scripting (XSS) vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors. drupal-gdinfinitescroll-xss(100629) https://www.drupal.org/node/2415219 https://www.drupal.org/node/2415885 Cross-site request forgery (CSRF) vulnerability in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote attackers to hijack the authentication of users with the "edit gd infinite scroll settings" permission for requests that delete settings via unspecified vectors. drupal-gdinfinitescroll-csrf(100628) https://www.drupal.org/node/2415219 https://www.drupal.org/node/2415885 Fortinet FortiClient 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof SSL VPN servers via a crafted certificate. 20150129 Fortinet FortiClient Multiple Vulnerabilities http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiClient_Multiple_Vulnerabilities.pdf The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof servers via a crafted certificate. 20150129 Fortinet FortiClient Multiple Vulnerabilities http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiClient_Multiple_Vulnerabilities.pdf ** DISPUTED ** The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key. NOTE: FG-IR-15-002 says "The Fortinet_Factory certificate is unique to each device ... An attacker cannot therefore stage a MitM attack." 20150129 Fortinet FortiOS Multiple Vulnerabilities http://www.fortiguard.com/advisory/FG-IR-15-002/ http://www.security-assessment.com/files/documents/advisory/Fortinet_FortiOS_Multiple_Vulnerabilities.pdf Heap-based buffer overflow in closefs.c in the libext2fs library in e2fsprogs before 1.42.12 allows local users to execute arbitrary code by causing a crafted block group descriptor to be marked as dirty. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0247. http://advisories.mageia.org/MGASA-2015-0088.html FEDORA-2015-2511 FEDORA-2015-2516 SUSE-SU-2015:1103 openSUSE-SU-2015:1002 openSUSE-SU-2015:1006 DSA-3166 MDVSA-2015:067 MDVSA-2015:068 72709 USN-2507-1 https://git.kernel.org/cgit/fs/ext2/e2fsprogs.git/commit/?id=49d0fe2a14f2a23da2fe299643379b8c1d37df73 GLSA-201507-22 The nft_flush_table function in net/netfilter/nf_tables_api.c in the Linux kernel before 3.18.5 mishandles the interaction between cross-chain jumps and ruleset flushes, which allows local users to cause a denial of service (panic) by leveraging the CAP_NET_ADMIN capability. http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a2f18db0c68fec96631c10cad9384c196e9008ac RHSA-2015:1137 RHSA-2015:1138 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.5 [oss-security] 20150210 Re: CVE-Request -- Linux kernel - panic on nftables rule flush 72552 https://bugzilla.redhat.com/show_bug.cgi?id=1190966 https://github.com/torvalds/linux/commit/a2f18db0c68fec96631c10cad9384c196e9008ac The Google Email application 4.2.2.0200 for Android allows remote attackers to cause a denial of service (persistent application crash) via a "Content-Disposition: ;" header in an e-mail message. http://hmarco.org/bugs/google_email_app_4.2.2_denial_of_service.html [oss-security] 20150210 Re: Re: CVE-Request -- Google Email App 4.2.2 remote denial of service [oss-security] 20150212 Re: CVE-Request -- Google Email App 4.2.2 remote denial of service http://packetstormsecurity.com/files/130388/Google-Email-4.4.2.0200-Denial-Of-Service.html 20150214 CVE-2015-1574 - Google Email App 4.2.2 remote denial of service 20150213 CVE-2015-1574 - Google Email App 4.2.2 remote denial of service Multiple cross-site scripting (XSS) vulnerabilities in u5CMS before 3.9.4 allow remote attackers to inject arbitrary web script or HTML via the (1) c, (2) i, (3) l, or (4) p parameter to index.php; the (5) a or (6) b parameter to u5admin/cookie.php; the name parameter to (7) copy.php or (8) delete.php in u5admin/; the (9) f or (10) typ parameter to u5admin/deletefile.php; the (11) n parameter to u5admin/done.php; the (12) c parameter to u5admin/editor.php; the (13) uri parameter to u5admin/meta2.php; the (14) n parameter to u5admin/notdone.php; the (15) newname parameter to u5admin/rename2.php; the (16) l parameter to u5admin/sendfile.php; the (17) s parameter to u5admin/characters.php; the (18) page parameter to u5admin/savepage.php; or the (19) name parameter to u5admin/new2.php. http://packetstormsecurity.com/files/130292/u5CMS-3.9.3-Cross-Site-Scripting.html 36029 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5223.php Multiple SQL injection vulnerabilities in u5CMS before 3.9.4 allow remote attackers to execute arbitrary SQL commands via the name parameter to (1) copy2.php, (2) localize.php, (3) metai.php, (4) nc.php, (5) new2.php, or (6) rename2.php in u5admin/; (7) c parameter to u5admin/editor.php; (8) typ parameter to u5admin/meta2.php; or (9) newname parameter to u5admin/rename2.php. http://packetstormsecurity.com/files/130326/u5CMS-3.9.3-SQL-Injection.html http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5225.php Directory traversal vulnerability in u5admin/deletefile.php in u5CMS before 3.9.4 allows remote attackers to write to arbitrary files via a (1) .. (dot dot) or (2) full pathname in the f parameter. http://packetstormsecurity.com/files/130325/u5CMS-3.9.3-Arbitrary-File-Deletion.html 36026 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5226.php Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) pidvesa cookie to u5admin/pidvesa.php or (2) uri parameter to u5admin/meta2.php. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> http://packetstormsecurity.com/files/130317/u5CMS-3.9.3-Open-Redirect.html http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5227.php Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734. 36039 https://wpvulndb.com/vulnerabilities/7540 Multiple cross-site request forgery (CSRF) vulnerabilities in the Redirection Page plugin 1.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) source or (3) redir parameter in an add action in the redirection-page to wp-admin/options-general.php. http://packetstormsecurity.com/files/130314/WordPress-Redirection-Page-1.2-CSRF-XSS.html Multiple cross-site request forgery (CSRF) vulnerabilities in the Mobile Domain plugin 1.5.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) domain, (3) text, (4) font, (5) fontcolor, (6) color, or (7) padding parameter in an add-domain action in the mobile-domain page to wp-admin/options-general.php. http://packetstormsecurity.com/files/130316/WordPress-Mobile-Domain-1.5.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html Multiple cross-site scripting (XSS) vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or HTML via the (2) asc_or_desc, (3) order_by, (4) page_number, (5) serch_or_not, or (6) search_events_by_title parameter in (a) the Spider_Facebook_manage page to wp-admin/admin.php or a (b) selectpagesforfacebook or (c) selectpostsforfacebook action to wp-admin/admin-ajax.php. http://packetstormsecurity.com/files/130318/WordPress-Spider-Facebook-1.0.10-Cross-Site-Scripting.html https://wordpress.org/plugins/spider-facebook/changelog/ Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account. http://packetstormsecurity.com/files/130410/Fat-Free-CRM-0.13.5-Cross-Site-Request-Forgery.html 20150214 [CVE-2015-1585] Fat Free CRM - CSRF Vulnerability in Version 0.13.5 fatfreecrm-cve20151585-csrf(100925) https://github.com/fatfreecrm/fat_free_crm/wiki/CSRF-Vulnerability-%28CVE-2015-1585%29 Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> http://asylum.seraum.com/Security-Alert-GED-ECM-Maarch-Critical-Vulnerabilities.html http://packetstormsecurity.com/files/130383/Maarch-LetterBox-2.8-Unrestricted-File-Upload.html 35113 Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21. http://packetstormsecurity.com/files/131649/Open-Xchange-Server-6-OX-AppSuite-Cross-Site-Scripting.html 20150427 Open-Xchange Security Advisory 2015-04-27 74350 1032202 Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file. [oss-security] 20150212 Re: CVE request: archmage directory traversal [oss-security] 20150212 CVE request: archmage directory traversal https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=776164 archmage-cve20151589-dir-trav(100879) The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl. [oss-security] 20150212 Re: kamailio: multiple /tmp file vulnerabilities https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775681 https://github.com/kamailio/kamailio/blob/4.3.0/ChangeLog#L2038 https://github.com/kamailio/kamailio/commit/06177b12936146d48378cc5f6c6e1b157ebd519b https://github.com/kamailio/kamailio/issues/48 The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. http://cve.killedkenny.io/cve/CVE-2015-1591 [oss-security] 20150212 Re: kamailio: multiple /tmp file vulnerabilities https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775681 https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=17;filename=0001-fix-fifo-and-ctl-defaults-pointing-to-unsecure-tmp-d.patch;att=1;bug=775681 https://github.com/kamailio/kamailio/issues/48 https://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1591.html Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors. [oss-security] 20150212 Re: CVE request: MovableType before 5.2.12 - Movable Type [oss-security] 20150212 CVE request: MovableType before 5.2.12 72606 1031777 movable-type-cve20151592-file-include(100912) https://movabletype.org/news/2015/02/movable_type_607_and_5212_released_to_close_security_vulnera.html DSA-3183 The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4e7c22d447bb6d7e37bfe39ff658486ae78e8d77 http://hmarco.org/bugs/linux-ASLR-integer-overflow.html openSUSE-SU-2015:0714 SUSE-SU-2015:0736 RHSA-2015:1137 RHSA-2015:1138 RHSA-2015:1221 DSA-3170 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.1 [oss-security] 20150213 Re: CVE-Request -- Linux ASLR integer overflow 72607 USN-2560-1 USN-2561-1 USN-2562-1 USN-2563-1 USN-2564-1 USN-2565-1 https://bugzilla.redhat.com/show_bug.cgi?id=1192519 https://github.com/torvalds/linux/commit/4e7c22d447bb6d7e37bfe39ff658486ae78e8d77 [linux-kernel] 20150107 Re: [PATH] Fix stack randomization on x86_64 bit Untrusted search path vulnerability in Siemens SIMATIC ProSave before 13 SP1; SIMATIC CFC before 8.0 SP4 Upd9 and 8.1 before Upd1; SIMATIC STEP 7 before 5.5 SP1 HF2, 5.5 SP2 before HF7, 5.5 SP3, and 5.5 SP4 before HF4; SIMOTION Scout before 4.4; and STARTER before 4.4 HF3 allows local users to gain privileges via a Trojan horse application file. <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> 1032039 http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-451236.pdf The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof servers by intercepting the client-server data stream. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf The Siemens SPCanywhere application for Android does not use encryption during the loading of code, which allows man-in-the-middle attackers to execute arbitrary code by modifying the client-server data stream. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf The Siemens SPCanywhere application for Android does not properly store application passwords, which allows physically proximate attackers to obtain sensitive information by examining the device filesystem. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf The Siemens SPCanywhere application for iOS allows physically proximate attackers to bypass intended access restrictions by leveraging a filesystem architectural error. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-185226.pdf Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier. http://packetstormsecurity.com/files/130401/Netatmo-Weather-Station-Cleartext-Password-Leak.html 20150213 CVE-2015-1600 - Netatmo Weather Station Cleartext Password Leak 72622 https://isc.sans.edu/forums/diary/Did+You+Remove+That+Debug+Code+Netatmo+Weather+Station+Sending+WPA+Passphrase+in+the+Clear/19327 Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 allows man-in-the-middle attackers to obtain sensitive information or modify transmitted data via unspecified vectors. 72691 http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-315836.pdf Siemens SIMATIC STEP 7 (TIA Portal) 12 and 13 before 13 SP1 Upd1 improperly stores password data within project files, which makes it easier for local users to determine cleartext (1) protection-level passwords or (2) web-server passwords by leveraging the ability to read these files. http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-315836.pdf Multiple cross-site scripting (XSS) vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php or (2) id parameter in a users_users action to asys/site/system.php. http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html 20150213 Reflecting XSS vulnerabitlies, unrestricted file upload and underlaying CSRF in Landsknecht Adminsystems CMS v. 4.0.1 (DEV, beta version) http://sroesemann.blogspot.de/2015/01/sroeadv-2015-14.html http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html [oss-security] 20150213 CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF [oss-security] 20150213 Re: CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF [oss-security] 20150214 Re: CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF 72605 https://github.com/kneecht/adminsystems/issues/1 https://github.com/kneecht/adminsystems/releases/tag/4.0.2 Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/files/. http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html 20150213 Reflecting XSS vulnerabitlies, unrestricted file upload and underlaying CSRF in Landsknecht Adminsystems CMS v. 4.0.1 (DEV, beta version) http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html [oss-security] 20150213 CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF [oss-security] 20150213 Re: CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF [oss-security] 20150214 Re: CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF 72605 https://github.com/kneecht/adminsystems/issues/1 https://github.com/kneecht/adminsystems/releases/tag/4.0.2 Multiple SQL injection vulnerabilities in Dell ScriptLogic Asset Manager (aka Quest Workspace Asset Manager) before 9.5 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to (1) GetClientPackage.aspx or (2) GetProcessedPackage.aspx. 72697 http://www.zerodayinitiative.com/advisories/ZDI-15-048/ http://www.zerodayinitiative.com/advisories/ZDI-15-049/ Topline Opportunity Form (aka XLS Opp form) before 2015-02-15 does not properly restrict access to database-connection strings, which allows attackers to read the cleartext version of sensitive credential and e-mail address information via unspecified vectors. VU#669156 http://www.kb.cert.org/vuls/id/BLUU-9RUTH4 72518 MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request. FEDORA-2015-4003 FEDORA-2015-4197 1034466 http://www.splunk.com/view/SP-CAAAPC3 https://jira.mongodb.org/browse/SERVER-17264 GLSA-201611-13 hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing." http://www.internetsociety.org/sites/default/files/10_4_2.pdf 73251 https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1610_l2switch:_topology_spoofing_via_hosttracker OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection." http://www.internetsociety.org/sites/default/files/10_4_2.pdf 73254 https://cloudrouter.org/security/ https://git.opendaylight.org/gerrit/#/c/16193/ https://git.opendaylight.org/gerrit/#/c/16208/ https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP packets, aka "LLDP Relay." http://www.internetsociety.org/sites/default/files/10_4_2.pdf 73254 https://cloudrouter.org/security/ https://git.opendaylight.org/gerrit/#/c/16193/ https://git.opendaylight.org/gerrit/#/c/16208/ https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the (1) update_repo, (2) get_locks, or (3) get_user_groups API method. https://rhodecode.com/blog/rhodecode-enterprise-security-release/ Multiple cross-site request forgery (CSRF) vulnerabilities in the Image Metadata Cruncher plugin for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) image_metadata_cruncher[alt] or (2) image_metadata_cruncher[caption] parameter in an update action in the image_metadata_cruncher_title page to wp-admin/options.php or (3) custom image meta tag to the image metadata cruncher page. http://packetstormsecurity.com/files/130404/WordPress-Image-Metadata-Cruncher-Cross-Site-Scripting.html 20150215 Multiple Cross site scripting in wordpress Plugin Image Metadata cruncher 20150217 CVE-2015-1614 csrf/xss in in wordpress Plugin Image Metadata cruncher image-metadata-wordpress-xss(100926) SQL injection vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated ePO users to execute arbitrary SQL commands via unspecified vectors. https://kc.mcafee.com/corporate/index?page=content&id=SB10098 Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. https://kc.mcafee.com/corporate/index?page=content&id=SB10098 The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows remote authenticated users to obtain sensitive password information via a crafted URL. https://kc.mcafee.com/corporate/index?page=content&id=SB10098 Cross-site scripting (XSS) vulnerability in the Secure Web Mail Client user interface in McAfee Email Gateway (MEG) 7.6.x before 7.6.3.2, 7.5.x before 75.6, 7.0.x through 7.0.5, 5.6, and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified tokens in Digest messages. https://kc.mcafee.com/corporate/index?page=content&id=SB10099 Cross-site scripting (XSS) vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. [oss-security] 20150213 CVE requests for Drupal contributed modules https://www.drupal.org/node/2423681 https://www.drupal.org/node/2424405 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 72927 1031888 MS15-018 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0056 and CVE-2015-1626. 72928 1031888 MS15-018 Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 72929 1031888 MS15-018 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1634. 72923 1031888 MS15-018 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0056 and CVE-2015-1623. 72930 1031888 MS15-018 Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." 72932 1031888 MS15-018 Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action, aka "OWA Modified Canary Parameter Cross Site Scripting Vulnerability." 1031900 MS15-026 Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "ExchangeDLP Cross Site Scripting Vulnerability." 1031900 MS15-026 Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Audit Report Cross Site Scripting Vulnerability." 1031900 MS15-026 Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to spoof meeting organizers via unspecified vectors, aka "Exchange Forged Meeting Request Spoofing Vulnerability." 1031900 MS15-026 Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via the msgParam parameter in an authError action, aka "Exchange Error Message Cross Site Scripting Vulnerability." 1031900 MS15-026 Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, SharePoint Foundation 2013 Gold and SP1, and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability." 1031895 MS15-022 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1625. 72931 1031888 MS15-018 HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability." http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html 74013 1032109 MS15-034 36773 36776 Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 Gold and SP1 and SharePoint Server 2013 Gold and SP1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability." 1031895 MS15-022 Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1067. 72965 1031833 MS15-031 https://freakattack.com/ https://technet.microsoft.com/library/security/3046015 Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability." 1032115 MS15-040 Cross-site scripting (XSS) vulnerability in Microsoft Office for Mac 2011 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Outlook App for Mac XSS Vulnerability." 1032104 MS15-033 Cross-site scripting (XSS) vulnerability in Microsoft Project Server 2010 SP2 and 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability." 1032111 MS15-036 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability." 73995 1032104 MS15-033 Microsoft Office 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." 1033239 MS15-081 20150901 Microsoft Word "TaskSymbol Control" Use After Free Vulnerability Microsoft Windows Server 2003 R2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "NtCreateTransactionManager Type Confusion Vulnerability." 1032113 MS15-038 Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows MS-DOS Device Name Vulnerability." 73998 1032113 MS15-038 Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image, aka "EMF Processing Remote Code Execution Vulnerability." http://packetstormsecurity.com/files/131457/Microsoft-Windows-GDI-MRSETDIBITSTODEVICE-bPlay-EMF-Parsing-Memory-Corruption.html 20150415 Secunia Research: Microsoft Windows GDI "MRSETDIBITSTODEVICE ::bPlay()" EMF Parsing Memory Corruption Vulnerability 1032110 MS15-035 Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD, aka "MSXML3 Same Origin Policy SFB Vulnerability." 1032114 MS15-039 Virtual Machine Manager (VMM) in Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 allows guest OS users to cause a denial of service (VMM functionality loss) via a crafted application, aka "Windows Hyper-V DoS Vulnerability." 1032117 MS15-042 ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, allows remote attackers to obtain sensitive configuration-file information via a crafted request, aka "ASP.NET Information Disclosure Vulnerability." 1032116 MS15-041 Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability." <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> 1032104 MS15-033 Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability." <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> 1032104 MS15-033 Use-after-free vulnerability in Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability." <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> 1032104 MS15-033 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1666. 73990 1032108 MS15-032 Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability." 1032111 MS15-036 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 1032108 MS15-032 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1706, CVE-2015-1711, CVE-2015-1717, and CVE-2015-1718. 74504 1032282 MS15-043 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1662 and CVE-2015-1665. 73994 1032108 MS15-032 Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 1032108 MS15-032 Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability." 74006 1032108 MS15-032 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1659 and CVE-2015-1665. 1032108 MS15-032 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1659 and CVE-2015-1662. 74000 1032108 MS15-032 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1652. 1032108 MS15-032 Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 1032108 MS15-032 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 74004 1032108 MS15-032 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability." 74485 1032281 MS15-044 The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability." 74490 1032281 MS15-044 Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability." <a href="https://cwe.mitre.org/data/definitions/674.html">CWE-674: Uncontrolled Recursion</a> 74482 1032297 MS15-048 The Windows Forms (aka WinForms) libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-assisted remote attackers to execute arbitrary code via a crafted partial-trust application, aka "Windows Forms Elevation of Privilege Vulnerability." 74487 1032297 MS15-048 The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate an unspecified address, which allows local users to bypass the KASLR protection mechanism, and consequently discover the cng.sys base address, via a crafted application, aka "Windows Kernel Security Feature Bypass Vulnerability." 74488 1032292 MS15-052 37052 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699. 1032280 MS15-045 The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1677, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680. 74483 1032294 MS15-051 The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680. 74494 1032294 MS15-051 The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1677, CVE-2015-1679, and CVE-2015-1680. 74495 1032294 MS15-051 The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1677, CVE-2015-1678, and CVE-2015-1680. 74496 1032294 MS15-051 The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1677, CVE-2015-1678, and CVE-2015-1679. 74497 1032294 MS15-051 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to cause a denial of service via a crafted .msc file, aka "Microsoft Management Console File Format Denial of Service Vulnerability." 74486 1032286 MS15-054 Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Office 2013 RT SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office for Mac 2011, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, PowerPoint Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, SharePoint Foundation 2010 SP2, and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." 74481 1032295 MS15-046 Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." 1032295 MS15-046 VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript ASLR Bypass." 74522 1032282 MS15-043 MS15-053 Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass." 74516 1032282 MS15-043 The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass." 74530 1032282 MS15-043 MS15-053 Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 1032521 MS15-056 Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." 74519 1032282 MS15-043 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1705. 74506 1032282 MS15-043 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1712. 74507 1032282 MS15-043 Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script, aka "Internet Explorer Clipboard Information Disclosure Vulnerability." 74517 1032282 MS15-043 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1710. 74508 1032282 MS15-043 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699. 1032280 MS15-045 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699. 1032280 MS15-045 20150501 Microsoft Windows Journal File Parsing "CEPMRCFormatReader" Out-of-Bounds Access Vulnerability Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1698, and CVE-2015-1699. 1032280 MS15-045 20150601 Microsoft Windows Journal File Parsing "INbImageLayer" Invalid Index Error Vulnerability Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, and CVE-2015-1699. 1032280 MS15-045 20150601 Microsoft Windows Journal File Parsing "DecodePos" Out-of-Bounds-Access Vulnerability Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, and CVE-2015-1698. 1032280 MS15-045 Microsoft SharePoint Server 2007 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, and SharePoint Foundation 2013 SP1 allow remote authenticated users to execute arbitrary code via crafted page content, aka "Microsoft SharePoint Page Content Vulnerabilities." 1032296 MS15-047 Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability." http://twitter.com/symantec/statuses/590208710527549440 74245 1032155 MS15-051 37049 37367 https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html The Service Control Manager (SCM) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Service Control Manager Elevation of Privilege Vulnerability." 74492 1032299 MS15-050 Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1704. 74520 1032282 MS15-043 Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1703. 74521 1032282 MS15-043 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1689. 74509 1032282 MS15-043 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1711, CVE-2015-1717, and CVE-2015-1718. 74510 1032282 MS15-043 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 74511 1032282 MS15-043 Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 74512 1032282 MS15-043 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1694. 74513 1032282 MS15-043 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1706, CVE-2015-1717, and CVE-2015-1718. 74514 1032282 MS15-043 Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1691. 74515 1032282 MS15-043 Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." 74518 1032282 MS15-043 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 74505 1032282 MS15-043 Microsoft Silverlight 5 before 5.1.40416.00 allows remote attackers to bypass intended integrity-level restrictions via a crafted Silverlight application, aka "Microsoft Silverlight Out of Browser Application Vulnerability." 1032298 MS15-049 Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict Diffie-Hellman Ephemeral (DHE) key lengths, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, aka "Schannel Information Disclosure Vulnerability." 74489 1032283 MS15-055 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1706, CVE-2015-1711, and CVE-2015-1718. 74606 1032282 MS15-043 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1706, CVE-2015-1711, and CVE-2015-1717. 74607 1032282 MS15-043 The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to obtain sensitive information from kernel memory via a crafted application, aka "Microsoft Windows Kernel Information Disclosure Vulnerability." 1032525 MS15-061 Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Use After Free Vulnerability." 1032525 MS15-061 The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a crafted application, aka "Win32k Null Pointer Dereference Vulnerability." 1032525 MS15-061 38274 Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Bitmap Handling Use After Free Vulnerability." CWE-416: Use After Free 1032525 MS15-061 38265 38275 Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Station Use After Free Vulnerability." CWE-416: Use After Free 1032525 MS15-061 38273 Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Object Use After Free Vulnerability." CWE-416: Use After Free 1032525 MS15-061 38272 Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Buffer Overflow Vulnerability." 1032525 MS15-061 38270 38271 Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Brush Object Use After Free Vulnerability." 1032525 MS15-061 38269 Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Pool Buffer Overflow Vulnerability." 1032525 MS15-061 38268 Microsoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site, aka "Windows Media Player RCE via DataObject Vulnerability." 1032522 MS15-057 20150701 Microsoft Windows Media Player DataObject Switch Memory Corruption Vulnerability Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." 1032894 MS15-065 Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." http://blog.skylined.nl/20161206001.html http://packetstormsecurity.com/files/140050/Microsoft-Internet-Explorer-9-jscript9-JavaScriptStackWalker-Memory-Corruption.html 1032521 MS15-056 40881 20150701 Microsoft Internet Explorer "JavascriptStackWalker" Invalid Pointer Reference Vulnerability Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1736, CVE-2015-1737, and CVE-2015-1755. 1032521 MS15-056 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1742, CVE-2015-1747, CVE-2015-1750, and CVE-2015-1753. 1032521 MS15-056 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2389 and CVE-2015-2411. 1032894 MS15-065 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1740, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766. 74972 1032521 MS15-056 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1737, and CVE-2015-1755. 74978 1032521 http://www.zerodayinitiative.com/advisories/ZDI-15-253 MS15-056 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1736, and CVE-2015-1755. 74979 1032521 MS15-056 Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2388. 1032894 MS15-065 Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." 74995 1032521 http://www.zerodayinitiative.com/advisories/ZDI-15-249 MS15-056 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766. 74981 1032521 MS15-056 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1752. 74982 1032521 MS15-056 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1747, CVE-2015-1750, and CVE-2015-1753. 74983 1032521 MS15-056 Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1748. 74996 1032521 http://www.zerodayinitiative.com/advisories/ZDI-15-377 MS15-056 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1745, and CVE-2015-1766. 74984 1032521 MS15-056 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1744, and CVE-2015-1766. 74985 1032521 http://www.zerodayinitiative.com/advisories/ZDI-15-252 MS15-056 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1750, and CVE-2015-1753. 74986 1032521 http://www.zerodayinitiative.com/advisories/ZDI-15-250 MS15-056 Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1743. 74997 1032521 http://www.zerodayinitiative.com/advisories/ZDI-15-251 MS15-056 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1747, and CVE-2015-1753. 74987 1032521 MS15-056 Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 74988 1032521 MS15-056 20150701 Microsoft Internet Explorer TableGridBlock Use-after-Free Vulnerability Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1741. 74989 1032521 MS15-056 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1747, and CVE-2015-1750. 74990 1032521 MS15-056 Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 74991 1032521 MS15-056 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1736, and CVE-2015-1737. 74992 1032521 http://www.zerodayinitiative.com/advisories/ZDI-15-254 MS15-056 20151001 Microsoft Internet Explorer COptionsElement Use-after-Free Vulnerability Use-after-free vulnerability in Microsoft Common Controls in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted web site that is accessed with the F12 Developer Tools feature of Internet Explorer, aka "Microsoft Common Control Use After Free Vulnerability." CWE-416: Use After Free https://cwe.mitre.org/data/definitions/416.html 75017 1032524 MS15-060 Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability." 75023 1032526 MS15-062 Untrusted search path vulnerability in the LoadLibrary function in the kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a Trojan horse DLL in an unspecified directory, aka "Windows LoadLibrary EoP Vulnerability." CWE-426: Untrusted Search Path https://cwe.mitre.org/data/definitions/426.html JVN#18146081 JVNDB-2015-000086 75004 1032527 MS15-063 Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 75014 1032523 MS15-059 Microsoft Office Compatibility Pack SP3, Office 2010 SP2, Office 2013 SP1, and Office 2013 RT SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 75015 1032523 MS15-059 Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 uses an incorrect class during casts of unspecified pointers, which allows remote authenticated users to gain privileges by leveraging certain write access, aka "SQL Server Elevation of Privilege Vulnerability." 1032893 MS15-058 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05382740 Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014, when transactional replication is configured, does not prevent use of uninitialized memory in unspecified function calls, which allows remote authenticated users to execute arbitrary code by leveraging certain permissions and making a crafted query, as demonstrated by the VIEW SERVER STATE permission, aka "SQL Server Remote Code Execution Vulnerability." 1032893 MS15-058 Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual functions, which allows remote authenticated users to execute arbitrary code via a crafted query, aka "SQL Server Remote Code Execution Vulnerability." 1032893 MS15-058 The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery (SSRF) issue, aka "Exchange Server-Side Request Forgery Vulnerability." 75007 1032528 MS15-064 Microsoft Internet Explorer 9 through 11 allows remote attackers to read the browser history via a crafted web site. 74994 1032521 MS15-056 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1744, and CVE-2015-1745. 74993 1032521 MS15-056 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2401 and CVE-2015-2408. 1032894 http://www.zerodayinitiative.com/advisories/ZDI-15-568 MS15-065 win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability." 75024 1032525 MS15-061 Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles symlinks, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Mount Manager Elevation of Privilege Vulnerability." http://blogs.technet.com/b/srd/archive/2015/08/11/defending-against-cve-2015-1769-a-logical-issue-exploited-via-a-malicious-usb-stick.aspx 1033244 MS15-085 Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability." 75016 1032523 MS15-059 Cross-site request forgery (CSRF) vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows remote attackers to hijack the authentication of arbitrary users, aka "Exchange Cross-Site Request Forgery Vulnerability." 75011 1032528 MS15-064 The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request. [www-announce] 20150521 CVE-2015-1772 1034365 http://www-01.ibm.com/support/docview.wss?uid=swg21969546 https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html Cross-site scripting (XSS) vulnerability in asdoc/templates/index.html in Apache Flex before 4.14.1 allows remote attackers to inject arbitrary web script or HTML by providing a crafted URI to JavaScript code generated by the asdoc component. 20150407 CVE-2015-1773 Apache Flex reflected XSS vulnerability 73954 1032107 https://helpx.adobe.com/security/products/flex/apsb15-08.html The HWP filter in LibreOffice before 4.3.7 and 4.4.x before 4.4.2 and Apache OpenOffice before 4.1.2 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted HWP document, which triggers an out-of-bounds write. FEDORA-2015-7022 FEDORA-2015-7213 openSUSE-SU-2015:0859 RHSA-2015:1458 DSA-3236 http://www.openoffice.org/security/cves/CVE-2015-1774.html 74338 1032205 1032206 USN-2578-1 GLSA-201603-05 https://www.libreoffice.org/about-us/security/advisories/cve-2015-1774/ 20150427 Multiple Vendor LibreOffice "HWPFILTER" Out Of Bounds Access Vulnerability Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call. <a href="https://cwe.mitre.org/data/definitions/918.html">CWE-918: Server-Side Request Forgery (SSRF)</a> [oss-security] 20151013 [CVE-2015-1775] Apache Ambari Server Side Request Forgery vulnerability https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file. [hadoop-general] 20160215 CVE-2015-1776: Apache Hadoop MapReduce, disclosure of encrypted data 83259 rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to prevent system registration via a man-in-the-middle attack. [oss-security] 20150304 Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 72943 https://bugzilla.redhat.com/show_bug.cgi?id=1198740 The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username and password combination. [oss-security] 20150320 OpenDaylight security advisory: CVE-2015-1778 authentication bypass, CVE-2015-1611 CVE-2015-1612 topology spoofing via LLDP 73255 https://cloudrouter.org/security/ https://wiki.opendaylight.org/view/Security_Advisories The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section. FEDORA-2015-5482 FEDORA-2015-5541 SUSE-SU-2015:0870 SUSE-SU-2015:0896 RHSA-2015:1931 RHSA-2015:1943 DSA-3259 [oss-security] 20150324 CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder [oss-security] 20150409 Re: CVE-2015-1779 qemu: vnc: insufficient resource limiting in VNC websockets decoder http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 73303 1033975 USN-2608-1 [Qemu-devel] 20150323 [PATCH 0/2] CVE-2015-1779: fix denial of service in VNC websockets [Qemu-devel] 20150323 [PATCH 2/2] CVE-2015-1779: limit size of HTTP headers from websockets clients [Qemu-devel] 20150323 [PATCH 1/2] CVE-2015-1779: incrementally decode websocket frames GLSA-201602-01 Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer. FEDORA-2016-0480defc94 SUSE-SU-2015:1424 SUSE-SU-2016:0470 DSA-3480 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 74255 1032178 USN-2985-1 USN-2985-2 RHSA-2015:0863 GLSA-201602-02 https://sourceware.org/bugzilla/show_bug.cgi?id=18287 https://sourceware.org/git/?p=glibc.git;a=commit;h=2959eda9272a03386 [libc-alpha] 20150814 The GNU C Library version 2.22 is now available The kex_agree_methods function in libssh2 before 1.5.0 allows remote servers to cause a denial of service (crash) or have other unspecified impact via crafted length values in an SSH_MSG_KEXINIT packet. FEDORA-2015-3757 FEDORA-2015-3797 FEDORA-2015-3791 DSA-3182 http://www.libssh2.org/adv_20150311.html MDVSA-2015:148 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 73061 The prefix variable in the get_or_define_ns function in Lasso before commit 6d854cef4211cdcdbc7446c978f23ab859847cdd allows remote attackers to cause a denial of service (uninitialized memory access and application crash) via unspecified vectors. FEDORA-2015-4848 FEDORA-2015-4807 FEDORA-2015-4821 https://bugzilla.redhat.com/show_bug.cgi?id=1199925 https://repos.entrouvert.org/lasso.git/commit/lasso/xml?id=6d854cef4211cdcdbc7446c978f23ab859847cdd Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers. https://bugzilla.redhat.com/show_bug.cgi?id=1207781 https://framework.zend.com/changelog/2.3.6 The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero. HPSBMU03380 HPSBMU03409 HPSBMU03397 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 73238 1031929 https://bto.bluecoat.com/security-advisory/sa92 https://bugzilla.redhat.com/show_bug.cgi?id=1202406 https://git.openssl.org/?p=openssl.git;a=commit;h=b19d8143212ae5fbc9cebfd51c01f802fabccd33 https://kc.mcafee.com/corporate/index?page=content&id=SB10110 GLSA-201503-11 https://www.openssl.org/news/secadv_20150319.txt The BN_GF2m_mod_inv function in crypto/bn/bn_gf2m.c in OpenSSL before 0.9.8s, 1.0.0 before 1.0.0e, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field, which allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm, as demonstrated by an attack against a server that supports client authentication. http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015 NetBSD-SA2015-008 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694 APPLE-SA-2015-08-13-2 openSUSE-SU-2015:1139 SUSE-SU-2015:1143 SUSE-SU-2015:1150 SUSE-SU-2015:1181 SUSE-SU-2015:1182 SUSE-SU-2015:1184 SUSE-SU-2015:1185 openSUSE-SU-2015:1277 openSUSE-SU-2016:0640 SSRT102180 HPSBMU03409 20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products DSA-3287 http://www.fortiguard.com/advisory/2015-06-11-fortinet-vulnerability-openssl-vulnerabilities-june-2015 http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 75158 91787 1032564 USN-2639-1 http://www-304.ibm.com/support/docview.wss?uid=swg21960041 https://bto.bluecoat.com/security-advisory/sa98 https://github.com/openssl/openssl/commit/4924b37ee01f71ae19c94a8934b80eeb2f677932 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131044 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351 https://kc.mcafee.com/corporate/index?page=content&id=SB10122 https://openssl.org/news/secadv/20150611.txt GLSA-201506-02 https://support.apple.com/kb/HT205031 https://support.citrix.com/article/CTX216642 https://www.openssl.org/news/secadv_20150611.txt The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback. http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015 NetBSD-SA2015-008 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733 APPLE-SA-2015-08-13-2 FEDORA-2015-10047 FEDORA-2015-10108 openSUSE-SU-2015:1139 SUSE-SU-2015:1143 SUSE-SU-2015:1150 SUSE-SU-2015:1181 SUSE-SU-2015:1182 SUSE-SU-2015:1183 SUSE-SU-2015:1184 SUSE-SU-2015:1185 openSUSE-SU-2015:1277 openSUSE-SU-2016:0640 HPSBGN03371 SSRT102180 HPSBMU03409 RHSA-2015:1115 RHSA-2015:1197 20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products DSA-3287 http://www.fortiguard.com/advisory/2015-06-11-fortinet-vulnerability-openssl-vulnerabilities-june-2015 http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015 http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 75156 91787 1032564 USN-2639-1 https://bto.bluecoat.com/security-advisory/sa98 https://github.com/openssl/openssl/commit/f48b83b4fb7d6689584cf25f61ca63a4891f5b11 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131044 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05353965 https://kc.mcafee.com/corporate/index?page=content&id=SB10122 https://openssl.org/news/secadv/20150611.txt GLSA-201506-02 https://support.apple.com/kb/HT205031 https://support.citrix.com/article/CTX216642 https://www.openssl.org/news/secadv_20150611.txt The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015 NetBSD-SA2015-008 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733 APPLE-SA-2015-08-13-2 FEDORA-2015-10047 FEDORA-2015-10108 openSUSE-SU-2015:1139 SUSE-SU-2015:1143 SUSE-SU-2015:1150 SUSE-SU-2015:1181 SUSE-SU-2015:1182 SUSE-SU-2015:1183 SUSE-SU-2015:1184 SUSE-SU-2015:1185 openSUSE-SU-2015:1277 openSUSE-SU-2016:0640 HPSBGN03371 SSRT102180 HPSBMU03409 RHSA-2015:1115 RHSA-2015:1197 20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products DSA-3287 http://www.fortiguard.com/advisory/2015-06-11-fortinet-vulnerability-openssl-vulnerabilities-june-2015 http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015 http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 75157 91787 1032564 USN-2639-1 https://bto.bluecoat.com/security-advisory/sa98 https://github.com/openssl/openssl/commit/59302b600e8d5b77ef144e447bb046fd7ab72686 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131044 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05353965 https://kc.mcafee.com/corporate/index?page=content&id=SB10122 https://openssl.org/news/secadv/20150611.txt GLSA-201506-02 https://support.apple.com/kb/HT205031 https://www.openssl.org/news/secadv_20150611.txt Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier. http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015 NetBSD-SA2015-008 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10733 APPLE-SA-2015-08-13-2 FEDORA-2015-10047 FEDORA-2015-10108 openSUSE-SU-2015:1139 SUSE-SU-2015:1143 SUSE-SU-2015:1150 SUSE-SU-2015:1182 SUSE-SU-2015:1184 SUSE-SU-2015:1185 openSUSE-SU-2016:0640 SSRT102180 HPSBMU03409 RHSA-2015:1115 20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products DSA-3287 http://www.fortiguard.com/advisory/2015-06-11-fortinet-vulnerability-openssl-vulnerabilities-june-2015 http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 75161 91787 1032479 USN-2639-1 http://www-304.ibm.com/support/docview.wss?uid=swg21960041 https://bto.bluecoat.com/security-advisory/sa98 https://github.com/openssl/openssl/commit/98ece4eebfb6cd45cc8d550c6ac0022965071afc https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131044 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05157667 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05353965 https://kc.mcafee.com/corporate/index?page=content&id=SB10122 https://openssl.org/news/secadv/20150611.txt GLSA-201506-02 https://support.apple.com/kb/HT205031 https://support.citrix.com/article/CTX216642 https://www.openssl.org/news/secadv_20150611.txt The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function. http://fortiguard.com/advisory/openssl-vulnerabilities-june-2015 NetBSD-SA2015-008 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694 APPLE-SA-2015-08-13-2 FEDORA-2015-10047 FEDORA-2015-10108 openSUSE-SU-2015:1139 SUSE-SU-2015:1143 SUSE-SU-2015:1150 SUSE-SU-2015:1182 SUSE-SU-2015:1184 SUSE-SU-2015:1185 openSUSE-SU-2015:1277 openSUSE-SU-2016:0640 HPSBGN03371 SSRT102180 HPSBMU03409 RHSA-2015:1115 20150612 Multiple Vulnerabilities in OpenSSL (June 2015) Affecting Cisco Products DSA-3287 http://www.fortiguard.com/advisory/2015-06-11-fortinet-vulnerability-openssl-vulnerabilities-june-2015 http://www.fortiguard.com/advisory/openssl-vulnerabilities-june-2015 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 75154 91787 1032564 USN-2639-1 https://bto.bluecoat.com/security-advisory/sa98 https://github.com/openssl/openssl/commit/cd30f03ac5bf2962f44bd02ae8d88245dff2f12c https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05131044 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05353965 https://kc.mcafee.com/corporate/index?page=content&id=SB10122 https://openssl.org/news/secadv/20150611.txt GLSA-201506-02 https://support.apple.com/kb/HT205031 https://support.citrix.com/article/CTX216642 https://www.openssl.org/news/secadv_20150611.txt The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly process X.509 Basic Constraints cA values during identification of alternative certificate chains, which allows remote attackers to spoof a Certification Authority role and trigger unintended certificate verifications via a valid leaf certificate. http://fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery NetBSD-SA2015-008 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10694 FEDORA-2015-11414 FEDORA-2015-11475 SSRT102180 HPSBGN03424 http://openssl.org/news/secadv_20150709.txt 20150710 OpenSSL Alternative Chains Certificate Forgery Vulnerability (July 2015) Affecting Cisco Products http://www.fortiguard.com/advisory/2015-07-09-cve-2015-1793-openssl-alternative-chains-certificate-forgery http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 75652 91787 1032817 SSA:2015-190-01 http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454058.htm https://git.openssl.org/?p=openssl.git;a=commit;h=9a0db453ba017ebcaccbee933ee6511a9ae4d1c8 https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04822825 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05184351 https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes https://kc.mcafee.com/corporate/index?page=content&id=SB10125 GLSA-201507-15 38640 FreeBSD-SA-15:12 The ssl3_get_key_exchange function in ssl/s3_clnt.c in OpenSSL 1.0.2 before 1.0.2e allows remote servers to cause a denial of service (segmentation fault) via a zero p value in an anonymous Diffie-Hellman (DH) ServerKeyExchange message. http://fortiguard.com/advisory/openssl-advisory-december-2015 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 openSUSE-SU-2016:0637 http://openssl.org/news/secadv/20151203.txt 20151204 Multiple Vulnerabilities in OpenSSL (December 2015) Affecting Cisco Products http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html 1034294 SSA:2015-349-04 USN-2830-1 https://git.openssl.org/?p=openssl.git;a=commit;h=ada57746b6b80beae73111fe1291bf8dd89af91c https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05398322 Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root. RHSA-2017:0484 RHSA-2017:0486 99311 1038128 https://bugzilla.redhat.com/show_bug.cgi?id=1200927 The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor. RHSA-2015:1176 RHSA-2015:1177 75370 https://shibboleth.net/community/advisories/secadv_20150225.txt ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC. http://bugs.ntp.org/show_bug.cgi?id=2779 APPLE-SA-2015-06-30-2 FEDORA-2015-5874 FEDORA-2015-5761 openSUSE-SU-2015:0775 SSRT102029 RHSA-2015:1459 http://support.apple.com/kb/HT204942 http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities 20150408 Multiple Vulnerabilities in ntpd (April 2015) Affecting Cisco Products 20150408 Network Time Protocol Daemon MAC Checking Failure Authentication Bypass Vulnerability DSA-3223 VU#374268 MDVSA-2015:202 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 73951 1032032 USN-2567-1 https://kc.mcafee.com/corporate/index?page=content&id=SB10114 GLSA-201509-01 The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer. http://bugs.ntp.org/show_bug.cgi?id=2781 [chrony-announce] 20150407 chrony-1.31.1 released (security) APPLE-SA-2015-06-30-2 FEDORA-2015-5874 FEDORA-2015-5761 openSUSE-SU-2015:0775 SSRT102029 HPSBHF03557 RHSA-2015:1459 http://support.apple.com/kb/HT204942 http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities 20150408 Multiple Vulnerabilities in ntpd (April 2015) Affecting Cisco Products 20150408 Network Time Protocol Daemon Symmetric Mode Packet Processing Denial of Service Vulnerability DSA-3222 DSA-3223 VU#374268 MDVSA-2015:202 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 73950 1032031 USN-2567-1 https://kc.mcafee.com/corporate/index?page=content&id=SB10114 GLSA-201509-01 The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information. [oss-security] 20150921 Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities [oss-security] 20150921 Samsung S4 (GT-I9500) multiple kernel vulnerabilities [oss-security] 20150922 Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities 76807 The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to cause a denial of service (memory corruption) or gain privileges. [oss-security] 20150921 Re: Samsung S4 (GT-I9500) multiple kernel vulnerabilities [oss-security] 20150921 Samsung S4 (GT-I9500) multiple kernel vulnerabilities 76807 The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file. http://advisories.mageia.org/MGASA-2015-0113.html FEDORA-2015-4199 FEDORA-2015-4230 openSUSE-SU-2015:0614 SUSE-SU-2015:0674 SUSE-SU-2015:0702 RHSA-2015:1708 DSA-3194 MDVSA-2015:145 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 73277 1031935 USN-2536-1 http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/ GLSA-201507-21 The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly handle character bitmaps it cannot read, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a crafted BDF font file. <a href="http://cwe.mitre.org/data/definitions/476.html">CWE-476: NULL Pointer Dereference</a> http://advisories.mageia.org/MGASA-2015-0113.html FEDORA-2015-4199 FEDORA-2015-4230 openSUSE-SU-2015:0614 SUSE-SU-2015:0674 SUSE-SU-2015:0702 RHSA-2015:1708 DSA-3194 MDVSA-2015:145 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 73280 1031935 USN-2536-1 http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/ GLSA-201507-21 The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file. http://advisories.mageia.org/MGASA-2015-0113.html FEDORA-2015-4199 FEDORA-2015-4230 openSUSE-SU-2015:0614 SUSE-SU-2015:0674 SUSE-SU-2015:0702 openSUSE-SU-2015:2300 RHSA-2015:1708 DSA-3194 MDVSA-2015:145 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 73279 1031935 USN-2536-1 http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/ GLSA-201507-21 The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=637b58c2887e5e57850865839cc75f59184b23d1 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f0d1bec9d58d4c038d0ac958c9af82be6eb18045 SUSE-SU-2015:1224 SUSE-SU-2015:1324 SUSE-SU-2015:1478 SUSE-SU-2015:1487 SUSE-SU-2015:1488 SUSE-SU-2015:1489 SUSE-SU-2015:1490 SUSE-SU-2015:1491 SUSE-SU-2015:1592 SUSE-SU-2015:1611 RHSA-2015:1042 RHSA-2015:1081 RHSA-2015:1082 RHSA-2015:1120 RHSA-2015:1137 RHSA-2015:1138 RHSA-2015:1190 RHSA-2015:1199 RHSA-2015:1211 http://source.android.com/security/bulletin/2016-04-02.html http://source.android.com/security/bulletin/2016-05-01.html DSA-3290 [oss-security] 20150606 CVE-2015-1805 Linux kernel: pipe: iovec overrun leading to memory corruption http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 74951 1032454 USN-2679-1 USN-2680-1 USN-2681-1 USN-2967-1 USN-2967-2 https://bugzilla.redhat.com/show_bug.cgi?id=1202855 https://github.com/torvalds/linux/commit/637b58c2887e5e57850865839cc75f59184b23d1 https://github.com/torvalds/linux/commit/f0d1bec9d58d4c038d0ac958c9af82be6eb18045 The combination filter Groovy script in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with job configuration permission to gain privileges and execute arbitrary code on the master via unspecified vectors. RHSA-2015:1844 RHSA-2016:0070 https://bugzilla.redhat.com/show_bug.cgi?id=1205620 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 Directory traversal vulnerability in Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users with certain permissions to read arbitrary files via a symlink, related to building artifacts. RHSA-2015:1844 RHSA-2016:0070 https://bugzilla.redhat.com/show_bug.cgi?id=1205622 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 Jenkins before 1.600 and LTS before 1.596.1 allows remote authenticated users to cause a denial of service (improper plug-in and tool installation) via crafted update center data. RHSA-2015:1844 RHSA-2016:0070 https://bugzilla.redhat.com/show_bug.cgi?id=1205623 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 The HudsonPrivateSecurityRealm class in Jenkins before 1.600 and LTS before 1.596.1 does not restrict access to reserved names when using the "Jenkins' own user database" setting, which allows remote attackers to gain privileges by creating a reserved name. RHSA-2015:1844 RHSA-2016:0070 https://bugzilla.redhat.com/show_bug.cgi?id=1205627 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-02-27 Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813. RHSA-2015:1844 RHSA-2016:0070 https://bugzilla.redhat.com/show_bug.cgi?id=1205615 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23 Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1812. RHSA-2015:1844 RHSA-2016:0070 https://bugzilla.redhat.com/show_bug.cgi?id=1205615 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23 The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users. RHSA-2015:1844 RHSA-2016:0070 https://bugzilla.redhat.com/show_bug.cgi?id=1205616 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-03-23 The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name. FEDORA-2015-4833 FEDORA-2015-4838 FEDORA-2015-4792 RHSA-2015:0729 [oss-security] 20150326 Fwd: setroubleshoot root exploit (CVE-Request) 73374 https://bugzilla.redhat.com/show_bug.cgi?id=1203352 https://bugzilla.redhat.com/show_bug.cgi?id=1206050 https://github.com/stealth/troubleshooter 36564 Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate. http://projects.theforeman.org/issues/9858 RHSA-2015:1591 RHSA-2015:1592 https://github.com/theforeman/foreman/pull/2265 https://groups.google.com/forum/#!topic/foreman-announce/9ZnuPcplNLI Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors. [oss-security] 20150330 Security advisory for musl libc - stack-based buffer overflow in ipv6 literal parsing [CVE-2015-1817] 73408 XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> RHSA-2015:1539 RHSA-2015:1704 The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack. APPLE-SA-2016-03-21-1 APPLE-SA-2016-03-21-2 APPLE-SA-2016-03-21-3 APPLE-SA-2016-03-21-5 FEDORA-2015-c24af963a2 FEDORA-2015-037f844d3e openSUSE-SU-2015:2372 openSUSE-SU-2016:0106 RHSA-2015:1419 RHSA-2015:2550 DSA-3430 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 75570 1034243 USN-2812-1 http://xmlsoft.org/news.html https://git.gnome.org/browse/libxml2/commit/?id=213f1fe0d76d30eaed6e5853057defc43e6df2c9 GLSA-201507-08 GLSA-201701-37 https://support.apple.com/HT206166 https://support.apple.com/HT206167 https://support.apple.com/HT206168 https://support.apple.com/HT206169 REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect. [oss-security] 20150323 CVE-2015-1820: ruby rest-client session fixation vulnerability 73295 https://bugzilla.redhat.com/show_bug.cgi?id=1205291 https://github.com/rest-client/rest-client/issues/369 Heap-based buffer overflow in chrony before 1.31.1 allows remote authenticated users to cause a denial of service (chronyd crash) or possibly execute arbitrary code by configuring the (1) NTP or (2) cmdmon access with a subnet size that is indivisible by four and an address with a nonzero bit in the subnet remainder. [chrony-announce] 20150407 chrony-1.31.1 released (security) DSA-3222 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 73955 GLSA-201507-01 chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests. [chrony-announce] 20150407 chrony-1.31.1 released (security) DSA-3222 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 73956 GLSA-201507-01 The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups. FEDORA-2015-4747 FEDORA-2015-4788 RHSA-2015:0728 73376 https://bugzilla.redhat.com/show_bug.cgi?id=1205200 https://fedorahosted.org/freeipa/ticket/4908 The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack. https://github.com/ruby/openssl/issues/8 https://groups.google.com/forum/#!topic/httprb/jkb4oxwZjkU https://rubysec.com/advisories/http-CVE-2015-1828 Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.7, 11.1.1.9, 12.1.2.0, and 12.1.3.0 allows remote attackers to affect availability via unknown vectors related to Web Listener. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html">The fix also addresses CVE-2015-3183.</a> http://www.apache.org/dist/apr/Announcement1.x.html http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 75164 1032617 Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors. http://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txt 76452 1033315 http://www.zerodayinitiative.com/advisories/ZDI-15-407 http://www.zerodayinitiative.com/advisories/ZDI-15-407/ [activemq-commits] 20190327 svn commit: r1042639 - in /websites/production/activemq/content/activemq-website: ./ projects/artemis/download/ projects/classic/download/ projects/cms/download/ security-advisories.data/ The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. 75940 1032985 https://struts.apache.org/docs/s2-024.html XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype. 93132 http://www-01.ibm.com/support/docview.wss?uid=swg21990100 https://issues.apache.org/jira/browse/DERBY-6807 https://svn.apache.org/viewvc?view=revision&revision=1691461 https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request. [jackrabbit-announce] 20150521 CVE-2015-1833 (Jackrabbit WebDAV XXE vulnerability) http://packetstormsecurity.com/files/132005/Jackrabbit-WebDAV-XXE-Injection.html http://www.apache.org/dist/jackrabbit/2.10.1/RELEASE-NOTES.txt DSA-3298 20150521 CVE-2015-1833 (Jackrabbit WebDAV XXE vulnerability) 74761 https://issues.apache.org/jira/browse/JCR-3883 37110 A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.4.2. Path traversal is the 'outbreak' of a given directory structure through relative file paths in the user input. It aims at accessing files and directories that are stored outside the web root folder, for disallowed reading or even executing arbitrary system commands. An attacker could use a certain parameter of the file path for instance to inject '../' sequences in order to navigate through the file system. In this particular case a remote authenticated attacker can exploit the identified vulnerability in order to upload arbitrary files to the server running a Cloud Controller instance - outside the isolated application container. 98691 https://pivotal.io/security/cve-2015-1834 Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL. http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps/ 74866 https://cordova.apache.org/announcements/2015/05/26/android-402.html Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic. [www-announce] 20150525 CVE-2015-1836: Apache HBase remote denial of service, information integrity, and information disclosure vulnerability 1034365 http://www-01.ibm.com/support/docview.wss?uid=swg21969546 https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. FEDORA-2016-105b3b8804 https://bugzilla.redhat.com/show_bug.cgi?id=1212784 https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. FEDORA-2016-105b3b8804 https://bugzilla.redhat.com/show_bug.cgi?id=1212788 https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html https://github.com/saltstack/salt/commit/22d2f7a1ec93300c34e8c42d14ec39d51e610b5c https://github.com/saltstack/salt/commit/b49d0d4b5ca5c6f31f03e2caf97cef1088eeed81 jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value. FEDORA-2015-10258 FEDORA-2015-10144 openSUSE-SU-2015:1260 [oss-security] 20150616 [CVE-2015-1840] CSRF Vulnerability in jquery-ujs and jquery-rails 75239 https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md https://github.com/rails/jquery-ujs/blob/master/CHANGELOG.md [rubyonrails-security] 20150616 [CVE-2015-1840] CSRF Vulnerability in jquery-ujs and jquery-rails The Web Admin interface in Red Hat Enterprise Virtualization Manager (RHEV-M) allows local users to bypass the timeout function by selecting a VM in the VM grid view. RHSA-2015:1713 1033459 The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors. RHSA-2015:0789 RHSA-2015:0791 RHSA-2015:0830 RHSA-2015:0831 RHSA-2015:0832 74049 https://bugzilla.redhat.com/show_bug.cgi?id=1201875 The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. NOTE: this vulnerability exists because of a CVE-2014-5277 regression. RHSA-2015:0776 73936 https://bugzilla.redhat.com/show_bug.cgi?id=1206443 Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API. http://projects.theforeman.org/issues/9947 RHSA-2015:1591 RHSA-2015:1592 https://github.com/theforeman/foreman/pull/2273 https://groups.google.com/forum/#!topic/foreman-announce/37KYWhIk4FY https://groups.google.com/forum/#!topic/foreman-users/qAGZh5n6n6M Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors. [oss-security] 20150401 CVE-2015-1845, CVE-2015-1846 - unzoo - Buffer overflow & Infinite loop 73693 1032011 https://bugzilla.redhat.com/show_bug.cgi?id=1207645 unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vectors to the (1) ExtrArch or (2) ListArch function, related to pointer handling. [oss-security] 20150401 CVE-2015-1845, CVE-2015-1846 - unzoo - Buffer overflow & Infinite loop 73686 1032011 https://bugzilla.redhat.com/show_bug.cgi?id=1207647 Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally inaccessible files via a .. (dot dot) in a crafted URL. http://appserver.io/security/2015/03/31/traversal-directory-vulnerability-in-webserver.html The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag. FEDORA-2015-8761 FEDORA-2015-8788 FEDORA-2015-8765 RHSA-2015:0980 RHSA-2015:0990 74623 https://bugzilla.redhat.com/attachment.cgi?id=1009855 AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled. https://bugzilla.redhat.com/show_bug.cgi?id=1199641 https://bugzilla.redhat.com/show_bug.cgi?id=1208580 https://github.com/wildfly-security/jboss-negotiation/commit/0dc9d191b6eb1d13b8f0189c5b02ba6576f4722e https://github.com/wildfly-security/jboss-negotiation/pull/21 OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2 signature in an image to the upload-to-image command. [openstack-announce] 20150616 [OSSA 2015-011.1] Cinder host file disclosure through qcow2 backing file (CVE-2015-1851) ERRATA 1 RHSA-2015:1206 DSA-3292 [oss-security] 20150613 CVE-2015-1850: OpenStack Cinder/Nova: Format-guessing and file disclosure in image convert [oss-security] 20150617 Re: [OSSA 2015-011] Cinder host file disclosure through qcow2 backing file (CVE-2015-1850) [oss-security] 20150617 Re: [OSSA 2015-011] Cinder host file disclosure through qcow2 backing file (CVE-2015-1850) USN-2703-1 https://bugs.launchpad.net/cinder/+bug/1415087 The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144. [openstack-announce] 20150414 [OSSA 2015-007] S3Token TLS cert verification option not honored (CVE-2015-1852) RHSA-2015:1677 RHSA-2015:1685 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 74187 USN-2705-1 https://bugs.launchpad.net/keystonemiddleware/+bug/1411063 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call. FEDORA-2015-7206 74392 RHSA-2015:0895 https://bugzilla.redhat.com/show_bug.cgi?id=1209573 [debian-lts-announce] 20180715 [SECURITY] [DLA 1428-1] 389-ds-base security update OpenStack Object Storage (Swift) before 2.3.0, when allow_version is configured, allows remote authenticated users to delete the latest version of an object by leveraging listing access to the x-versions-location container. FEDORA-2015-12245 [openstack-announce] 20150414 [OSSA 2015-006] Unauthorized delete of versioned Swift object (CVE-2015-1856) SUSE-SU-2015:1846 RHSA-2015:1681 RHSA-2015:1684 RHSA-2015:1845 RHSA-2015:1846 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 74182 USN-2704-1 https://bugs.launchpad.net/swift/+bug/1430645 The odl-mdsal-apidocs feature in OpenDaylight Helium allow remote attackers to obtain sensitive information by leveraging missing AAA restrictions. https://cloudrouter.org/security/ https://git.opendaylight.org/gerrit/#/c/17709/ https://wiki.opendaylight.org/view/Security_Advisories Multiple buffer overflows in gui/image/qbmphandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted BMP image. FEDORA-2015-6114 FEDORA-2015-6123 FEDORA-2015-6315 FEDORA-2015-6364 FEDORA-2015-6252 [Announce] 20150413 Qt Project Security Advisory - Multiple Vulnerabilities in Qt Image Format Handling 74309 USN-2626-1 https://codereview.qt-project.org/#/c/108312/ GLSA-201603-10 Multiple buffer overflows in plugins/imageformats/ico/qicohandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault and crash) and possibly execute arbitrary code via a crafted ICO image. FEDORA-2015-6114 FEDORA-2015-6123 FEDORA-2015-6315 FEDORA-2015-6364 FEDORA-2015-6252 [Announce] 20150413 Qt Project Security Advisory - Multiple Vulnerabilities in Qt Image Format Handling 74307 74310 USN-2626-1 GLSA-201603-10 Multiple buffer overflows in gui/image/qgifhandler.cpp in the QtBase module in Qt before 4.8.7 and 5.x before 5.4.2 allow remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a crafted GIF image. FEDORA-2015-6114 FEDORA-2015-6123 FEDORA-2015-6613 FEDORA-2015-6315 FEDORA-2015-6364 FEDORA-2015-6252 FEDORA-2015-6661 FEDORA-2015-6573 [Announce] 20150413 Qt Project Security Advisory - Multiple Vulnerabilities in Qt Image Format Handling 74302 USN-2626-1 https://codereview.qt-project.org/#/c/108248/ GLSA-201603-10 The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment. http://packetstormsecurity.com/files/131422/Fedora-abrt-Race-Condition.html http://packetstormsecurity.com/files/131423/Linux-Apport-Abrt-Local-Root-Exploit.html http://packetstormsecurity.com/files/131429/Abrt-Apport-Race-Condition-Symlink.html 20150414 Problems in automatic crash analysis frameworks [oss-security] 20150414 Problems in automatic crash analysis frameworks 74263 https://bugzilla.redhat.com/show_bug.cgi?id=1211223 https://github.com/abrt/abrt/pull/810 36746 36747 Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries. openSUSE-SU-2015:0813 http://packetstormsecurity.com/files/131598/Android-wpa_supplicant-Heap-Overflow.html RHSA-2015:1090 20150424 [ALICLOUDSEC-VUL2015-001]Android wpa_supplicant WLAN Direct remote buffer overflow http://security.alibaba.com/blog/blog.htm?spm=0.0.0.0.p1ECc3&id=19 http://w1.fi/security/2015-1/wpa_supplicant-p2p-ssid-overflow.txt DSA-3233 20150423 [ALICLOUDSEC-VUL2015-001]Android wpa_supplicant WLAN Direct remote buffer overflow 74296 1032192 USN-2577-1 GLSA-201606-17 Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) first name or (2) last name user details, or the (3) repository, (4) repository group, or (5) user group description. [oss-security] 20150414 CVE-2015-1864: Multiple HTML and Javascript injections 74184 https://kallithea-scm.org/repos/kallithea/changeset/a8f2986afc18c9221bf99f88b06e60ab83c86c55 https://kallithea-scm.org/security/cve-2015-1864.html fts.c in coreutils 8.4 allows local users to delete arbitrary files. 76073 https://bugzilla.redhat.com/show_bug.cgi?id=1211300 Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2. [oss-security] 20150414 [CVE-2015-1866] Ember.js XSS Vulnerability With {{view 74185 https://emberjs.com/blog/2015/04/14/security-and-bugfix-releases-ember-1-10-1-1-11-2-1-11-3.html Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command. FEDORA-2015-e5e36bbb87 FEDORA-2015-f6860d8f9d FEDORA-2015-f9864ecd8f RHSA-2015:1424 RHSA-2015:2383 74231 https://bugzilla.redhat.com/show_bug.cgi?id=1211370 https://github.com/ClusterLabs/pacemaker/commit/84ac07c GLSA-201710-08 The label decompression functionality in PowerDNS Recursor 3.5.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.2 and Authoritative (Auth) Server 3.2.x, 3.3.x before 3.3.2, and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a name that refers to itself. FEDORA-2015-7079 FEDORA-2015-7033 FEDORA-2015-7057 FEDORA-2015-7047 FEDORA-2015-7031 FEDORA-2015-7018 DSA-3306 DSA-3307 74306 1032220 The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors. RHSA-2015:1083 RHSA-2015:1210 75119 https://bugzilla.redhat.com/show_bug.cgi?id=1212868 https://github.com/abrt/abrt/commit/7d023c32a565e83306cddf34c894477b7aaf33d1 https://github.com/abrt/abrt/commit/8939398b82006ba1fec4ed491339fc075f43fc7c https://github.com/abrt/libreport/commit/c962918bc70a61a8cc647898ee8b1ff1c14a87c5 The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data. http://git.videolan.org/?p=ffmpeg.git;a=commit;h=fabbfaa095660982cc0bc63242c459561fa37037 72644 1033078 USN-2944-1 [debian-lts-announce] 20190330 [SECURITY] [DLA 1740-1] libav security update Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8.32 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete all plugin records via a request in the CF7DBPluginSubmissions page to wp-admin/admin.php. http://packetstormsecurity.com/files/130654/WordPress-Contact-Form-DB-2.8.29-Cross-Site-Request-Forgery.html 20150304 CSRF in Contact Form DB allows attacker to delete all stored form submissions (WordPress plugin) 72964 https://security.dxw.com/advisories/csrf-in-contact-form-db-allows-attacker-to-delete-all-stored-form-submissions/ https://wordpress.org/plugins/contact-form-7-to-database-extension/changelog/ SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitrary SQL commands via the transactionID parameter. http://packetstormsecurity.com/files/130698/Elastix-2.5.0-SQL-Injection.html 36305 Directory traversal vulnerability in ES File Explorer 3.2.4.1. http://packetstormsecurity.com/files/130431/ES-File-Explorer-3.2.4.1-Path-Traversal.html Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign arbitrary data with previously loaded signing keys, extract the device identification key [KNETI] and impersonate the nShield Connect device on a network, affect the integrity and confidentiality of newly created keys, and potentially cause other unspecified impacts using previously loaded keys by connecting to the USB port on the front panel. 1032152 Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arbitrary web script or HTML via the profile parameter in an edit action in the gde-settings page to wp-admin/options-general.php. http://packetstormsecurity.com/files/130309/WordPress-Google-Doc-Embedder-2.5.18-Cross-Site-Scripting.html 72547 https://wordpress.org/plugins/google-document-embedder/changelog/ Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www.fortiguard.com/advisory/FG-IR-15-005/ 74652 1032261 1032262 1032264 1032265 OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684. [openstack-announce] 20150223 [OSSA 2015-004] Glance import task leaks image in backend (CVE-2014-9684, CVE-2015-1881) RHSA-2015:0938 72694 https://bugs.launchpad.net/glance/+bug/1420696 Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user. 74222 1032190 PI33357 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read certain administrative files via crafted use of an automated-maintenance policy stored procedure. 75946 1032881 IT08075 IT08080 IT08085 IT08086 http://www-01.ibm.com/support/docview.wss?uid=swg21698308 Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, and 8.5.5 through 8.5.5.0 and WebSphere Lombardi Edition (WLE) 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via a crafted internationalization-file URL. 75360 1032700 1032701 JR52957 http://www-01.ibm.com/support/docview.wss?uid=swg21700831 WebSphereOauth20SP.ear in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, 8.5 Liberty Profile before 8.5.5.5, and 8.5 Full Profile before 8.5.5.6, when the OAuth grant type requires sending a password, allows remote attackers to gain privileges via unspecified vectors. 74219 1032190 PI33202 PI36211 http://www-01.ibm.com/support/docview.wss?uid=swg21697368 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 The Remote Document Conversion Service (DCS) in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05 allows remote attackers to cause a denial of service (memory consumption) via crafted requests. 74216 1032189 PI37356 http://www-01.ibm.com/support/docview.wss?uid=swg21701566 IBM WebSphere Portal 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to obtain sensitive Java Content Repository (JCR) information via a crafted request. 75475 1032970 PI36150 http://www-01.ibm.com/support/docview.wss?uid=swg21958024 Cross-site scripting (XSS) vulnerability in IBM Content Navigator 2.0.2 before 2.0.2-ICN-FP007 and 2.0.3 before 2.0.3-ICN-FP003, as used in Content Manager, FileNet Content Manager, Content Foundation, Content Manager OnDemand, and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. http://www-01.ibm.com/support/docview.wss?uid=swg21700205 The Big SQL component in IBM InfoSphere BigInsights 3.0 through 3.0.0.2 allows remote authenticated users to bypass intended HDFS data-access restrictions via (1) a crafted CREATE HADOOP TABLE statement referencing the data of an arbitrary user or (2) an import of a certain Hive table definition with the HCAT_SYNC_OBJECTS procedure. 1032150 http://www-01.ibm.com/support/docview.wss?uid=swg21700654 /usr/lpp/mmfs/bin/gpfs.snap in IBM General Parallel File System (GPFS) 4.1 before 4.1.0.7 produces an archive potentially containing cleartext keys, and lacks a warning about reviewing this archive to detect included keys, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream. http://www.ibm.com/support/docview.wss?uid=isg3T1022077 73918 The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets. VU#550620 73683 IV70911 IV70913 http://www-01.ibm.com/support/docview.wss?uid=swg21699497 The IBM WebSphere DataPower XC10 appliance 2.1 before 2.1.0.3 allows remote attackers to hijack the sessions of arbitrary users, and consequently obtain sensitive information or modify data, via unspecified vectors. 73916 1032025 IT07841 http://www-01.ibm.com/support/docview.wss?uid=swg21701337 Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Optim Workload Replay 2.x before 2.1.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. 74441 http://www-01.ibm.com/support/docview.wss?uid=swg21700768 IBM InfoSphere Optim Workload Replay 2.x before 2.1.0.3 relies on client-side code to verify authorization, which allows remote attackers to bypass intended access restrictions by modifying the client behavior. 74442 http://www-01.ibm.com/support/docview.wss?uid=swg21700768 Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows remote attackers to execute arbitrary code via unspecified vectors. 74024 http://www-01.ibm.com/support/docview.wss?uid=swg21700536 20150410 IBM Tivoli Storage Manager FastBackMount " GetValByKey" Buffer Overflow Vulnerability Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1898. 1032102 http://www-01.ibm.com/support/docview.wss?uid=swg21700057 20150410 IBM Tivoli Storage Manager FastBackMount "Insecure sprintf Use" Buffer Overflow Vulnerability Stack-based buffer overflow in the FastBackMount process in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.11.1 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1897. 74036 1032102 http://www-01.ibm.com/support/docview.wss?uid=swg21700539 20150410 IBM Tivoli Storage Manager FastBackMount "Insecure sscanf Use" Buffer Overflow Vulnerability IBM WebSphere Portal 8.5 through CF05 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. PI37139 http://www-01.ibm.com/support/docview.wss?uid=swg21700066 IBM InfoSphere DataStage 8.1, 8.5, 8.7, 9.1, and 11.3 through 11.3.1.2 on UNIX allows local users to write to executable files, and consequently obtain root privileges, via unspecified vectors. 75481 JR52770 http://www-01.ibm.com/support/docview.wss?uid=swg21902280 The installer in IBM InfoSphere Information Server 8.5 through 11.3 before 11.3.1.2 allows local users to obtain sensitive information via unspecified commands. 75162 1032633 JR52549 http://www-01.ibm.com/support/docview.wss?uid=swg21701436 Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image, aka SPR KLYH9TSMLA. 74597 1032376 http://www.zerodayinitiative.com/advisories/ZDI-15-193 http://www-01.ibm.com/support/docview.wss?uid=swg21883245 Stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image, aka SPR KLYH9TSN3Y. 74598 1032376 http://www.zerodayinitiative.com/advisories/ZDI-15-194 http://www-01.ibm.com/support/docview.wss?uid=swg21883245 IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0, when external Enterprise Content Management (ECM) integration is enabled with a certain technical system account configuration, allows remote authenticated users to bypass intended document-access restrictions via a (1) upload or (2) download action. 1033159 JR53209 http://www-01.ibm.com/support/docview.wss?uid=swg21960293 The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors. 75977 1033002 JR52772 http://www-01.ibm.com/support/docview.wss?uid=swg21700717 Cross-site scripting (XSS) vulnerability in the REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. 1033002 JR52772 http://www-01.ibm.com/support/docview.wss?uid=swg21700717 The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4 before 8.1.4.7 allows remote authenticated users to read cookies via unspecified vectors. 74552 1032257 http://www-01.ibm.com/support/docview.wss?uid=swg21882666 Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF16, and 8.5.0 through CF05, as used in Web Content Manager and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted URL. 74218 1032189 PI37661 http://www-01.ibm.com/support/docview.wss?uid=swg21701566 The XML parser in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, 11.3, and 11.4 before FP2 allows remote attackers to read arbitrary files, and consequently obtain administrative access, via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. http://www-01.ibm.com/support/docview.wss?uid=swg21700754 Cross-site scripting (XSS) vulnerability in the Reference Data Management component in the server in IBM InfoSphere Master Data Management (MDM) 10.1 before IF1, 11.0 before FP3, and 11.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. http://www-01.ibm.com/support/docview.wss?uid=swg21700741 Cross-site scripting (XSS) vulnerability in Sterling Order Management 8.5 before HF113, Sterling Selling and Fulfillment Foundation 9.0.0 before FP92, and Sterling Field Sales (SFS) 9.0 before HF7 in IBM Sterling Selling and Fulfillment Suite allows remote attackers to inject arbitrary web script or HTML via a crafted URL. 74224 http://www-01.ibm.com/support/docview.wss?uid=swg21700864 Rational Test Control Panel in IBM Rational Test Workbench and Rational Test Virtualization Server 8.0.0.x before 8.0.0.5, 8.0.1.x before 8.0.1.6, 8.5.0.x before 8.5.0.4, 8.5.1.x before 8.5.1.5, 8.6.0.x before 8.6.0.4, and 8.7.0.x before 8.7.0.2 uses the MD5 algorithm for password hashing, which makes it easier for remote attackers to bypass authentication via unspecified vectors. 75307 http://www-01.ibm.com/support/docview.wss?uid=swg21959298 IBM Java 7 R1 before SR3, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to bypass "permission checks" and obtain sensitive information via vectors related to the Java Virtual Machine. SUSE-SU-2015:1073 SUSE-SU-2015:1085 SUSE-SU-2015:1086 SUSE-SU-2015:1138 SUSE-SU-2015:1161 RHSA-2015:1006 RHSA-2015:1007 RHSA-2015:1020 RHSA-2015:1021 RHSA-2015:1091 74645 IV72245 IV72246 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 The Endpoint Manager for Remote Control component in IBM Tivoli Endpoint Manager for Lifecycle Management 9.0.1 before IF6 and 9.1.0 before IF6 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. 74193 IV72069 http://www-01.ibm.com/support/docview.wss?uid=swg21882571 Unspecified vulnerability in IBM Java 8 before SR1 allows remote attackers to cause a denial of service via unknown vectors related to SSL/TLS and the Secure Socket Extension provider. 1032779 IV72245 http://www-01.ibm.com/support/docview.wss?uid=swg21883640 Cross-site scripting (XSS) vulnerability in the Active Content Filtering component in IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. 75479 1032970 PI38732 http://www-01.ibm.com/support/docview.wss?uid=swg21958024 Cross-site scripting (XSS) vulnerability in IBM Security QRadar Incident Forensics before 7.2.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. 75209 http://www-01.ibm.com/support/docview.wss?uid=swg21960011 IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.11, and 8.5 before 8.5.5.6 allows remote attackers to execute arbitrary code by sending crafted instructions in a management-port session. 74439 1032249 PI38302 http://www-01.ibm.com/support/docview.wss?uid=swg21883573 Open redirect vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF17 and 8.5.0 before CF06 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> 74705 PI38632 http://www-01.ibm.com/support/docview.wss?uid=swg21884060 The Data Movement implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to bypass intended access restrictions and delete table rows via unspecified vectors. 75911 1032879 IT08523 IT08524 IT08525 IT08526 http://www-01.ibm.com/support/docview.wss?uid=swg21959650 Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors. 75445 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-264 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965. 75447 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-267 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965. 75449 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-266 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 and 11.1.1.9.0, and the Oracle Applications Framework component in Oracle E-Business Suite 12.2.3 and 12.2.4, allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Portal. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75860 1032926 The default configuration of IBM WebSphere Application Server (WAS) 7.0.0 before 7.0.0.39, 8.0.0 before 8.0.0.11, and 8.5 before 8.5.5.6 has a false value for the com.ibm.ws.webcontainer.disallowServeServletsByClassname WebContainer property, which allows remote attackers to obtain privileged access via unspecified vectors. 75486 1033383 PI31622 http://www-01.ibm.com/support/docview.wss?uid=swg21959083 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.x before 6.0.0 IF4; Rational Quality Manager (RQM) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.0 before 6.0.0 IF4; Rational Team Concert (RTC) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.0 before 6.0.0 IF4; Rational Requirements Composer (RRC) 3.x before 3.0.1.6 IF7 and 4.x before 4.0.7 IF9; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF11, and 6.0 before 6.0.0 IF4; Rational Engineering Lifecycle Manager (RELM) 4.0.3 through 4.0.7, 5.0 through 5.0.2, and 6.0.0; Rational Rhapsody Design Manager (DM) 4.0 through 4.0.7, 5.0 through 5.0.2, and 6.0.0; and Rational Software Architect Design Manager (DM) 4.0 through 4.0.7, 5.0 through 5.0.2, and 6.0.0 allows remote authenticated users to conduct clickjacking attacks via a crafted web site. 1034565 1034566 1034567 1034568 http://www-01.ibm.com/support/docview.wss?uid=swg21973200 Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965. 75451 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-263 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965. 75452 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-265 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 IBM WebSphere Application Server 7.x before 7.0.0.39, 8.0.x before 8.0.0.11, and 8.5.x before 8.5.5.7 and WebSphere Virtual Enterprise before 7.0.0.7 allow remote attackers to obtain potentially sensitive information about the proxy-server software by reading the HTTP Via header. 76466 1033325 PI38403 http://www-01.ibm.com/support/docview.wss?uid=swg21963275 IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX001 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not have an off autocomplete attribute for the password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation. Per http://www-01.ibm.com/support/docview.wss?uid=swg21965080: " This vulnerability could allow a local attacker to obtain account access." http://www-01.ibm.com/support/docview.wss?uid=swg21965080 IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX002, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX002 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not properly encrypt passwords, which makes it easier for context-dependent attackers to determine cleartext passwords by leveraging access to a password file. http://www-01.ibm.com/support/docview.wss?uid=swg21964855 The scalar-function implementation in IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors. 75908 1033063 IT08543 IT08656 IT08667 IT08668 http://www-01.ibm.com/support/docview.wss?uid=swg21902661 The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter. 75480 PI37230 http://www-01.ibm.com/support/docview.wss?uid=swg21959083 IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a session on port 27017. 74911 http://www-01.ibm.com/support/docview.wss?uid=nas8N1020731 IT08806 The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2015-1986. 75444 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-272 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to read arbitrary files via a crafted TCP packet to an unspecified port. 75446 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-268 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to write to arbitrary files, and subsequently execute these files, via a crafted TCP packet to an unspecified port. 75450 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-269 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request. 1033444 PI39617 http://www-01.ibm.com/support/docview.wss?uid=swg21962567 Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF17 and 8.5.0 before CF06 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. 75478 1032970 PI40341 http://www-01.ibm.com/support/docview.wss?uid=swg21958024 Unspecified vulnerability in the Reference Data Management component in IBM InfoSphere Master Data Management 10.1, 11.0, 11.3 before FP3, and 11.4 allows remote authenticated users to gain privileges via unknown vectors. 74929 http://www-01.ibm.com/support/docview.wss?uid=swg21957776 IBM WebSphere Application Server (WAS) 8.5 before 8.5.5.6, and WebSphere Virtual Enterprise 7.0 before 7.0.0.6 for WebSphere Application Server (WAS) 7.0 and 8.0, does not properly implement user roles, which allows local users to gain privileges via unspecified vectors. 75496 PI35180 http://www-01.ibm.com/support/docview.wss?uid=swg21959083 Untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, when a DB2 database is used, allows local users to gain privileges via a Trojan horse library that is loaded by a setuid or setgid program. <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> 79693 1034537 1034562 http://www-01.ibm.com/support/docview.wss?uid=swg21967131 http://www-304.ibm.com/support/docview.wss?uid=swg21970376 Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965. 75453 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-270 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands with SYSTEM privileges via unspecified vectors. 75459 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-271 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 IBM PowerVC Standard Edition 1.2.2.1 through 1.2.2.2 does not require authentication for access to the Python interpreter with nova credentials, which allows KVM guest OS users to discover certain PowerVC credentials and bypass intended access restrictions via unspecified Python code. 75102 http://www-01.ibm.com/support/docview.wss?uid=nas8N1020740 IT08926 IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.0 IFIX005 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation. 75340 http://www-01.ibm.com/support/docview.wss?uid=swg21959613 Cross-site scripting (XSS) vulnerability in IBM AppScan Enterprise Edition 9.0.x before 9.0.2 iFix 001 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 103416. http://www-01.ibm.com/support/docview.wss?uid=swg21883124 ibm-appscan-cve20151952-xss(103416) Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965. 75456 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-273 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965. 75448 1032773 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (CPU consumption) via a crafted byte sequence in authentication data. http://www-01.ibm.com/support/docview.wss?uid=swg21959205 IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1958 and CVE-2015-1987. http://www-01.ibm.com/support/docview.wss?uid=swg21959204 IBM WebSphere MQ 7.5.x before 7.5.0.6 and 8.0.x before 8.0.0.3 allows remote authenticated users to obtain sensitive information via a man-in-the-middle attack, related to duplication of message data in cleartext outside the protected payload. IBM X-Force ID: 103482. http://www-01.ibm.com/support/docview.wss?uid=swg21960506 ibm-mq-cve20151957-info-disc(103482) IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1956 and CVE-2015-1987. http://www-01.ibm.com/support/docview.wss?uid=swg21959210 IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not properly restrict encrypted files, which allows local users to obtain sensitive information or possibly have unspecified other impact via a (1) download or (2) upload action. 75442 1032734 http://www-01.ibm.com/support/docview.wss?uid=swg21960659 The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions and execute arbitrary JavaScript code on the server via an unspecified API call. 75536 1032972 JR53356 http://www-01.ibm.com/support/docview.wss?uid=swg21959052 Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965. 75454 1032773 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1964, and CVE-2015-1965. 75455 1032773 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, and CVE-2015-1965. 75457 1032773 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, and CVE-2015-1964. 75458 1032773 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before FP17, 6.2.1 before FP9, and 6.2.2 before FP15, as used in Security Access Manager for Mobile and other products, allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to the (1) ERROR_DESCRIPTION and (2) TOKEN:RelayState macros. 75537 1032767 IV74198 IV74199 IV74200 http://www-01.ibm.com/support/docview.wss?uid=swg21959071 MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option, which allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used. 1032772 http://www-01.ibm.com/support/docview.wss?uid=swg21960491 Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. 75476 http://www-01.ibm.com/support/docview.wss?uid=swg21960244 Cross-site scripting (XSS) vulnerability in IBM Tivoli Common Reporting (TCR) 2.1 before IF13 and 2.1.1 before IF21, and TCR 3.1.x as used in Cognos Business Intelligence before 10.2 IF0015 and other products, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. 76472 1034050 http://www-01.ibm.com/support/docview.wss?uid=swg21967384 The IBM WebSphere DataPower XC10 appliance 2.1 through 2.1.0.3 and 2.5 through 2.5.0.4 retains data on SSD cards, which might allow physically proximate attackers to obtain sensitive information by extracting a card and attaching it elsewhere. IT09803 http://www-01.ibm.com/support/docview.wss?uid=swg21962861 Unspecified vulnerability in Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF8 and 5.x before 5.0.2 IF10; Rational Quality Manager (RQM) 2.x and 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF8, and 5.x before 5.0.2 IF10; Rational Team Concert (RTC) 2.x and 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF8, and 5.x before 5.0.2 IF10; Rational Requirements Composer (RRC) 2.x and 3.x before 3.0.1.6 IF7 and 4.0 through 4.0.7; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF8 and 5.x before 5.0.2 IF10; Rational Engineering Lifecycle Manager (RELM) 1.0 through 1.0.0.1, 4.0.3 through 4.0.7, and 5.0 through 5.0.2; Rational Rhapsody Design Manager (DM) 3.0 through 3.0.1, 4.0 through 4.0.7, 5.0 through 5.0.2, and 6.0; and Rational Software Architect Design Manager (DM) 3.0 through 3.0.1, 4.0 through 4.0.7, and 5.0 through 5.0.2 allows remote attackers to cause a denial of service via unknown vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21971164 IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to obtain sensitive error-log information via a crafted POST request. 75441 1032734 http://www-01.ibm.com/support/docview.wss?uid=swg21960659 The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote authenticated users to bypass intended command restrictions via unspecified vectors. 75438 1032734 http://www-01.ibm.com/support/docview.wss?uid=swg21960659 The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, and 6.3 before iFix 37 and IBM Security Directory Server 6.3.1 before iFix 11 and 6.4 before iFix 2 allows local users to gain privileges via vectors related to argument injection. IBM X-Force ID: 103694. 103717 http://www-01.ibm.com/support/docview.wss?uid=swg21960659 ibm-sds-cve20151975-arg-injection(103694) IBM Security Directory Server could allow an authenticated user to execute commands into the web administration tool that would cause the tool to crash. http://www.ibm.com/support/docview.wss?uid=swg21980585 90526 Directory traversal vulnerability in the Web Administration tool in IBM Tivoli Directory Server (ITDS) before 6.1.0.74-ISS-ISDS-IF0074, 6.2.x before 6.2.0.50-ISS-ISDS-IF0050, and 6.3.x before 6.3.0.43-ISS-ISDS-IF0043 and IBM Security Directory Server (ISDS) before 6.3.1.18-ISS-ISDS-IF0018 and 6.4.x before 6.4.0.9-ISS-ISDS-IF0009 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL. http://www-01.ibm.com/support/docview.wss?uid=swg21986452 Cross-site scripting (XSS) vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 75435 1032734 http://www-01.ibm.com/support/docview.wss?uid=swg21960659 Multiple cross-site scripting (XSS) vulnerabilities in the Error dialog in IBM Case Manager 5.2.1 before 5.2.1.2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to the (1) addressability or (2) comments component. 75538 http://www-01.ibm.com/support/docview.wss?uid=swg21959695 IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors. 75143 http://www-01.ibm.com/support/docview.wss?uid=swg21960244 Cross-site scripting (XSS) vulnerability in the web server in IBM Domino 8.5.x before 8.5.3 FP6 IF8 and 9.x before 9.0.1 FP4, when Webmail is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYH9WYPR5. 20150619 IBM Domino Web Server Cross-site Scripting Vulnerability (CVE-2015-1981) 74908 1032673 http://www-01.ibm.com/support/docview.wss?uid=swg21959908 IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to obtain sensitive information via a crafted request, which reveals the full path in an error message. 75477 http://www-01.ibm.com/support/docview.wss?uid=swg21960244 Cross-site scripting (XSS) vulnerability in the Projects page in IBM UrbanCode Build 6.1.x before 6.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. http://www-01.ibm.com/support/docview.wss?uid=swg21964316 IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to bypass intended access restrictions and read arbitrary profiles via unspecified vectors, as demonstrated by discovering usernames for use in brute-force attacks. 75474 http://www-01.ibm.com/support/docview.wss?uid=swg21960244 The queue manager on IBM MQ M2000 appliances before 8.0.0.4 allows local users to bypass an intended password requirement and read private keys by leveraging the existence of a stash file. http://www-01.ibm.com/support/docview.wss?uid=swg21971445 The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2015-1938. 75461 1032773 http://www.zerodayinitiative.com/advisories/ZDI-15-274 http://www-01.ibm.com/support/docview.wss?uid=swg21959398 IBM MQ Light before 1.0.0.2 allows remote attackers to cause a denial of service (disk consumption) via a crafted byte sequence in authentication data, a different vulnerability than CVE-2015-1956 and CVE-2015-1958. http://www-01.ibm.com/support/docview.wss?uid=swg21961276 Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 and Tivoli Storage FlashCopy Manager for VMware 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.3.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. http://www-01.ibm.com/support/docview.wss?uid=swg21967532 SQL injection vulnerability in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21970116 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2015. Notes: none. IBM Systems Director 5.2.x, 6.1.x, 6.2.0.x, 6.2.1.x, 6.3.0.0, 6.3.1.x, 6.3.2.x, 6.3.3.x, 6.3.5.0, and 6.3.6.0 improperly processes events, which allows local users to gain privileges via unspecified vectors. http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098524 1033653 http://www-01.ibm.com/support/docview.wss?uid=nas7d9a0db411a9071e986257e8c0029b365 IT08185 IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not set the secure flag for unspecified cookies in an https session, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session. <a href="https://cwe.mitre.org/data/definitions/614.html">CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute</a> http://www-01.ibm.com/support/docview.wss?uid=swg21968270 IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. http://www-01.ibm.com/support/docview.wss?uid=swg21968271 Multiple cross-site scripting (XSS) vulnerabilities in IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 allow remote attackers to inject arbitrary web script or HTML via a crafted URL. http://www-01.ibm.com/support/docview.wss?uid=swg21968326 IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation. http://www-01.ibm.com/support/docview.wss?uid=swg21970139 Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar Vulnerability Manager 7.2.x before 7.2.5 Patch 5 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. http://www-01.ibm.com/support/docview.wss?uid=swg21970140 IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 places session IDs in https URLs, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history. http://www-01.ibm.com/support/docview.wss?uid=swg21968269 The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. https://alephsecurity.com/vulns/aleph-2015001 https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf The MetaIO SDK before 6.0.2.1 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. https://alephsecurity.com/vulns/aleph-2015002 https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. https://alephsecurity.com/vulns/aleph-2015003 https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. https://alephsecurity.com/vulns/aleph-2015004 https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf The GraceNote GNSDK SDK before SVN Changeset 1.1.7 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. https://alephsecurity.com/vulns/aleph-2015005 https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.5 Patch 6 does not properly expire sessions, which allows remote attackers to obtain sensitive information by leveraging an unattended workstation. http://www-01.ibm.com/support/docview.wss?uid=swg21967654 Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafted URL. http://www-01.ibm.com/support/docview.wss?uid=swg21967647 IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 and 7.2.x before 7.2.6 includes SSH private keys during backup operations, which allows remote authenticated administrators to obtain sensitive information by reading a backup archive. http://www-01.ibm.com/support/docview.wss?uid=swg21967632 Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to webmin. IBM X-Force ID: 103921. http://www-01.ibm.com/support/docview.wss?uid=swg21965821 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-0010. Reason: This candidate is a duplicate of CVE-2015-0010. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2015-0010 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21965817 The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password, which allows local users to obtain sensitive information by reading this file. 1034943 IT09866 http://www-01.ibm.com/support/docview.wss?uid=swg21968399 IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers to cause a denial of service (channel-agent abend and process outage) via a crafted selection string in an MQI call. 1033449 IV73860 http://www-01.ibm.com/support/docview.wss?uid=swg21962479 Open redirect vulnerability in the web server in IBM Domino 8.5 before 8.5.3 FP6 IF9 and 9.0 before 9.0.1 FP4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via a crafted URL, aka SPR SJAR9DNGDA. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> 1033271 http://www-01.ibm.com/support/docview.wss?uid=swg21963016 Cross-site scripting (XSS) vulnerability in pubnames.ntf (aka the Directory template) in the web server in IBM Domino before 9.0.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYH8WBPRN. 1033271 http://www-01.ibm.com/support/docview.wss?uid=swg21963016 Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21965813 CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL. <a href="http://cwe.mitre.org/data/definitions/113.html">CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')</a> 78457 1034096 PI45266 http://www-01.ibm.com/support/docview.wss?uid=swg21966837 IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the correct security profile is selected, which allows remote authenticated users to obtain sensitive information via unspecified vectors. IT07773 http://www-01.ibm.com/support/docview.wss?uid=swg21961734 IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent caching of documents retrieved in SSL sessions, which allows physically proximate attackers to obtain sensitive information by leveraging an unattended workstation. 75437 1032734 http://www-01.ibm.com/support/docview.wss?uid=swg21960659 The MyScript SDK before 1.3 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function. https://alephsecurity.com/vulns/aleph-2015006 https://www.usenix.org/system/files/conference/woot15/woot15-paper-peles.pdf Buffer overflow in IBM i Access 7.1 on Windows allows local users to gain privileges via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=nas8N1020996 SI57907 38751 IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. PI44098 PI44105 http://www-01.ibm.com/support/docview.wss?uid=swg21966044 Cross-site request forgery (CSRF) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences. PI44098 PI44105 http://www-01.ibm.com/support/docview.wss?uid=swg21966044 IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 improperly performs logout actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. Per http://www-01.ibm.com/support/docview.wss?uid=swg21966044: " IBM WebSphere Extreme Scale could allow a local user to bypass security on another user's session due to it improperly logging out the previous user." PI44098 PI44105 http://www-01.ibm.com/support/docview.wss?uid=swg21966044 CRLF injection vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL. <a href="http://cwe.mitre.org/data/definitions/113.html">CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')</a> PI44098 PI44105 http://www-01.ibm.com/support/docview.wss?uid=swg21966044 Session fixation vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote attackers to hijack web sessions via a session identifier. <a href="http://cwe.mitre.org/data/definitions/384.html">CWE-384: Session Fixation</a> PI44098 PI44105 http://www-01.ibm.com/support/docview.wss?uid=swg21966044 IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 has an improper account-lockout setting, which makes it easier for remote attackers to obtain access via a brute-force attack. <a href="https://cwe.mitre.org/data/definitions/307.html">CWE-307: Improper Restriction of Excessive Authentication Attempts</a> PI44098 PI44105 http://www-01.ibm.com/support/docview.wss?uid=swg21966044 Cross-site scripting (XSS) vulnerability in IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL. PI44098 PI44105 http://www-01.ibm.com/support/docview.wss?uid=swg21966044 Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request. http://unsecurityresearch.com/index.php?option=com_content&view=article&id=46&Itemid=53 73423 https://support.infoblox.com/app/answers/detail/a_id/3666/kw/NETMRI-23483 Cross-site scripting (XSS) vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php. http://packetstormsecurity.com/files/130432/CMS-Piwigo-2.7.3-Cross-Site-Scripting-SQL-Injection.html http://piwigo.org/forum/viewtopic.php?id=25179 http://piwigo.org/releases/2.7.4 20150218 Reflecting XSS- and SQL injection-vulnerabilities in the administrative backend of Piwigo <= v. 2.7.3 http://sroesemann.blogspot.de/2015/01/sroeadv-2015-06.html http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-06.html 72690 SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php. http://packetstormsecurity.com/files/130432/CMS-Piwigo-2.7.3-Cross-Site-Scripting-SQL-Injection.html http://piwigo.org/forum/viewtopic.php?id=25179 http://piwigo.org/releases/2.7.4 20150218 Reflecting XSS- and SQL injection-vulnerabilities in the administrative backend of Piwigo <= v. 2.7.3 http://sroesemann.blogspot.de/2015/01/sroeadv-2015-06.html http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-06.html 72689 Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php. http://packetstormsecurity.com/files/130306/WordPress-Acobot-Live-Chat-And-Contact-Form-2.0-CSRF-XSS.html wp-acobot-xss(100813) wp-acobot-csrf(100814) Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php. http://packetstormsecurity.com/files/130311/WordPress-Contact-Form-DB-2.8.26-Cross-Site-Scripting.html wp-cfdb-submittime-xss(100818) net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6b8d9117ccb4f81b1244aafa7bc70ef8fa45fc49 SUSE-SU-2015:0812 SUSE-SU-2015:1224 openSUSE-SU-2015:1382 SUSE-SU-2015:1478 DSA-3237 [oss-security] 20150220 CVE-2015-2041 - Linux kernel - incorrect data type in llc2_timeout_table 72729 USN-2560-1 USN-2561-1 USN-2562-1 USN-2563-1 USN-2564-1 USN-2565-1 https://bugzilla.redhat.com/show_bug.cgi?id=1195350 https://github.com/torvalds/linux/commit/6b8d9117ccb4f81b1244aafa7bc70ef8fa45fc49 net/rds/sysctl.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=db27ebb111e9f69efece08e4cb6a34ff980f8896 SUSE-SU-2015:1478 DSA-3237 [oss-security] 20150220 CVE-2015-2042 - Linux kernel - incorrect data type in rds_sysctl_rds_table 72730 USN-2560-1 USN-2561-1 USN-2562-1 USN-2563-1 USN-2564-1 USN-2565-1 https://bugzilla.redhat.com/show_bug.cgi?id=1195355 https://github.com/torvalds/linux/commit/db27ebb111e9f69efece08e4cb6a34ff980f8896 Multiple cross-site scripting (XSS) vulnerabilities in Visualware MyConnection Server 8.2b allow remote attackers to inject arbitrary web script or HTML via the (1) bt, (2) variable, or (3) et parameter to myspeed/db/historyitem. http://packetstormsecurity.com/files/130490/MyConnection-Server-8.2b-Cross-Site-Scripting.html The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size. FEDORA-2015-3935 FEDORA-2015-3721 FEDORA-2015-3944 openSUSE-SU-2015:0732 http://support.citrix.com/article/CTX200484 DSA-3181 72954 1031806 1031836 http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-423503.htm http://xenbits.xen.org/xsa/advisory-121.html GLSA-201504-04 The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users to obtain sensitive information via unspecified vectors. FEDORA-2015-3935 FEDORA-2015-3721 FEDORA-2015-3944 openSUSE-SU-2015:0732 http://support.citrix.com/article/CTX200484 DSA-3181 72955 1031806 1031837 http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-423503.htm http://xenbits.xen.org/xsa/advisory-122.html GLSA-201504-04 Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20. [oss-security] 20150220 Re: CVE request: XSS in MantisBT [oss-security] 20150221 RE: CVE request: XSS in MantisBT https://bugzilla.redhat.com/show_bug.cgi?id=1191130 The rsaauth extension in TYPO3 4.3.0 through 4.3.14, 4.4.0 through 4.4.15, 4.5.0 through 4.5.39, and 4.6.0 through 4.6.18, when configured for the frontend, allows remote attackers to bypass authentication via a password that is casted to an empty value. openSUSE-SU-2016:2169 http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-001/ DSA-3164 [oss-security] 20150222 CVE Request: TYPO3-CORE-SA-2015-001: Authentication Bypass in TYPO3 CMS 4.5 [oss-security] 20150222 Re: CVE Request: TYPO3-CORE-SA-2015-001: Authentication Bypass in TYPO3 CMS 4.5 72763 1031824 https://review.typo3.org/#/c/37013/ Cross-site request forgery (CSRF) vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10049 Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10049 VU#377348 39192 D-Link DAP-1320 Rev Ax with firmware before 1.21b05 allows attackers to execute arbitrary commands via unspecified vectors. http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10050 VU#184100 73143 The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface. http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051 72623 74870 37171 Stack-based buffer overflow in the DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary code via a long string in a GetDeviceSettings action to the HNAP interface. http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051 72623 The log viewer in McAfee Agent (MA) before 4.8.0 Patch 3 and 5.0.0, when the "Accept connections only from the ePO server" option is disabled, allows remote attackers to conduct clickjacking attacks via a crafted web page, aka an "http-generic-click-jacking" vulnerability. 74873 1031821 https://kc.mcafee.com/corporate/index?page=content&id=SB10094 CRLF injection vulnerability in export.cfg in the web-based administrative console for Sierra Wireless AirCard 760S, 762S, and 763S allows remote attackers to inject arbitrary headers via CRLF sequences in the save parameter. <a href="http://cwe.mitre.org/data/definitions/93.html" target="_blank">CWE-93: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')</a> 20150114 Sierra Wireless AirCard 760S/762S/763S Mobile Hotspot CRLF Injection 74875 Zhone GPON 2520 with firmware R4.0.2.566b allows remote attackers to cause a denial of service via a long string in the oldpassword parameter. 35859 74876 c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID. [oss-security] 20150209 CVE Request: jabberd remote information disclosure [oss-security] 20150223 Re: CVE Request: jabberd remote information disclosure 72731 https://github.com/jabberd2/jabberd2/issues/85 The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows context-dependent attackers to read system memory and possibly have other unspecified impact via invalid UTF-8 characters in a string, which triggers an out-of-bounds read. http://git.savannah.gnu.org/cgit/libidn.git/commit/?id=2e97c279 FEDORA-2015-11621 FEDORA-2015-11562 openSUSE-SU-2015:1261 openSUSE-SU-2016:2135 DSA-3578 [oss-security] 20150223 Re: CVE Request: jabberd remote information disclosure 72736 USN-3068-1 https://github.com/jabberd2/jabberd2/issues/85 Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified attribute. 72836 http://www.zerodayinitiative.com/advisories/ZDI-15-051/ https://support.ptc.com/appserver/cs/view/solution.jsp?n=CS172389 Integer overflow in unace 1.2b allows remote attackers to cause a denial of service (crash) via a small file header in an ace archive, which triggers a buffer overflow. DSA-3178 [oss-security] 20150223 Re: CVE request: unace https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775003 Multiple cross-site scripting (XSS) vulnerabilities in DLGuard 5, 4.6, and 4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) c, or (3) redirect parameter to index.php or (4) search field (searchTerm parameter) in the main page. 20150218 DLGuard Multiple XSS (Cross-Site Scripting) Security Vulnerabilities http://securityrelated.blogspot.com/2015/02/dlguard-multiple-xss-cross-site.html http://tetraph.com/security/xss-vulnerability/dlguard-multiple-xss-cross-site-scripting-security-vulnerabilities/ 72684 SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php. http://packetstormsecurity.com/files/130371/WordPress-Video-Gallery-2.7-SQL-Injection.html 36058 74882 https://wordpress.org/plugins/contus-video-gallery/changelog/ SQL injection vulnerability in DLGuard 4.5 allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php. 20150218 DLGuard SQL Injection Security Vulnerabilities http://securityrelated.blogspot.com/2015/02/dlguard-sql-injection-security.html http://tetraph.com/security/sql-injection-vulnerability/dlguard-sql-injection-security-vulnerabilities/ 72683 Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. http://packetstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.html 35996 74881 Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php. http://packetstormsecurity.com/files/130250/Magento-Server-MAGMI-Cross-Site-Scripting-Local-File-Inclusion.html 35996 74879 Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php. http://packetstormsecurity.com/files/130458/WordPress-WooCommerce-2.2.10-Cross-Site-Scripting.html 20150221 WooCommerce WordPress plugin 2.2.10 Reflected XSS 74885 https://wordpress.org/plugins/woocommerce/changelog/ SQL injection vulnerability in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote attackers to execute arbitrary SQL commands via the catId parameter to cm/blogrss/feed. http://packetstormsecurity.com/files/130386/eTouch-Samepage-4.4.0.0.239-SQL-Injection-File-Read.html 20150213 eTouch SamePage v4.4.0.0.239 multiple vulnerabilities 36089 74883 Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the filepath parameter. http://packetstormsecurity.com/files/130386/eTouch-Samepage-4.4.0.0.239-SQL-Injection-File-Read.html 20150213 eTouch SamePage v4.4.0.0.239 multiple vulnerabilities 36089 74887 Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or (2) xs/ide/editor/templates/trace/hanaTraceDetailService.xsjs, aka SAP Note 2069676. http://packetstormsecurity.com/files/130519/SAP-HANA-Web-based-Development-Workbench-Cross-Site-Scripting.html 20150225 [Onapsis Security Advisory 2015-001] Multiple Reflected Cross Site Scripting Vulnerabilities in SAP HANA Web-based Development Workbench 20150225 [Onapsis Security Advisory 2015-001] Multiple Reflected Cross Site Scripting Vulnerabilities in SAP HANA Web-based Development Workbench 72773 SAP BusinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396. http://packetstormsecurity.com/files/130522/SAP-Business-Objects-Unauthorized-Audit-Information-Delete.html 20150225 [Onapsis Security Advisory 2015-004] SAP Business Objects Unauthorized Audit Information Delete via CORBA 20150225 [Onapsis Security Advisory 2015-004] SAP Business Objects Unauthorized Audit Information Delete via CORBA 72778 The Auditing service in SAP BusinessObjects Edge 4.0 allows remote attackers to obtain sensitive information by reading an audit event, aka SAP Note 2011395. http://packetstormsecurity.com/files/130523/SAP-Business-Objects-Unauthorized-Audit-Information-Access.html 20150225 [Onapsis Security Advisory 2015-005] SAP Business Objects Unauthorized Audit Information Access via CORBA 20150225 [Onapsis Security Advisory 2015-005] SAP Business Objects Unauthorized Audit Information Access via CORBA 72775 The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, uses the same X.509 certificate private key for a root CA certificate across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging knowledge of this key, as originally reported for Superfish VisualDiscovery on certain Lenovo Notebook laptop products. http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.VOq6Yfn8Fp4 http://blog.erratasec.com/2015/02/some-notes-on-superfish.html#.VOq6Yvn8Fp4 http://marcrogers.org/2015/02/19/lenovo-installs-adware-on-customer-laptops-and-compromises-all-ssl/ http://news.lenovo.com/article_display.cfm?article_id=1929 http://support.lenovo.com/us/en/product_security/superfish VU#529496 72693 1031779 http://www.theguardian.com/technology/2015/feb/19/lenovo-accused-compromising-user-security-installing-adware-pcs-superfish TA15-051A http://www.wired.com/2015/02/lenovo-superfish/ https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/ https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339 The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, a different vulnerability than CVE-2015-2077. http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.VOq6Yfn8Fp4 http://blog.erratasec.com/2015/02/some-notes-on-superfish.html#.VOq6Yvn8Fp4 VU#529496 1031779 TA15-051A https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/ https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak. [jetty-announce] 20150224 Critical Security Release of Jetty 9.2.9.v20150224 [jetty-announce] 20150225 CVE-2015-2080 : JetLeak Vulnerability Remote Leakage of Shared Buffers in Jetty FEDORA-2015-2673 http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html 20150301 GDS Labs Alert [CVE-2015-2080] - JetLeak Vulnerability: Remote Leakage Of Shared Buffers In Jetty Web Server 20150225 GDS Labs Alert [CVE-2015-2080] - JetLeak Vulnerability: Remote Leakage Of Shared Buffers In Jetty Web Server 1031800 https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md https://security.netapp.com/advisory/ntap-20190307-0005/ Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts. http://www.information-paradox.net/2015/02/cve-2015-2081-multiple-vulnerabilities.html Cross-site scripting (XSS) vulnerability in Login.aspx in UNIT4 Prosoft HRMS before 8.14.330.43 allows remote attackers to inject arbitrary web script or HTML via the txtUserID parameter. http://packetstormsecurity.com/files/130396/UNIT4-Prosoft-HRMS-8.14.230.47-Cross-Site-Scripting.html 20150213 UNIT4 Prosoft HRMS XSS Vulnerability 74896 Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields request to admin.php. http://packetstormsecurity.com/files/130441/Ilch-CMS-Cross-Site-Request-Forgery.html 74898 Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the image_file parameter in an edit action in the cnss_social_icon_add page to wp-admin/admin.php. http://packetstormsecurity.com/files/130461/WordPress-Easy-Social-Icons-1.2.2-CSRF-XSS.html 20150221 Easy Social Icons WordPress plugin v1.2.2 Persistent XSS and CSRF 36161 74893 https://wordpress.org/plugins/easy-social-icons/changelog/ Cross-site scripting (XSS) vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title. 72671 https://www.drupal.org/node/2428749 https://www.drupal.org/node/2428799 Unrestricted file upload vulnerability in the Avatar Uploader module before 6.x-1.3 for Drupal allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via unspecified vectors. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> 72674 https://www.drupal.org/node/2427069 https://www.drupal.org/node/2428793 Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Term Queue module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unknown vectors. 72678 https://www.drupal.org/node/2428483 https://www.drupal.org/node/2428853 Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) csj_width, (3) csj_height, (4) csj_sleep, (5) csj_fade, or (6) upload_image parameter in the thisismyurl_csj.php page to wp-admin/options-general.php. http://packetstormsecurity.com/files/130313/WordPress-Cross-Slide-2.0.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html 74894 SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php. http://packetstormsecurity.com/files/130381/WordPress-Survey-And-Poll-1.1.7-Blind-SQL-Injection.html 36054 74890 https://wordpress.org/plugins/wp-survey-and-poll/changelog/ The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate. http://issues.outoforder.cc/view.php?id=93 DSA-3177 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=578663 GLSA-201709-04 The AnnotationX.AnnList.1 ActiveX control in Agilent Technologies Feature Extraction allows remote attackers to execute arbitrary code via a crafted object parameter in the Insert function, related to "Index Out-Of-Bounds." 72840 http://www.zerodayinitiative.com/advisories/ZDI-15-053/ Stack-based buffer overflow in the Connect function in the WebGate WebEyeAudio ActiveX control allows remote attackers to execute arbitrary code via a crafted value. 72839 http://www.zerodayinitiative.com/advisories/ZDI-15-054/ Stack-based buffer overflow in the WESPPlayback.WESPPlaybackCtrl.1 control in WebGate WinRDS allows remote attackers to execute arbitrary code via unspecified vectors to the (1) PrintSiteImage, (2) PlaySiteAllChannel, (3) StopSiteAllChannel, or (4) SaveSiteImage function. http://packetstormsecurity.com/files/131069/WebGate-WinRDS-2.0.8-StopSiteAllChannel-Stack-Overflow.html 72841 http://www.zerodayinitiative.com/advisories/ZDI-15-071/ http://www.zerodayinitiative.com/advisories/ZDI-15-072/ http://www.zerodayinitiative.com/advisories/ZDI-15-073/ http://www.zerodayinitiative.com/advisories/ZDI-15-074/ 36517 Heap-based buffer overflow in the SetConnectInfo function in the WESPPTZ.WESPPTZCtrl.1 ActiveX control in WebGate eDVR Manager allows remote attackers to execute arbitrary code via crafted arguments. 73222 http://www.zerodayinitiative.com/advisories/ZDI-15-070/ Use-after-free vulnerability in the Connect function in the WESPMonitor.WESPMonitorCtrl.1 ActiveX control in WebGate eDVR Manager allows remote attackers to execute arbitrary code via an invalid IP address and a page reload. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> 72849 http://www.zerodayinitiative.com/advisories/ZDI-15-069/ Multiple buffer overflows in WebGate Embedded Standard Protocol (WESP) SDK allow remote attackers to execute arbitrary code via unspecified vectors to the (1) LoadImage or (2) LoadImageEx function in the WESPMonitor.WESPMonitorCtrl.1 control, (3) ChangePassword function in the WESPCONFIGLib.UserItem control, Connect function in the (4) WESPSerialPort.WESPSerialPortCtrl.1 or (5) WESPPLAYBACKLib.WESPPlaybackCtrl control, or (6) AddID function in the WESPCONFIGLib.IDList control or a (7) long string to the second argument to the ConnectEx3 function in the WESPPLAYBACKLib.WESPPlaybackCtrl control. http://packetstormsecurity.com/files/131072/WebGate-eDVR-Manager-Stack-Buffer-Overflow.html 20150223 WESP SDK multiple Remote Code Execution Vulnerabilities 72835 http://www.zerodayinitiative.com/advisories/ZDI-15-059/ http://www.zerodayinitiative.com/advisories/ZDI-15-062/ http://www.zerodayinitiative.com/advisories/ZDI-15-068/ 36505 36602 36607 Cross-site scripting (XSS) vulnerability in the Navigate bar in the Navigate module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 72670 https://www.drupal.org/node/2428503 https://www.drupal.org/node/2428505 https://www.drupal.org/node/2428815 SQL injection vulnerability in view_item.php in ClipBucket 2.7 RC3 (2.7.0.4.v2929-rc3) allows remote attackers to execute arbitrary SQL commands via the item parameter. http://packetstormsecurity.com/files/130485/Clipbucket-2.7.0.4.v2929-rc3-Blind-SQL-Injection.html 36156 20150304 [CVE-2015-2102] Clipbucket 2.7 RC3 0.9 - Blind SQL Injection 72879 Cross-site scripting (XSS) vulnerability in the admin-login panel (admin/index.cgi) in Cosmoshop allows remote attackers to inject arbitrary web script or HTML via the username field (u_name parameter). http://packetstormsecurity.com/files/130403/Cosmoshop-Cross-Site-Scripting.html 20150214 Cosmoshop - XSS on Admin-Login Mask Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers to bypass intended access restrictions or cause a denial of service via unknown vectors. 73324 1031974 SSRT101886 HP Operations Manager i Management Pack 1.x before 1.01 for SAP allows local users to execute OS commands by leveraging SAP administrative privileges. SSRT101971 1031870 Unspecified vulnerability in Powershell Operations in HP Operations Orchestration 9.x and 10.x allows remote authenticated users to obtain sensitive information via unknown vectors. 73320 1031987 SSRT101980 Unspecified vulnerability in HP Operations Orchestration 10.x allows remote attackers to bypass authentication, and obtain sensitive information or modify data, via unknown vectors. 73323 SSRT101981 Buffer overflow in HP LoadRunner 11.52 allows remote attackers to execute arbitrary code via unspecified vectors. SSRT101319 Unspecified vulnerability in HP Intelligent Provisioning 1.40 through 1.60 on Windows Server 2008 R2 and 2012 allows local users to obtain sensitive information via unknown vectors. 73481 SSRT101588 Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540, t5740, and t5740e devices and HP Flexible Thin Client t510, t520, t610, t620, and t820 devices allows remote authenticated users to execute arbitrary code via unknown vectors. 73961 SSRT101680 Unspecified vulnerability in HP Easy Deploy, as distributed standalone and in HP Easy Tools before 3.0.1.1650, on HP Thin Client t5540, t5740, and t5740e devices and HP Flexible Thin Client t510, t520, t610, t620, and t820 devices allows remote attackers to execute arbitrary code via unknown vectors. 73964 SSRT101680 HP Support Solution Framework before 11.51.0049 allows remote attackers to download an arbitrary program onto a client machine and execute this program via unspecified vectors. 74054 SSRT102005 Unspecified vulnerability in HP Capture and Route Software (HPCR) 1.3 before Patch 7, 1.3 FP1 before Patch 1, and 1.4 before Patch 1 allows remote authenticated users to obtain sensitive information via unknown vectors. 74336 SSRT102023 Unspecified vulnerability in HP Storage Data Protector 7.x before 7.03 build 107 allows remote authenticated users to execute arbitrary code or cause a denial of service via unknown vectors. 74249 1032162 SSRT101677 HP TippingPoint Security Management System (SMS) and TippingPoint Virtual Security Management System (vSMS) before 4.1 patch 3 and 4.2 before patch 1 do not require authentication for JBoss RMI requests, which allows remote attackers to execute arbitrary code by (1) uploading this code within an archive or (2) instantiating a class. 74285 1032187 http://zerodayinitiative.com/advisories/ZDI-15-154/ SSRT101873 Unspecified vulnerability in the Secure Pull Print and Security Pull Print components in HP Access Control (AC) Software 12.x through 14.x before 14.1.2 allows remote authenticated users to obtain sensitive information via unknown vectors. SSRT102033 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Unspecified vulnerability in HP SiteScope 11.1x before 11.13, 11.2x before 11.24.391, and 11.3x before 11.30.521 allows remote authenticated users to gain privileges via unknown vectors, aka ZDI-CAN-2567. 74801 http://www.zerodayinitiative.com/advisories/ZDI-15-239 SSRT101902 HP Network Virtualization for LoadRunner and Performance Center 8.61 and 11.52 allows remote attackers to read arbitrary files via a crafted filename in a URL to the (1) HttpServlet or (2) NetworkEditorController component, aka ZDI-CAN-2569. 74583 http://zerodayinitiative.com/advisories/ZDI-15-192/ SSRT101932 The REST layer on HP SDN VAN Controller devices 2.5 and earlier allows remote attackers to cause a denial of service via network traffic to the REST port. 74588 SSRT102049 Unspecified vulnerability in HP NonStop Safeguard Security Software H06.x, L15.02, and J06.x before J06.19 allows remote authenticated users to gain privileges by leveraging Expand access. 74819 SSRT102058 Unspecified vulnerability in Easy Setup Wizard in HP ThinPro Linux 4.1 through 5.1 and Smart Zero Core 4.3 and 4.4 allows local users to bypass intended access restrictions and gain privileges via unknown vectors. 74897 SSRT102045 Unspecified vulnerability in HP WebInspect 7.x through 10.4 before 10.4 update 1 allows remote authenticated users to bypass intended access restrictions via unknown vectors. 75036 1032478 SSRT102038 37250 Unspecified vulnerability in pppoec in HP HP-UX 11iv2 and 11iv3 allows local users to gain privileges by leveraging setuid permissions. 75462 1032746 SSRT102094 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Unspecified vulnerability in the execve system-call implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors. SSRT102037 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. HPSBMU03409 75961 1033014 SSRT102109 Unspecified vulnerability in HP Intelligent Provisioning 1.00 through 1.62(a), 2.00, and 2.10 allows remote attackers to execute arbitrary code via unknown vectors. SSRT102065 HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unspecified vectors. SSRT101904 Unspecified vulnerability in HP Operations Manager i (OMi) 9.22, 9.23, 9.24, 9.25, 10.00, and 10.01 allows remote attackers to execute arbitrary code via unknown vectors. 1033260 SSRT102189 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5403. HPSBMU03394 HPSBMU03409 HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information or modify data via unspecified vectors. HPSBMU03394 HPSBMU03409 The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack. openSUSE-SU-2015:1271 http://sourceforge.net/p/cryptopp/code/542/ DSA-3296 75467 https://github.com/weidai11/cryptopp/commit/9425e16437439e68c7d96abef922167d68fafaff Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to (1) hijack the authentication of users for requests that cause an unspecified impact via the id parameter to project.php, (2) hijack the authentication of users for requests that cause an unspecified impact via the group_id parameter to group.php, (3) hijack the authentication of users for requests that delete statuses via the status_id parameter to status.php, (4) hijack the authentication of users for requests that delete severities via the severity_id parameter to severity.php, (5) hijack the authentication of users for requests that cause an unspecified impact via the priority_id parameter to priority.php, (6) hijack the authentication of users for requests that delete the operating system via the os_id parameter to os.php, (7) hijack the authentication of users for requests that delete databases via the database_id parameter to database.php, or (8) hijack the authentication of users for requests that delete sites via the site_id parameter to sites.php. [oss-security] 20150227 Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities https://github.com/a-v-k/phpBugTracker/issues/4 Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to hijack the authentication of users for requests that cause an unspecified impact via unknown parameters. [oss-security] 20150227 Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) project name parameter to project.php; the (2) use_js parameter to user.php; the (3) use_js parameter to group.php; the (4) Description parameter to status.php; the (5) Description parameter to severity.php; the (6) Regex parameter to os.php; or the (7) Name parameter to database.php. [oss-security] 20150227 Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities https://github.com/a-v-k/phpBugTracker/issues/4 Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. [oss-security] 20150227 Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to project.php, the (2) group_id parameter to group.php, the (3) status_id parameter to status.php, the (4) resolution_id parameter to resolution.php, the (5) severity_id parameter to severity.php, the (6) priority_id parameter to priority.php, the (7) os_id parameter to os.php, or the (8) site_id parameter to site.php. [oss-security] 20150227 Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities https://github.com/a-v-k/phpBugTracker/issues/4 Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via unspecified parameters. http://cve.killedkenny.io/cve/CVE-2015-2147 [oss-security] 20150227 Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in Issuetracker phpBugTracker before 1.7.2 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. [oss-security] 20150227 Re: CVE-Request -- phpBugTracker v. 1.6.0 -- Multiple SQLi, stored/reflecting XSS- and CSRF-vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachment_types module to admin/index.php; (2) title or (3) short description field in an add action in the (a) config-mycode or (b) user-groups module to admin/index.php; (4) title field in an add action in the (c) forum-management or (d) tool-tasks module to admin/index.php; (5) name field in an add_set action in the style-templates module to admin/index.php; (6) title field in an add_template_group action in the style-templates module to admin/index.php; (7) name field in an add action in the config-post_icons module to admin/index.php; (8) "title to assign" field in an add action in the user-titles module to admin/index.php; or (9) username field in the config-banning module to admin/index.php. http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/ 20150221 Multiple stored XSS-vulnerabilities in MyBB v. 1.8.3 [oss-security] 20150221 CVE-Request -- MyBB v. 1.8.3 -- Multiple stored XSS-vulnerabilities [oss-security] 20150227 Re: CVE-Request -- MyBB v. 1.8.3 -- Multiple stored XSS-vulnerabilities http://sroesemann.blogspot.de/2015/02/sroeadv-2015-15.html 72738 1031953 Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=af6fc858a35b90e89ea7a7ee58e66628c55c776b FEDORA-2015-6294 FEDORA-2015-6320 FEDORA-2015-6100 FEDORA-2015-4066 SUSE-SU-2015:0658 SUSE-SU-2015:1478 SUSE-SU-2015:1592 SUSE-SU-2015:1611 DSA-3237 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 73014 1031806 1031902 USN-2631-1 USN-2632-1 http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-423503.htm http://xenbits.xen.org/xsa/advisory-120.html https://bugzilla.redhat.com/show_bug.cgi?id=1196266 https://github.com/torvalds/linux/commit/af6fc858a35b90e89ea7a7ee58e66628c55c776b 20190813 [SECURITY] [DSA 4497-1] linux security update The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via unspecified vectors. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 FEDORA-2015-3935 FEDORA-2015-3721 FEDORA-2015-3944 openSUSE-SU-2015:0732 http://support.citrix.com/article/CTX200484 DSA-3181 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 73015 1031806 1031903 http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-423503.htm http://xenbits.xen.org/xsa/advisory-123.html GLSA-201604-03 Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support. FEDORA-2015-3935 FEDORA-2015-3721 FEDORA-2015-3944 openSUSE-SU-2015:0732 73068 1031806 1031919 http://xenbits.xen.org/xsa/advisory-119.html GLSA-201504-04 The rpki_rtr_pdu_print function in print-rpki-rtr.c in the TCP printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via a crafted header length in an RPKI-RTR Protocol Data Unit (PDU). http://advisories.mageia.org/MGASA-2015-0114.html FEDORA-2015-4939 FEDORA-2015-4804 openSUSE-SU-2015:0616 http://packetstormsecurity.com/files/130730/tcpdump-Denial-Of-Service-Code-Execution.html DSA-3193 MDVSA-2015:125 MDVSA-2015:182 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html 20150309 tcpdump 4.7.2 remote crashes 73018 1031937 USN-2580-1 RHSA-2017:1871 https://bugzilla.redhat.com/show_bug.cgi?id=1201795 GLSA-201510-04 37663 The osi_print_cksum function in print-isoclns.c in the ethernet printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted (1) length, (2) offset, or (3) base pointer checksum value. http://advisories.mageia.org/MGASA-2015-0114.html FEDORA-2015-4939 FEDORA-2015-4804 openSUSE-SU-2015:0616 http://packetstormsecurity.com/files/130730/tcpdump-Denial-Of-Service-Code-Execution.html DSA-3193 MDVSA-2015:125 MDVSA-2015:182 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html 20150309 tcpdump 4.7.2 remote crashes 73017 1031937 USN-2580-1 RHSA-2017:1871 https://bugzilla.redhat.com/show_bug.cgi?id=1201797 GLSA-201510-04 The force printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. http://advisories.mageia.org/MGASA-2015-0114.html FEDORA-2015-4939 openSUSE-SU-2015:0616 http://packetstormsecurity.com/files/130730/tcpdump-Denial-Of-Service-Code-Execution.html DSA-3193 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html 20150309 tcpdump 4.7.2 remote crashes 73021 1031937 USN-2580-1 RHSA-2017:1871 https://bugzilla.redhat.com/show_bug.cgi?id=1201798 GLSA-201510-04 Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters. FEDORA-2015-8713 FEDORA-2015-8684 http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html [oss-security] 20150516 Netty/Play's Security Updates (CVE-2015-2156) 74704 https://bugzilla.redhat.com/show_bug.cgi?id=1222923 https://github.com/netty/netty/pull/3754 [pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1 https://www.playframework.com/security/vulnerability/CVE-2015-2156-HttpOnlyBypass The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory. FEDORA-2015-3070 FEDORA-2015-3204 FEDORA-2015-3160 openSUSE-SU-2015:0474 http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html DSA-3190 [oss-security] 20150228 CVE Request: PuTTY fails to clear private key information from memory [oss-security] 20150228 Re: CVE Request: PuTTY fails to clear private key information from memory 72825 Off-by-one error in the pngcrush_measure_idat function in pngcrush.c in pngcrush before 1.7.84 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file. [oss-security] 20150228 Re: CVE request: pngcrush 1.7.83 crash bug (most likely exploitable) 72830 https://bugzilla.redhat.com/show_bug.cgi?id=1198171 https://sourceforge.net/p/pmt/news/2015/02/pngcrush-1784-released/ Multiple cross-site scripting (XSS) vulnerabilities in the Report Viewer in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4.x, 5.x, and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) portal, (2) fromDate, (3) toDate, (4) fromTime, (5) toTime, (6) kword, (7) uname, (8) pname, (9) sname, (10) atype, or (11) atitle parameter to top-links.jsp; (12) portal or (13) uid parameter to (a) page-summary.jsp or (b) service-summary.jsp; (14) portal, (15) fromDate, (16) toDate, (17) fromTime, (18) toTime, (19) sortDirection, (20) kword, (21) uname, (22) pname, (23) sname, (24) file, (25) atype, or (26) atitle parameter to (c) top-useragent-devices.jsp or (d) top-interest-areas.jsp; (27) fromDate, (28) toDate, (29) fromTime, (30) toTime, (31) sortDirection, (32) kword, (33) uname, (34) pname, (35) sname, (36) file, (37) atype, or (38) atitle parameter to top-message-services.jsp; (39) portal, (40) fromDate, (41) toDate, (42) fromTime, (43) toTime, (44) orderBy, (45) sortDirection, (46) kword, (47) uname, (48) pname, (49) sname, (50) file, (51) atype, or (52) atitle parameter to (e) user-statistics.jsp, (f) top-web-pages.jsp, (g) top-devices.jsp, (h) top-pages.jsp, (i) session-summary.jsp, (j) top-providers.jsp, (k) top-modules.jsp, or (l) top-services.jsp; (53) fromDate, (54) toDate, (55) fromTime, (56) toTime, (57) orderBy, (58) sortDirection, (59) uid, (60) uid2, (61) kword, (62) uname, (63) pname, (64) sname, (65) file, (66) atype, or (67) atitle parameter to message-shortcode-summary.jsp; (68) fromDate, (69) toDate, (70) fromTime, (71) toTime, (72) orderBy, (73) sortDirection, (74) uid, (75) kword, (76) uname, (77) pname, (78) sname, (79) file, (80) atype, or (81) atitle parameter to (m) message-providers-summary.jsp or (n) message-services-summary.jsp; (82) kword, (83) uname, (84) pname, (85) sname, (86) file, (87) atype, or (88) atitle parameter to license-summary.jsp; (89) portal, (90) fromDate, (91) toDate, (92) fromTime, (93) toTime, (94) orderBy, (95) sortDirection, (96) uid, (97) uid2, (98) kword, (99) uname, (100) pname, (101) sname, (102) file, (103) atype, or (104) atitle parameter to useragent-device-summary.jsp; (105) fromDate, (106) toDate, (107) fromTime, (108) toTime, (109) orderBy, (110) sortDirection, (111) kword, (112) uname, (113) pname, (114) sname, (115) file, (116) atype, or (117) atitle parameter to (o) top-message-providers.jsp, (p) top-message-devices.jsp, (q) top-message-assets.jsp, (r) top-message-downloads.jsp, or (s) top-message-shortcode.jsp; (118) fromDate, (119) toDate, (120) fromTime, (121) toTime, (122) kword, (123) uname, (124) pname, (125) sname, (126) file, (127) atype, or (128) atitle parameter to request-summary.jsp; (129) portal parameter to link-summary-select.jsp, (130) provider-summary-select.jsp, or (131) module-summary-select.jsp; (132) portal, (133) uid, (134) kword, (135) uname, (136) pname, (137) sname, (138) file, (139) atype, or (140) atitle parameter to link-summary.jsp; (141) portal, (142) fromDate, (143) toDate, (144) fromTime, (145) toTime, (146) orderBy, (147) sortDirection, (148) uid, (149) kword, (150) uname, (151) pname, (152) sname, (153) file, (154) atype, or (155) atitle parameter to (t) provider-summary.jsp or (u) module-summary.jsp in reports/pages/. http://packetstormsecurity.com/files/131232/Ericsson-Drutt-MSDP-Report-Viewer-Cross-Site-Scripting.html 73933 Directory traversal vulnerability in the Instance Monitor in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the default URI. http://packetstormsecurity.com/files/131233/Ericsson-Drutt-MSDP-Instance-Monitor-Directory-Traversal-File-Access.html 73901 36619 Open redirect vulnerability in the 3PI Manager in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to jsp/start-3pi-manager.jsp. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> http://packetstormsecurity.com/files/131230/Ericsson-Drutt-MSDP-3PI-Manager-Open-Redirect.html 73934 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue in customer-controlled software. Notes: none. Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 allows remote attackers to inject arbitrary web script or HTML via a Publisher registry entry, which is not properly handled when the machine is scanned. http://packetstormsecurity.com/files/132433/ManageEngine-Asset-Explorer-6.1-Cross-Site-Scripting.html 20150623 XSS vulnerability in manage engine. http://techtootech.blogspot.in/2015/06/found-xss-vulnerability-in-manage.html 75389 37395 The upx decoder in ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted file. http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html openSUSE-SU-2015:0906 USN-2594-1 74443 GLSA-201512-08 Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data. 20150302 Slim Framework - (CVE-2015-2171, PHP Object Injection), Other Vulnerabilities 70087 http://www.slimframework.com/2015/03/01/version-260.html https://github.com/slimphp/Slim/issues/1034 DokuWiki before 2014-05-05d and before 2014-09-29c does not properly check permissions for the ACL plugins, which allows remote authenticated users to gain privileges and add or delete ACL rules via a request to the XMLRPC API. http://advisories.mageia.org/MGASA-2015-0093.html FEDORA-2015-3211 FEDORA-2015-3186 FEDORA-2015-3079 [oss-security] 20150301 Re: CVE request: DokuWiki privilege escalation in RPC API 72827 https://github.com/splitbrain/dokuwiki/commit/4970ad24ce49ec76a0ee67bca7594f918ced2f5f https://github.com/splitbrain/dokuwiki/issues/1056 https://www.dokuwiki.org/changes Siemens SIMATIC S7-300 CPU devices allow remote attackers to cause a denial of service (defect-mode transition) via crafted packets on (1) TCP port 102 or (2) Profibus. 72973 1032040 http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-987029.pdf https://ics-cert.us-cert.gov/advisories/ICSA-15-064-04 44802 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the password. 96387 https://github.com/roundcube/roundcubemail/issues/4757 Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username. 96391 https://github.com/roundcube/roundcubemail/issues/4757 Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (2) brand parameter in a viewbrands action to index.php. NOTE: The search parameter vector is already covered by CVE-2010-5322. http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html 20150223 ECommerce-Shopping Cart Zeuscart v. 4: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities [oss-security] 20150223 CVE-Request -- Zeuscart v. 4 -- Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities [oss-security] 20150302 Re: CVE-Request -- Zeuscart v. 4 -- Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities http://secpod.org/advisories/SECPOD_ZeusCart_XSS.txt http://secpod.org/blog/?p=109 http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html 36159 72761 https://github.com/ZeusCart/zeuscart/issues/28 Multiple SQL injection vulnerabilities in the administrative backend in ZeusCart 4 allow remote administrators to execute arbitrary SQL commands via the id parameter in a (1) disporders detail or (2) subadminmgt edit action or (3) cid parameter in an editcurrency action to admin/. http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html 20150223 ECommerce-Shopping Cart Zeuscart v. 4: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities [oss-security] 20150223 CVE-Request -- Zeuscart v. 4 -- Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities [oss-security] 20150302 Re: CVE-Request -- Zeuscart v. 4 -- Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html 36159 72761 https://github.com/ZeusCart/zeuscart/issues/28 ZeusCart 4 allows remote attackers to obtain configuration information via a getphpinfo action to admin/, which calls the phpinfo function. http://packetstormsecurity.com/files/130487/Zeuscart-4-Cross-Site-Scripting-SQL-Injection.html 20150223 ECommerce-Shopping Cart Zeuscart v. 4: Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities [oss-security] 20150223 CVE-Request -- Zeuscart v. 4 -- Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities [oss-security] 20150302 Re: CVE-Request -- Zeuscart v. 4 -- Multiple reflecting XSS-, SQLi and InformationDisclosure-vulnerabilities http://sroesemann.blogspot.de/2015/01/sroeadv-2015-12.html 36159 72761 https://github.com/ZeusCart/zeuscart/issues/28 The Ansible edxapp role in the Configuration Repo in edX allows remote websites to spoof edX accounts by leveraging use of the string literal "False" instead of a boolean False for the CORS_ORIGIN_ALLOW_ALL setting. Note: this vulnerability was fixed on 2015-03-06, but the version number was not changed. https://github.com/edx/configuration/pull/1885/files https://open.edx.org/CVE-2015-2186 The dissect_atn_cpdlc_heur function in asn1/atn-cpdlc/packet-atn-cpdlc-template.c in the ATN-CPDLC dissector in Wireshark 1.12.x before 1.12.4 does not properly follow the TRY/ENDTRY code requirements, which allows remote attackers to cause a denial of service (stack memory corruption and application crash) via a crafted packet. openSUSE-SU-2015:0489 72940 1031858 http://www.wireshark.org/security/wnpa-sec-2015-06.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9952 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=1a3dd349233a4ee3e69295c8e79f9a216027037e GLSA-201510-03 epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet that is improperly handled during decompression. http://advisories.mageia.org/MGASA-2015-0117.html openSUSE-SU-2015:0489 DSA-3210 MDVSA-2015:183 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 72942 1031858 http://www.wireshark.org/security/wnpa-sec-2015-07.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10844 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=b204ff4846fe84b7789893c6b1d9afbdecac5b5d GLSA-201510-03 Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet. http://advisories.mageia.org/MGASA-2015-0117.html openSUSE-SU-2015:0489 RHSA-2015:1460 DSA-3210 MDVSA-2015:183 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 72944 1031858 http://www.wireshark.org/security/wnpa-sec-2015-08.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10895 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=a835c85e3d662343d7283f1dcdacb8a11d1d0727 GLSA-201510-03 epan/proto.c in Wireshark 1.12.x before 1.12.4 does not properly handle integer data types greater than 32 bits in size, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet that is improperly handled by the LLDP dissector. openSUSE-SU-2015:0489 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 72938 1031858 http://www.wireshark.org/security/wnpa-sec-2015-09.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10983 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=d1865e000ebedf49fc0d9f221a11d6af74360837 GLSA-201510-03 Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet. http://advisories.mageia.org/MGASA-2015-0117.html openSUSE-SU-2015:0489 RHSA-2015:1460 DSA-3210 MDVSA-2015:183 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 72941 1031858 http://www.wireshark.org/security/wnpa-sec-2015-10.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11023 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=608cf324b3962877e9699f3e81e8f82ac9f1ea14 GLSA-201510-03 Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet. openSUSE-SU-2015:0489 72937 1031858 http://www.wireshark.org/security/wnpa-sec-2015-11.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=11024 https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=c35ca6c051adb28c321db54cc138f18637977c9a GLSA-201510-03 Unrestricted file upload vulnerability in the fusion_options function in functions.php in the Fusion theme 3.1 for Wordpress allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension in a fusion_save action, then accessing it via unspecified vectors. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a> http://packetstormsecurity.com/files/130397/WordPress-Fusion-3.1-Arbitrary-File-Upload.html 75341 https://wpvulndb.com/vulnerabilities/7795 Multiple cross-site scripting (XSS) vulnerabilities in the WP Media Cleaner plugin 2.2.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) view, (2) paged, or (3) s parameter in the wp-media-cleaner page to wp-admin/upload.php. 20150227 Wordpress Media Cleaner Plugin - XSS Vulnerability SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php. 36061 Cross-site scripting (XSS) vulnerability in the Entity API module before 7.x-1.6 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a field label in the Token API. 72806 https://www.drupal.org/node/2437885 https://www.drupal.org/node/2437905 Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url, (2) pic_url, or (3) avatar_url parameter, which are not properly handled in an error message. http://sourceforge.net/p/beehiveforum/news/2015/02/beehive-forum-145-released/ 36154 Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php. http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html 36086 http://www.wonderplugin.com/wordpress-audio-player/ Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL. http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9 http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7 http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4 http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/ http://git.evergreen-ils.org/?p=Evergreen.git;a=commit;h=ac588e879cf73ff1b65617e0bd273361d3529063 [oss-security] 20150303 Re: CVE request - Evergreen 72885 https://bugs.launchpad.net/evergreen/+bug/1206589 Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ou_setting.ancestor_default to enforce view_perm when no auth token is provided. http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9 http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7 http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4 http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/ http://git.evergreen-ils.org/?p=Evergreen.git;a=commit;h=3a0f1cc7b2efa517ee4cd4c6a682237554fed307 [oss-security] 20150303 Re: CVE request - Evergreen 72889 https://bugs.launchpad.net/evergreen/+bug/1424755 libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values in unknown-language error responses that contain a CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests. FEDORA-2015-3287 FEDORA-2015-3329 FEDORA-2015-3336 openSUSE-SU-2015:1191 DSA-3382 MDVSA-2015:186 http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php 72949 1031871 https://github.com/phpmyadmin/phpmyadmin/commit/b2f1e895038a5700bf8e81fb9a5da36cbdea0eeb The saveObject function in moadmin.php in phpMoAdmin 1.1.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the object parameter. http://packetstormsecurity.com/files/130685/PHPMoAdmin-1.1.2-Remote-Code-Execution.html 20150304 PHPMoAdmin Unauthorized Remote Code Execution (0-Day) 36251 [oss-security] 20150304 CVE request: PHPMoAdmin Unauthorized Remote Code Execution [oss-security] 20150304 Re: CVE request: PHPMoAdmin Unauthorized Remote Code Execution DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php. 20150218 DLGuard Full Path Disclosure (Information Leakage) Security Vulnerabilities http://tetraph.com/security/full-path-disclosure-vulnerability/dlguard-full-path-disclosure-information-leakage-security-vulnerabilities/ 72685 The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell. http://packetstormsecurity.com/files/131732/Epicor-Retail-Store-Help-System-3.2.03.01.008-Code-Execution.html 20150502 Code Injection in Epicor Retail Store 3.2.03.01.008 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-5623. Reason: This candidate is a reservation duplicate of CVE-2015-5623. Notes: All CVE users should reference CVE-2015-5623 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. SQL injection vulnerability in the wp_untrash_post_comments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash. [oss-security] 20150804 Re: CVE request: WordPress 4.2.3 and earlier multiple vulnerabilities DSA-3332 DSA-3383 76160 1033178 https://codex.wordpress.org/Version_4.2.4 https://core.trac.wordpress.org/changeset/33555 https://core.trac.wordpress.org/changeset/33556 https://wordpress.org/news/2015/08/wordpress-4-2-4-security-and-maintenance-release/ https://wpvulndb.com/vulnerabilities/8126 NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php. http://packetstormsecurity.com/files/130583/NetCat-CMS-5.01-3.12-Full-Path-Disclosure.html 20150302 NetCat CMS Full Path Disclosure (Information Disclosure) Security Vulnerabilities http://tetraph.com/security/full-path-disclosure-vulnerability/netcat-cms-full-path-disclosure-information-disclosure-security-vulnerabilities/ 72854 Open redirect vulnerability in the Services single sign-on server helper (services_sso_server_helper) module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters. <a href="http://cwe.mitre.org/data/definitions/601.html">CWE-601: URL Redirection to Untrusted Site ('Open Redirect')</a> 72803 https://www.drupal.org/node/2437965 SQL injection vulnerability in ecomm-sizes.php in the Photocrati theme 4.x for WordPress allows remote attackers to execute arbitrary SQL commands via the prod_id parameter. http://packetstormsecurity.com/files/130595/WordPress-Photocrati-Theme-4.x.x-SQL-Injection.html 36242 74854 https://wpvulndb.com/vulnerabilities/7818 Multiple cross-site scripting (XSS) vulnerabilities in Ultimate PHP Board (aka myUPB) before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) q parameter to search.php or (2) avatar parameter to profile.php. http://packetstormsecurity.com/files/130684/Ultimate-PHP-Board-UPB-2.2.7-Cross-Site-Scripting.html 20150305 Ultimate PHP Board (UPB) 2.2.7 Cross Site Scripting Vulnerability 72991 https://github.com/Halamix2/MyUPB/blob/8b00a8f6ea999d22c22b081f4a144f51ec7225b0/changelog.txt https://github.com/PHP-Outburst/myUPB/issues/17 Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or the itemid parameter in the (3) wonderplugin_audio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php. http://security.szurek.pl/wonderplugin-audio-player-20-blind-sql-injection-and-xss.html 36086 74851 http://www.wonderplugin.com/wordpress-audio-player/ Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe. 1032268 http://support.lenovo.com/us/en/product_security/lsu_privilege http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf 74649 Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php. http://packetstormsecurity.com/files/130369/WordPress-Ninja-Forms-2.8.8-Cross-Site-Scripting.html 20150211 Ninja Forms WordPress Plugin Multiple Cross-Site Scripting Vulnerability 74857 https://wordpress.org/plugins/ninja-forms/changelog/ ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted y0da cryptor file. http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html openSUSE-SU-2015:0906 USN-2594-1 74443 GLSA-201512-08 ClamAV before 0.98.7 allows remote attackers to cause a denial of service (crash) via a crafted petite packed file. http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html openSUSE-SU-2015:0906 USN-2594-1 74443 GLSA-201512-08 Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyvera Endpoint Protection) 3.1.2.1546 allow remote attackers to inject arbitrary web script or HTML via the (1) Arguments, (2) FileName, or (3) URL parameter in a SOAP request. http://packetstormsecurity.com/files/131182/Palo-Alto-Traps-Server-3.1.2.1546-Cross-Site-Scripting.html http://securityadvisories.paloaltonetworks.com/Home/Detail/34 20150329 CVE-2015-2223: Palo Alto Traps Server Stored XSS 73704 Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console. https://bugzilla.zimbra.com/show_bug.cgi?id=97625 https://wiki.zimbra.com/wiki/Security_Center Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate. 1032268 http://support.lenovo.com/us/en/product_security/lsu_privilege http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf 74642 Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated. 1032268 http://support.lenovo.com/us/en/product_security/lsu_privilege http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf 74634 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-1067. Reason: This candidate is a duplicate of CVE-2015-1067. Notes: All CVE users should reference CVE-2015-1067 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Multiple SQL injection vulnerabilities in Betster (aka PHP Betoffice) 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) showprofile.php or (2) categoryedit.php or (3) username parameter in a login to index.php. http://packetstormsecurity.com/files/130696/Betster-1.0.4-SQL-Injection-Authentication-Bypass.html 20150306 Betster (PHP Betoffice) Authentication Bypass and SQL Injection 36306 Multiple unspecified vulnerabilities in Google V8 before 4.1.0.21, as used in Google Chrome before 41.0.2272.76, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html USN-2521-1 Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD transitions, which makes it easier for remote attackers to spoof the address bar for a search-results page by leveraging (1) a compromised search engine or (2) an XSS vulnerability in a search engine, a different vulnerability than CVE-2015-1231. http://googlechromereleases.blogspot.com/2015/03/stable-channel-update.html 74855 https://code.google.com/p/chromium/issues/detail?id=256724 https://code.google.com/p/chromium/issues/detail?id=463349 Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property. MDVSA-2015:109 73095 https://code.djangoproject.com/ticket/24461 https://www.djangoproject.com/weblog/2015/mar/09/security-releases/ Multiple SQL injection vulnerabilities in Webshop hun 1.062S allow remote attackers to execute arbitrary SQL commands via the (1) termid or (2) nyelv_id parameter to index.php. http://packetstormsecurity.com/files/130656/Webshop-Hun-1.062S-SQL-Injection.html 20150305 Webshop hun v1.062S SQL Injection Security Vulnerabilities http://tetraph.com/security/sql-injection-vulnerability/webshop-hun-v1-062s-sql-injection-security-vulnerabilities/ Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php. http://packetstormsecurity.com/files/130653/Webshop-Hun-1.062S-Directory-Traversal.html 20150305 Webshop hun v1.062S Directory Traversal Security Vulnerabilities http://tetraph.com/security/directory-traversal-vulnerability/webshop-hun-v1-062s-directory-traversal-security-vulnerabilities/ Multiple cross-site scripting (XSS) vulnerabilities in Webshop hun 1.062S allow remote attackers to inject arbitrary web script or HTML via the (1) param, (2) center, (3) lap, (4) termid, or (5) nyelv_id parameter to index.php. http://packetstormsecurity.com/files/130648/Webshop-Hun-1.062S-Cross-Site-Scripting.html 20150305 Webshop hun v1.062S XSS (Cross-site Scripting) Security Vulnerabilities http://tetraph.com/security/xss-vulnerability/webshop-hun-v1-062s-xss-cross-site-scripting-security-vulnerabilities/ Huawei Ascend P7 allows remote attackers to cause a denial of service (phone process crash). 72571 http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-414153.htm The MeWidget module on Huawei P7 smartphones with software P7-L10 V100R001C00B136 and earlier versions could lead to the disclosure of contact information. http://www.huawei.com/en/psirt/security-advisories/hw-414289 Unspecified vulnerability in Boosted Boards skateboards allows physically proximate attackers to modify skateboard movement, cause human injury, or cause physical damage via vectors related to an "injection attack" that blocks and hijacks a Bluetooth signal. http://www.theregister.co.uk/2014/12/19/hack_hijacks_boosted_skateboards_kills_hipsters/ https://speakerdeck.com/richo/building-a-hipster-catapult-or-how2own-your-skateboard https://twitter.com/aphyr/status/576502129264738304 https://twitter.com/rich0H/status/576484574504439808 Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request to cgi-bin/editBookmark. http://packetstormsecurity.com/files/131762/Dell-SonicWALL-Secure-Remote-Access-7.5-8.0-CSRF.html http://www.scip.ch/en/?vuldb.75111 73098 1032227 https://support.software.dell.com/product-notification/151370?productName=SonicWALL%20SRA%20Series 36940 Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) banned_word[] parameter to index.php/dashboard/system/conversations/bannedwords/success, (2) channel parameter to index.php/dashboard/reports/logs/view, (3) accessType parameter to index.php/tools/required/permissions/access_entity, (4) msCountry parameter to index.php/dashboard/system/multilingual/setup/load_icon, arHandle parameter to (5) design/submit or (6) design in index.php/ccm/system/dialogs/area/design/submit, (7) pageURL to index.php/dashboard/pages/single, (8) SEARCH_INDEX_AREA_METHOD parameter to index.php/dashboard/system/seo/searchindex/updated, (9) unit parameter to index.php/dashboard/system/optimization/jobs/job_scheduled, (10) register_notification_email parameter to index.php/dashboard/system/registration/open/1, or (11) PATH_INFO to index.php/dashboard/extend/connect/. http://packetstormsecurity.com/files/131882/Concrete5-5.7.3.1-Cross-Site-Scripting.html 20150513 Concrete5 Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-2250 20150513 Concrete5 Security Advisory - Multiple XSS Vulnerabilities - CVE-2015-2250 74651 https://www.concrete5.org/documentation/developers/5.7/background/version-history/5-7-4-release-notes/ https://www.netsparker.com/cve-2015-2250-multiple-xss-vulnerabilities-identified-in-concrete5/ The DeviceManager in Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to obtain sensitive information via a crafted UDS patch with JavaScript. http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417837.htm Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to execute arbitrary code with root privileges via a crafted UDS patch with shell scripts. http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417837.htm The XML interface in Huawei OceanStor UDS devices with software before V100R002C01SPC102 allows remote authenticated users to obtain sensitive information via a crafted XML document. http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417837.htm Huawei OceanStor UDS devices with software before V100R002C01SPC102 might allow remote attackers to capture and change patch loading information resulting in the deletion of directory files and compromise of system functions when loading a patch. https://www.huawei.com/en/psirt/security-advisories/hw-417839 Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amount of traffic from the GE port to the FE port. http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-417840.htm Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process. https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#topic_1_0_3 Multiple untrusted search path vulnerabilities in (1) EQATEC.Analytics.Monitor.Win32_vc100.dll and (2) EQATEC.Analytics.Monitor.Win32_vc100-x64.dll in Telerik Analytics Monitor Library before 3.2.125 allow local users to gain privileges via a Trojan horse (a) csunsapi.dll, (b) swift.dll, (c) nfhwcrhk.dll, or (d) surewarehook.dll file in an unspecified directory. <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> VU#794095 The remove_bad_chars function in utils/cups-browsed.c in cups-filters before 1.0.66 allows remote IPP printers to execute arbitrary commands via consecutive shell metacharacters in the (1) model or (2) PDL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707. http://advisories.mageia.org/MGASA-2015-0132.html http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7333 openSUSE-SU-2015:1244 MDVSA-2015:196 USN-2532-1 https://bugs.linuxfoundation.org/show_bug.cgi?id=1265 message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain sensitive personal-contact and unread-message-count information via a modified URL. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49204 [oss-security] 20150316 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=307380 mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49087 [oss-security] 20150316 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=307381 filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38466 [oss-security] 20150316 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=307382 Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2) title attribute in an IMG element. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49144 [oss-security] 20150316 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=307383 lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote attackers to obtain sensitive course information via unspecified vectors. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48804 [oss-security] 20150316 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=307384 tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as inappropriate" feature. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49084 [oss-security] 20150316 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=307385 login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48691 [oss-security] 20150316 Moodle security issues are now public 73166 https://moodle.org/mod/forum/discuss.php?d=307386 Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a crafted quiz response. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49364 [oss-security] 20150316 Moodle security issues are now public https://moodle.org/mod/forum/discuss.php?d=307387 Cross-site scripting (XSS) vulnerability in WoltLab Community Gallery 2.0 before 2014-12-26 allows remote attackers to inject arbitrary web script or HTML via the parameters[data][7][title] parameter in a saveImageData action to index.php/AJAXProxy. http://packetstormsecurity.com/files/130766/Community-Gallery-2.0-Cross-Site-Scripting.html 20150311 Community Gallery - Srored Corss-Site Scripting vulnerability 36368 http://www.itas.vn/news/itas-team-found-out-a-stored-xss-vulnerability-in-burning-board-community-gallery-77.html 20150311 Community Gallery - Srored Corss-Site Scripting vulnerability 73053 The LZH decompression implementation (CsObjectInt::BuildHufTree function in vpa108csulzh.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, related to look-ups of non-simple codes, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316. http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html 20150513 [CORE-2015-0009] - SAP LZC/LZH Compression Multiple Vulnerabilities 20150522 SAP Security Notes May 2015 http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities 20150513 [CORE-2015-0009] - SAP LZC/LZH Compression Multiple Vulnerabilities 74643 cgi_test.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" (ampersand) in the write_mac write_pid, write_msn, write_tan, or write_hdv parameter. http://packetstormsecurity.com/files/132585/AirLive-Remote-Command-Injection.html 20150706 [CORE-2015-0012] - AirLive Multiple Products OS Command Injection 20150706 [CORE-2015-0012] - AirLive Multiple Products OS Command Injection 75559 https://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection 37532 snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FW_AIC1620W_1.1.0-12_20120709_r1192.pck allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the mac parameter. http://packetstormsecurity.com/files/132609/AirLink101-SkyIPCam1620W-OS-Command-Injection.html 20150708 [CORE-2015-0011] - AirLink101 SkyIPCam1620W OS Command Injection 20150708 [CORE-2015-0011] - AirLink101 SkyIPCam1620W OS Command Injection 75597 https://www.coresecurity.com/advisories/airlink101-skyipcam1620w-os-command-injection 37527 Stack-based buffer overflow in collectoragent.exe in Fortinet Single Sign On (FSSO) before build 164 allows remote attackers to execute arbitrary code via a large PROCESS_HELLO message to the Message Dispatcher on TCP port 8000. 20150318 [CORE-2015-0006] - Fortinet Single Sign On Stack Overflow http://www.coresecurity.com/advisories/fortinet-single-sign-on-stack-overflow http://www.fortiguard.com/advisory/2015-02-27-fsso-stack-based-buffer-overflow http://www.fortiguard.com/advisory/FG-IR-15-006/ 119719 20150318 [CORE-2015-0006] - Fortinet Single Sign On Stack Overflow 73206 36422 Stack-based buffer overflow in the LZC decompression implementation (CsObjectInt::CsDecomprLZC function in vpa106cslzc.cpp) in SAP MaxDB 7.5 and 7.6, Netweaver Application Server ABAP, Netweaver Application Server Java, Netweaver RFC SDK, GUI, RFC SDK, SAPCAR archive tool, and other products allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, aka SAP Security Note 2124806, 2121661, 2127995, and 2125316. http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html 20150513 [CORE-2015-0009] - SAP LZC/LZH Compression Multiple Vulnerabilities 20150522 SAP Security Notes May 2015 http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities 20150513 [CORE-2015-0009] - SAP LZC/LZH Compression Multiple Vulnerabilities 74643 userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers to gain privileges and execute arbitrary code via unspecified vectors, related to client session handling. http://www.zerodayinitiative.com/advisories/ZDI-15-107/ The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/. http://packetstormsecurity.com/files/130587/Ubuntu-Vivid-Upstart-Privilege-Escalation.html 20150302 upstart logrotate privilege escalation in Ubuntu Vivid (development) http://www.halfdog.net/Security/2015/UpstartLogrotationPrivilegeEscalation/ https://bugs.launchpad.net/ubuntu/+source/upstart/+bug/1425685 lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site. https://github.com/edx/edx-platform/commit/a1ffcc52594b1e7240501aab0ea145f1da3edb5a https://open.edx.org/CVE-2015-2286 Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category. http://blog.s9y.org/archives/263-Serendipity-2.0.1-released.html http://packetstormsecurity.com/files/130838/Serendipity-CMS-2.0-Cross-Site-Scripting.html [oss-security] 20150314 CVE-2015-2289: Serendipity CMS cross-site scripting vulnerability in 2.0 version 20150313 Serendipity CMS - XSS Vulnerability in Version 2.0 1031961 https://github.com/s9y/Serendipity/commit/a30886d3bb9d8eeb6698948864c77caaa982435d (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call. http://packetstormsecurity.com/files/130854/Intel-Network-Adapter-Diagnostic-Driver-IOCTL-DoS.html 79623 https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00051&languageid=en-fr 36392 Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands. http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html 20150312 WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection 1031920 https://wordpress.org/plugins/wordpress-seo/changelog/ https://wpvulndb.com/vulnerabilities/7841 36413 https://yoast.com/wordpress-seo-security-release/ Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page. http://packetstormsecurity.com/files/130811/WordPress-SEO-By-Yoast-1.7.3.3-SQL-Injection.html 20150312 WordPress SEO by Yoast <= 1.7.3.3 - Blind SQL Injection 1031920 https://wordpress.org/plugins/wordpress-seo/changelog/ https://wpvulndb.com/vulnerabilities/7841 https://yoast.com/wordpress-seo-security-release/ Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) zone parameter to status_captiveportal.php; (2) if or (3) dragtable parameter to firewall_rules.php; (4) queue parameter in an add action to firewall_shaper.php; (5) id parameter in an edit action to services_unbound_acls.php; or (6) filterlogentries_time, (7) filterlogentries_sourceipaddress, (8) filterlogentries_sourceport, (9) filterlogentries_destinationipaddress, (10) filterlogentries_interfaces, (11) filterlogentries_destinationport, (12) filterlogentries_protocolflags, or (13) filterlogentries_qty parameter to diag_logs_filter.php. http://packetstormsecurity.com/files/131022/pfSense-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html 20150325 Arbitrary file deletion and multiple XSS vulnerabilities in pfSense 73344 36506 https://www.htbridge.com/advisory/HTB23251 https://www.pfsense.org/security/advisories/pfSense-SA-15_03.webgui.asc Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter. http://packetstormsecurity.com/files/131022/pfSense-2.2-Cross-Site-Request-Forgery-Cross-Site-Scripting.html 20150325 Arbitrary file deletion and multiple XSS vulnerabilities in pfSense 73344 36506 https://www.htbridge.com/advisory/HTB23251 https://www.pfsense.org/security/advisories/pfSense-SA-15_04.webgui.asc The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect. <a href="http://cwe.mitre.org/data/definitions/384.html">CWE-384: Session Fixation</a> http://advisories.mageia.org/MGASA-2015-0120.html [oss-security] 20150314 CVE Request for python-requests session fixation vulnerability [oss-security] 20150314 Re: CVE Request for python-requests session fixation vulnerability USN-2531-1 https://github.com/kennethreitz/requests/commit/3bd8afbff29e50b38f889b2f688785a669b9aafc https://warehouse.python.org/project/requests/2.6.0/ nanohttp in libcsoap allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Authorization header. [oss-security] 20150315 Re: CVE request: vulnerabilities in libcsoap node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID. [oss-security] 20150314 Re: CVE Request for information leak in Etherpad exports https://github.com/ether/etherpad-lite/commit/a0fb65205c7d7ff95f00eb9fd88e93b300f30c3d https://github.com/ether/etherpad-lite/releases/tag/1.5.2 Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file. <a href="http://cwe.mitre.org/data/definitions/416.html" rel="nofollow">CWE-416: Use After Free</a> http://git.php.net/?p=php-src.git;a=commit;h=b2cf3f064b8f5efef89bb084521b61318c71781b APPLE-SA-2015-09-30-3 SUSE-SU-2015:0868 openSUSE-SU-2015:0644 SSRT102066 HPSBMU03380 HPSBMU03409 [oss-security] 20150315 Re: CVE Request: PHP 5.6.6 changelog http://php.net/ChangeLog-5.php RHSA-2015:1053 RHSA-2015:1066 RHSA-2015:1135 RHSA-2015:1218 DSA-3198 MDVSA-2015:079 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 73037 1031949 USN-2535-1 https://bugs.php.net/bug.php?id=68901 https://bugzilla.redhat.com/show_bug.cgi?id=1194747 GLSA-201606-10 https://support.apple.com/HT205267 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6405. Reason: This candidate is a reservation duplicate of CVE-2014-6405. Notes: All CVE users should reference CVE-2014-6405 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-6406. Reason: This candidate is a reservation duplicate of CVE-2014-6406. Notes: All CVE users should reference CVE-2014-6406 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive. http://advisories.mageia.org/MGASA-2015-0106.html openSUSE-SU-2015:0568 DSA-3180 MDVSA-2015:157 [oss-security] 20150108 Directory traversals in cpio and friends? [oss-security] 20150116 CVE Request: libarchive -- directory traversal in bsdcpio 1035996 USN-2549-1 https://github.com/libarchive/libarchive/commit/59357157706d47c365b2227739e17daba3607526 https://github.com/libarchive/libarchive/pull/110 https://groups.google.com/forum/#!msg/libarchive-discuss/dN9y1VvE1Qk/Z9uerigjQn0J GLSA-201701-03 FreeBSD-SA-16:22 Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow. http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html APPLE-SA-2015-09-30-3 SUSE-SU-2015:0868 SUSE-SU-2015:0946 openSUSE-SU-2015:0644 openSUSE-SU-2015:0906 SSRT102066 [oss-security] 20150207 Spencer regexp heap overflow? [oss-security] 20150311 Re: CVE request: spencer regexp http://php.net/ChangeLog-5.php RHSA-2015:1053 RHSA-2015:1066 DSA-3195 VU#695940 http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 72611 1031947 USN-2572-1 USN-2594-1 https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/ https://support.apple.com/HT205267 Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element. JVN#19578958 JVNDB-2015-000089 75357 https://symfony.com/blog/cve-2015-2308-esi-code-injection Integer overflow in layout.c++ in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation. [oss-security] 20150317 Re: CVE Request: Cap'n Proto: Several issues https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780565 https://github.com/capnproto/capnproto/blob/master/security-advisories/2015-03-02-0-c%2B%2B-integer-overflow.md https://github.com/capnproto/capnproto/commit/f343f0dbd0a2e87f17cd74f14186ed73e3fbdbfa Integer underflow in Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 might allow remote peers to cause a denial of service or possibly obtain sensitive information from memory or execute arbitrary code via a crafted message. [oss-security] 20150317 Re: CVE Request: Cap'n Proto: Several issues https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780566 https://github.com/capnproto/capnproto/blob/master/security-advisories/2015-03-02-1-c%2B%2B-integer-underflow.md https://github.com/capnproto/capnproto/commit/26bcceda72372211063d62aab7e45665faa83633 Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service (CPU and possibly general resource consumption) via a list with a large number of elements. [oss-security] 20150317 Re: CVE Request: Cap'n Proto: Several issues https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780567 https://github.com/capnproto/capnproto/blob/master/security-advisories/2015-03-02-2-all-cpu-amplification.md https://github.com/capnproto/capnproto/commit/104870608fde3c698483fdef6b97f093fc15685d Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.2, when an application invokes the totalSize method on an object reader, allows remote peers to cause a denial of service (CPU consumption) via a crafted small message, which triggers a "tight" for loop. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-2312. [oss-security] 20150317 Re: CVE Request: Cap'n Proto: Several issues https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=780568 https://github.com/capnproto/capnproto/blob/master/security-advisories/2015-03-05-0-c%2B%2B-addl-cpu-amplification.md https://github.com/capnproto/capnproto/commit/80149744bdafa3ad4eedc83f8ab675e27baee868 SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed. http://klikki.fi/adv/wpml.html http://packetstormsecurity.com/files/130810/WordPress-WPML-XSS-Deletion-SQL-Injection.html 20150312 WPML WordPress plug-in SQL injection etc. http://wpml.org/2015/03/wpml-security-update-bug-and-fix/ 20150312 WPML WordPress plug-in SQL injection etc. Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminder_popup action to the default URI. http://klikki.fi/adv/wpml.html http://packetstormsecurity.com/files/130810/WordPress-WPML-XSS-Deletion-SQL-Injection.html 20150312 WPML WordPress plug-in SQL injection etc. http://wpml.org/2015/03/wpml-security-update-bug-and-fix/ 20150312 WPML WordPress plug-in SQL injection etc. The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string. FEDORA-2015-5766 openSUSE-SU-2015:0643 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 73322 USN-2539-1 https://www.djangoproject.com/weblog/2015/mar/18/security-releases/ The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \x08javascript: URL. FEDORA-2015-5766 FEDORA-2015-9604 openSUSE-SU-2015:0643 openSUSE-SU-2015:1598 USN-2539-1 DSA-3204 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 73319 https://www.djangoproject.com/weblog/2015/mar/18/security-releases/ The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a "SMACK SKIP-TLS" issue. http://www.mono-project.com/news/2015/03/07/mono-tls-vulnerability/ [oss-security] 20150317 Re: Mono TLS vulnerabilities 73253 USN-2547-1 https://bugzilla.redhat.com/show_bug.cgi?id=1202869 https://github.com/mono/mono/commit/1509226c41d74194c146deb173e752b8d3cdeec4 https://mitls.org/pages/attacks/SMACK#skip DSA-3202 The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204. http://www.mono-project.com/news/2015/03/07/mono-tls-vulnerability/ [oss-security] 20150317 Re: Mono TLS vulnerabilities 73250 USN-2547-1 https://bugzilla.redhat.com/show_bug.cgi?id=1202869 https://github.com/mono/mono/commit/9c38772f094168d8bfd5bc73bf8925cd04faad10 https://mitls.org/pages/attacks/SMACK#freak DSA-3202 The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback. http://www.mono-project.com/news/2015/03/07/mono-tls-vulnerability/ [oss-security] 20150317 Re: Mono TLS vulnerabilities 73256 USN-2547-1 https://bugzilla.redhat.com/show_bug.cgi?id=1202869 https://github.com/mono/mono/commit/b371da6b2d68b4cdd0f21d6342af6c42794f998b DSA-3202 Cross-site scripting (XSS) vulnerability in the Job Manager plugin 0.7.22 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the email field. http://packetstormsecurity.com/files/132931/WordPress-Job-Manager-0.7.22-Cross-Site-Scripting.html https://wpvulndb.com/vulnerabilities/8129 37738 FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets. http://fortiguard.com/advisory/2015-07-24-weak-ciphers-suites-are-presented-towards-fortiguard-servers http://www.fortiguard.com/advisory/FG-IR-15-021/ 1033092 Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors. https://fortiguard.com/zeroday/FG-VD-15-009 https://github.com/wp-plugins/photo-gallery/blob/master/readme.txt PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. RHSA-2016:2750 http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup http://www.fortiguard.com/advisory/FG-VD-15-010/ [oss-security] 20151128 Re: Heap Overflow in PCRE 74924 https://bugs.exim.org/show_bug.cgi?id=1503 https://jira.mongodb.org/browse/SERVER-17252 PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. RHSA-2016:1025 RHSA-2016:2750 http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup http://www.fortiguard.com/advisory/FG-VD-15-014/ [oss-security] 20151128 Re: Heap Overflow in PCRE http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html 74924 http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886 https://bugs.exim.org/show_bug.cgi?id=1515 https://jira.mongodb.org/browse/SERVER-17252 Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order. https://fortiguard.com/zeroday/FG-VD-15-020 https://raw.githubusercontent.com/woocommerce/woocommerce/master/CHANGELOG.txt Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies. [oss-security] 20150317 CVE Request: WebKitGTK+ late TLS certificate verification [oss-security] 20150318 Re: CVE Request: WebKitGTK+ late TLS certificate verification https://bugs.webkit.org/show_bug.cgi?id=142244 GLSA-201706-15 https://trac.webkit.org/changeset/181074 https://webkitgtk.org/security/WSA-2015-0002.html Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow. http://git.php.net/?p=php-src.git;a=commit;h=ef8fc4b53d92fbfcd8ef1abbd6f2f5fe2c4a11e5 http://hg.nih.at/libzip/rev/9f11d54f692e APPLE-SA-2015-09-30-3 FEDORA-2015-4565 FEDORA-2015-4669 FEDORA-2015-4553 FEDORA-2015-4556 FEDORA-2015-4699 FEDORA-2015-4559 openSUSE-SU-2015:0615 openSUSE-SU-2015:0644 SSRT102066 HPSBMU03380 HPSBMU03409 http://php.net/ChangeLog-5.php DSA-3198 MDVSA-2015:079 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html 1031985 https://bugs.php.net/bug.php?id=69253 https://support.apple.com/HT205267 Cross-site scripting (XSS) vulnerability in member.php in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/ 73212 1031953 Cross-site scripting (XSS) vulnerability in the MyCode editor in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/ 73213 1031953 Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/ 73214 1031953 A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors. http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/ 73216 1031953 TPView.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to execute arbitrary code on the host OS via unspecified vectors, a different vulnerability than CVE-2012-0897. 75095 1032529 1032530 http://www.vmware.com/security/advisories/VMSA-2015-0004.html TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to execute arbitrary code on the host OS via unspecified vectors. 75095 1032529 1032530 http://www.vmware.com/security/advisories/VMSA-2015-0004.html TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2339. 75092 1032529 1032530 http://www.vmware.com/security/advisories/VMSA-2015-0004.html TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2338. 75092 1032529 1032530 http://www.vmware.com/security/advisories/VMSA-2015-0004.html TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors. 75092 1032529 1032530 http://www.vmware.com/security/advisories/VMSA-2015-0004.html VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.6, and VMware Fusion 6.x before 6.0.6 and 7.x before 7.0.1 allow attackers to cause a denial of service against a 32-bit guest OS or 64-bit host OS via a crafted RPC command. 75094 1032530 http://www.vmware.com/security/advisories/VMSA-2015-0004.html The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol. <a href="https://cwe.mitre.org/data/definitions/415.html">CWE-415: Double Free</a> 20151001 CVE-2015-2342 VMware vCenter Remote Code Execution 76930 1033720 http://www.vmware.com/security/advisories/VMSA-2015-0007.html http://www.zerodayinitiative.com/advisories/ZDI-15-455 https://www.7elements.co.uk/resources/technical-advisories/cve-2015-2342-vmware-vcenter-remote-code-execution/ ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. 1035270 http://www.vmware.com/security/advisories/VMSA-2016-0003.html ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. XML external entity (XXE) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote authenticated users to read arbitrary files via the req parameter. <a href="http://cwe.mitre.org/data/definitions/611.html">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a> http://packetstormsecurity.com/files/131459/Huawei-SEQ-Analyst-XXE-Injection.html 20150415 Huawei SEQ Analyst - XML External Entity Injection (XXE) Cross-site scripting (XSS) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers to inject arbitrary web script or HTML via the command XML element in the req parameter to flexdata.action in (1) common/, (2) monitor/, or (3) psnpm/ or the (4) module XML element in the req parameter to flexdata.action in monitor/. http://packetstormsecurity.com/files/131460/Huawei-SEQ-Analyst-Cross-Site-Scripting.html 20150415 Huawei SEQ Analyst - Multiple Reflected Cross Site Scripting (XSS) http://www.huawei.com/en/security/psirt/security-bulletins/security-notices/hw-424267.htm https://drive.google.com/folderview?id=0B-LWHbwdK3P9fnBlLWZqWlZqNnB0b2xHWFpYUWt3bmY3Y0lPUHVLNm9VTUlFcWhYTHlZSUU&usp=sharing The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. http://git.php.net/?p=php-src.git;a=commit;h=1291d6bbee93b6109eb07e8f7916ff1b7fcc13e1 APPLE-SA-2015-09-30-3 SUSE-SU-2015:0868 openSUSE-SU-2015:0684 HPSBMU03380 HPSBMU03409 http://php.net/ChangeLog-5.php RHSA-2015:1053 RHSA-2015:1066 RHSA-2015:1135 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 73434 1032484 USN-2572-1 https://bugs.php.net/bug.php?id=69207 GLSA-201606-10 https://support.apple.com/HT205267 Cross-site scripting (XSS) vulnerability in defaultnewsletter.php in SuperWebMailer 5.60.0.01190 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTMLForm parameter. http://packetstormsecurity.com/files/130751/SuperWebMailer-5.50.0.01160-Cross-Site-Scripting.html 20150310 SuperWebMailer 5.50.0.01160 XSS (Cross-site Scripting) Security Vulnerabilities http://tetraph.com/security/xss-vulnerability/superwebmailer-5-50-0-01160-xss-cross-site-scripting-security-vulnerabilities/ 73063 Cross-site request forgery (CSRF) vulnerability in MikroTik RouterOS 5.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request in the status page to /cfg. http://packetstormsecurity.com/files/130722/MikroTik-RouterOS-Cross-Site-Request-Forgery.html 20150309 MikroTik RouterOS Admin Password Change CSRF 73013 Multiple cross-site scripting (XSS) vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/help_head.jsp, (2) workplaceresource parameter to system/workplace/locales/en/help/index.html, (3) path parameter to system/workplace/views/admin/admin-main.jsp, (4) mode parameter to system/workplace/views/explorer/explorer_files.jsp, or (5) query parameter in a search action to system/modules/org.opencms.workplace.help/elements/search.jsp. http://packetstormsecurity.com/files/130812/Alkacon-OpenCms-9.5.1-Cross-Site-Scripting.html 20150312 Alkacon OpenCms 9.5.1 Multiple XSS Vulnerabilities 20150312 Alkacon OpenCms 9.5.1 Multiple XSS Vulnerabilities 73112 https://github.com/alkacon/opencms-core/issues/304 The cache handler in MyBB (aka MyBulletinBoard) before 1.8.4 does not properly check the encoding of input to the var_export function, which allows attackers to have an unspecified impact via unknown vectors. http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release/ 73257 1031953 Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability." 75013 1032528 MS15-064 win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." 75025 1032525 MS15-061 Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 does not properly initialize guest OS system data structures, which allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (buffer overflow) by leveraging guest OS privileges, aka "Hyper-V Buffer Overflow Vulnerability." 1032897 MS15-068 Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly initialize guest OS system data structures, which allows guest OS users to execute arbitrary code on the host OS by leveraging guest OS privileges, aka "Hyper-V System Data Structure Vulnerability." 1032897 MS15-068 win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." 1032904 MS15-073 The graphics component in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application that leverages an incorrect bitmap conversion, aka "Graphics Component EOP Vulnerability." 1032902 MS15-072 win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." 1032904 MS15-073 38267 win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." 1032904 MS15-073 38266 win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from uninitialized kernel memory via a crafted application, aka "Win32k Information Disclosure Vulnerability." 1032904 http://www.zerodayinitiative.com/advisories/ZDI-15-536 MS15-073 Untrusted search path vulnerability in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Windows DLL Remote Code Execution Vulnerability." <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> 1032898 MS15-069 Untrusted search path vulnerability in Windows Media Device Manager in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rtf file, aka "DLL Planting Remote Code Execution Vulnerability." <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> 1032898 MS15-069 The authentication implementation in the RPC subsystem in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not prevent DCE/RPC connection reflection, which allows local users to gain privileges via a crafted application, aka "Windows RPC Elevation of Privilege Vulnerability." 1032907 MS15-076 37768 The Windows Installer service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a custom action script associated with a .msi package, aka "Windows Installer EoP Vulnerability." 1032905 MS15-074 vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability." 1032894 1032895 MS15-065 MS15-066 The Remote Desktop Protocol (RDP) server service in Microsoft Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a series of crafted packets, aka "Remote Desktop Protocol (RDP) Remote Code Execution Vulnerability." 1032896 MS15-067 The Netlogon service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly implement domain-controller communication, which allows remote attackers to discover credentials by leveraging certain PDC access and spoofing the BDC role in a PDC communication channel, aka "Elevation of Privilege Vulnerability in Netlogon." 75633 1032900 MS15-071 Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel Viewer 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to bypass the ASLR protection mechanism via a crafted spreadsheet, aka "Microsoft Excel ASLR Bypass Vulnerability." 1032899 MS15-070 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 1032899 MS15-070 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 1032899 MS15-070 Untrusted search path vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel Viewer 2007 SP3, and Office Compatibility Pack SP3 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Microsoft Excel DLL Remote Code Execution Vulnerability." <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> 1032899 MS15-070 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 1032899 MS15-070 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, and Word 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 1032899 MS15-070 win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory via a crafted application, aka "Win32k Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2382. 1032904 MS15-073 win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory via a crafted application, aka "Win32k Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2381. 1032904 MS15-073 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2384 and CVE-2015-2425. 1032894 MS15-065 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2425. 1032894 MS15-065 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, CVE-2015-2406, and CVE-2015-2422. 1032894 MS15-065 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "ATMFD.DLL Memory Corruption Vulnerability." 75587 1032908 TA15-195A MS15-077 Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1738. 1032894 MS15-065 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1733 and CVE-2015-2411. 1032894 MS15-065 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2397, CVE-2015-2404, CVE-2015-2406, and CVE-2015-2422. 1032894 MS15-065 Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 1032894 MS15-065 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2404, CVE-2015-2406, and CVE-2015-2422. 1032894 MS15-065 Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document, aka "Internet Explorer XSS Filter Bypass Vulnerability." 1032894 MS15-065 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1767 and CVE-2015-2408. 1032894 MS15-065 Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability." 75677 1032894 MS15-065 Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 1032894 MS15-065 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2397, CVE-2015-2406, and CVE-2015-2422. 1032894 MS15-065 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, and CVE-2015-2422. 1032894 MS15-065 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1767 and CVE-2015-2401. 1032894 http://www.zerodayinitiative.com/advisories/ZDI-15-458 MS15-065 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted stylesheet, aka "Internet Explorer Information Disclosure Vulnerability." 1032894 MS15-065 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1733 and CVE-2015-2389. 1032894 MS15-065 Microsoft Internet Explorer 10 and 11 allows remote attackers to read arbitrary local files via a crafted pathname, aka "Internet Explorer Information Disclosure Vulnerability." 75687 1032894 MS15-065 Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted module-resource request, aka "Internet Explorer Information Disclosure Vulnerability." 1032894 MS15-065 Microsoft Internet Explorer 8 through 11 allows remote attackers to obtain sensitive browsing-history information via vectors related to image caching, aka "Internet Explorer Information Disclosure Vulnerability." 1032894 MS15-065 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 1032899 MS15-070 OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via crafted input, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "OLE Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2417. 1032906 MS15-075 OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via crafted input, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "OLE Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2416. 1032906 MS15-075 Race condition in Microsoft Malicious Software Removal Tool (MSRT) before 5.26 allows local users to gain privileges via a crafted DLL, aka "MSRT Race Condition Vulnerability." 1032901 https://technet.microsoft.com/library/security/3074162 JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability." 1032894 MS15-065 Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and R2 before Rollup 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "System Center Operations Manager Web Console XSS Vulnerability." 1033245 MS15-086 Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass." 1032894 MS15-065 Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, and CVE-2015-2406. 1032894 MS15-065 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Visio 2013 RT SP1, Word 2013 RT SP1, and Internet Explorer 7 through 11 allow remote attackers to gain privileges and obtain sensitive information via a crafted command-line parameter to an Office application or Notepad, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Unsafe Command Line Parameter Passing Vulnerability." 1033237 1033239 1033248 MS15-079 MS15-081 MS15-088 Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 1032899 MS15-070 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384. 1032894 MS15-065 Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability." http://blog.trendmicro.com/trendlabs-security-intelligence/a-look-at-the-open-type-font-manager-vulnerability-from-the-hacking-team-leak/ VU#103336 75951 1032991 MS15-078 38222 Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." 1034112 MS15-112 Object Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels during interaction with object symbolic links that originated in a sandboxed process, which allows local users to gain privileges via a crafted application, aka "Windows Object Manager Elevation of Privilege Vulnerability." 1033251 MS15-090 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified registry actions via a crafted application, aka "Windows Registry Elevation of Privilege Vulnerability." 1033251 http://www.zerodayinitiative.com/advisories/ZDI-15-379 http://www.zerodayinitiative.com/advisories/ZDI-15-380 http://www.zerodayinitiative.com/advisories/ZDI-15-459 MS15-090 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow attackers to bypass an application sandbox protection mechanism and perform unspecified filesystem actions via a crafted application, aka "Windows Filesystem Elevation of Privilege Vulnerability." 76233 1033251 http://www.zerodayinitiative.com/advisories/ZDI-15-378 MS15-090 Microsoft Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, and Lync Basic 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office Graphics Library (OGL) font, aka "Microsoft Office Graphics Component Remote Code Execution Vulnerability." 1033238 MS15-080 37911 ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability." 1033238 MS15-080 37920 The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Kernel ASLR Bypass Vulnerability." 76213 1033238 MS15-080 38222 Microsoft XML Core Services 3.0 and 5.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2471. 1033241 MS15-084 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, and Silverlight before 5.1.40728 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability." 76238 1033238 http://www.zerodayinitiative.com/advisories/ZDI-15-387 MS15-080 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft XML Core Services 3.0, 5.0, and 6.0 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "MSXML Information Disclosure Vulnerability." 76232 1033241 http://www.zerodayinitiative.com/advisories/ZDI-15-381 MS15-084 Microsoft Internet Explorer 7 through 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2452. 1033237 MS15-079 MS15-091 Microsoft Internet Explorer 8 through 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2444. 1033237 MS15-079 MS15-091 Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability." 76195 1033237 http://www.zerodayinitiative.com/advisories/ZDI-15-382 MS15-079 Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2442. 76194 1033237 MS15-079 37764 Microsoft Internet Explorer 10 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "ASLR Bypass." 1033237 MS15-079 Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2447. 1033237 MS15-079 MS15-091 Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2446. 1033237 MS15-079 Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability." 76191 1033237 MS15-079 Microsoft Internet Explorer 7 through 11 and Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "ASLR Bypass." 1033237 MS15-079 MS15-091 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2451. 76190 1033237 MS15-079 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2450. 76189 1033237 MS15-079 Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2441. 76188 1033237 MS15-079 The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information via a crafted application that continues to execute during a subsequent user's login session, aka "Windows CSRSS Elevation of Privilege Vulnerability." 1033238 MS15-080 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows KMD Security Feature Bypass Vulnerability." 1033238 MS15-080 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2456. 76216 1033238 MS15-080 37919 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2455. 76241 1033238 MS15-080 37918 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2459 and CVE-2015-2461. 1033238 MS15-080 37923 ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2458 and CVE-2015-2461. 1033238 MS15-080 37922 ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability." 1033238 MS15-080 37921 ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2458 and CVE-2015-2459. 76209 1033238 MS15-080 37917 ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability." 76215 1033238 MS15-080 37916 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2464. 76239 1033238 MS15-080 37915 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, Silverlight before 5.1.40728, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allow remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2463. 76240 1033238 MS15-080 37914 The Windows shell in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Shell Security Feature Bypass Vulnerability." 1033238 MS15-080 Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted template, aka "Microsoft Office Remote Code Execution Vulnerability." 1033239 MS15-081 Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." 1033239 MS15-081 37913 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." 1033239 MS15-081 37912 Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." 1033239 MS15-081 37910 Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability." 1033239 MS15-081 37924 Microsoft XML Core Services 3.0, 5.0, and 6.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2434. 1033241 MS15-084 Remote Desktop Session Host (RDSH) in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly verify certificates, which allows man-in-the-middle attackers to spoof clients via a crafted certificate with valid Issuer and Serial Number fields, aka "Remote Desktop Session Host Spoofing Vulnerability." 1033242 MS15-082 Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability." <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> Per the Microsoft advisory, " In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted RDP file that is designed to exploit the vulnerability. An attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message." This vulnerability has been assigned and Attack Vector of Remote. 1033242 MS15-082 Microsoft Windows Vista SP2 and Server 2008 SP2 allow remote authenticated users to execute arbitrary code via a crafted string in a Server Message Block (SMB) server error-logging action, aka "Server Message Block Memory Corruption Vulnerability." 1033243 MS15-083 Cross-site scripting (XSS) vulnerability in uddi/search/frames.aspx in the UDDI Services component in Microsoft Windows Server 2008 SP2 and BizTalk Server 2010, 2013 Gold, and 2013 R2 allows remote attackers to inject arbitrary web script or HTML via the search parameter, aka "UDDI Services Elevation of Privilege Vulnerability." 76259 1033246 MS15-087 The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "WebDAV Client Information Disclosure Vulnerability." 1033249 MS15-089 Microsoft Office 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." 1033239 MS15-081 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application that triggers a Winsock call referencing an invalid address, aka "Winsock Elevation of Privilege Vulnerability." 1034121 MS15-119 The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a crafted .NET application, aka "RyuJIT Optimization Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2480 and CVE-2015-2481. 1033253 MS15-092 The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a crafted .NET application, aka "RyuJIT Optimization Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2479 and CVE-2015-2481. 1033253 MS15-092 The RyuJIT compiler in Microsoft .NET Framework 4.6 produces incorrect code during an attempt at optimization, which allows remote attackers to execute arbitrary code via a crafted .NET application, aka "RyuJIT Optimization Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2479 and CVE-2015-2480. 1033253 MS15-092 The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted replace operation with a JavaScript regular expression, aka "Scripting Engine Memory Corruption Vulnerability." 20151013 JScript 5.7 (MSIE 8) RegExpBase::FBadHeader regular expression use-after-free 1033800 http://www.zerodayinitiative.com/advisories/ZDI-15-515 MS15-106 MS15-108 40798 Microsoft Internet Explorer 10 and 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Information Disclosure Vulnerability." 76584 1033487 MS15-094 Microsoft Internet Explorer 10 and 11 uses an incorrect flag during certain filesystem accesses, which allows remote attackers to delete arbitrary files via unspecified vectors, aka "Tampering Vulnerability." 76586 1033487 MS15-094 Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2491 and CVE-2015-2541. 76572 1033487 MS15-094 MS15-095 Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499. 76573 1033487 MS15-094 MS15-095 Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499. 76574 1033487 MS15-094 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Elevation of Privilege Vulnerability." 76585 1033487 MS15-094 Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2492, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499. 76576 1033487 MS15-094 Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2541. 76577 1033487 MS15-094 Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490, CVE-2015-2494, CVE-2015-2498, and CVE-2015-2499. 76578 1033487 MS15-094 The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability." 76575 1033487 MS15-094 Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2498, and CVE-2015-2499. 76570 1033487 MS15-094 MS15-095 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, and CVE-2015-2499. 76579 1033487 http://www.zerodayinitiative.com/advisories/ZDI-15-424 MS15-094 Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, and CVE-2015-2498. 76580 1033487 http://www.zerodayinitiative.com/advisories/ZDI-15-425 MS15-094 Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability." 76581 1033487 http://www.zerodayinitiative.com/advisories/ZDI-15-426 MS15-094 Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability." 76582 1033487 http://www.zerodayinitiative.com/advisories/ZDI-15-427 MS15-094 Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," as exploited in the wild in August 2015. http://twitter.com/Laughing_Mantis/statuses/633839231840841728 http://twitter.com/Laughing_Mantis/statuses/633839771865886721 76403 1033317 http://www.securityweek.com/microsoft-issues-emergency-patch-critical-ie-flaw-exploited-wild MS15-093 Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese) SP3, Access 2010 SP2, Excel 2010 SP2, InfoPath 2010 SP2, OneNote 2010 SP2, PowerPoint 2010 SP2, Project 2010 SP2, Publisher 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Pinyin IME 2010, Access 2013 SP1, Excel 2013 SP1, InfoPath 2013 SP1, OneNote 2013 SP1, PowerPoint 2013 SP1, Project 2013 SP1, Publisher 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, OneNote 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Access 2016, Excel 2016, OneNote 2016, PowerPoint 2016, Project 2016, Publisher 2016, Visio 2016, Word 2016, Skype for Business 2016, and Lync 2013 SP1 allow remote attackers to bypass a sandbox protection mechanism and gain privileges via a crafted web site that is accessed with Internet Explorer, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Microsoft Office Elevation of Privilege Vulnerability." 1034117 1034119 1034122 MS15-116 Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 improperly counts objects before performing an array copy, which allows remote attackers to (1) execute arbitrary code via a crafted XAML browser application (XBAP) or (2) bypass Code Access Security restrictions via a crafted .NET Framework application, aka ".NET Elevation of Privilege Vulnerability." 76560 1033493 MS15-101 Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted request, aka "Exchange Information Disclosure Vulnerability." 1033495 MS15-103 atmfd.dll in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to cause a denial of service (system crash) via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability." 76563 1033485 MS15-097 The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2512. 76591 1033485 MS15-097 38279 The Adobe Type Manager Library in Microsoft Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability." 76592 1033485 MS15-097 38198 Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media Center link (mcl) file, aka "Windows Media Center RCE Vulnerability." http://www.rapid7.com/db/modules/exploit/windows/fileformat/ms15_100_mcl_exe 76594 1033499 MS15-100 38151 38195 Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "Graphics Component Buffer Overflow Vulnerability." 76593 1033485 1033500 1033501 MS15-097 38217 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2517, CVE-2015-2518, and CVE-2015-2546. 76597 1033485 MS15-097 38276 The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Font Driver Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2507. 76589 1033485 MS15-097 38280 Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2514 and CVE-2015-2530. 1033484 MS15-098 Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2530. 1033484 MS15-098 Use-after-free vulnerability in Windows Shell in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted toolbar object, aka "Toolbar Use After Free Vulnerability." <a href="http://cwe.mitre.org/data/definitions/416.html" rel="nofollow">CWE-416: Use After Free</a> 1033799 MS15-109 Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to cause a denial of service (data loss) via a crafted .jnt file, aka "Windows Journal DoS Vulnerability." 1033484 MS15-098 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2518, and CVE-2015-2546. 76606 1033485 MS15-097 38278 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2546. 76607 1033485 MS15-097 38277 Integer overflow in Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal Integer Overflow RCE Vulnerability." 1033484 MS15-098 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 1033488 MS15-099 38215 Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 1033488 MS15-099 38216 Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content, aka "Microsoft SharePoint XSS Spoofing Vulnerability." http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 1033489 MS15-099 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability." 1033488 MS15-099 38214 Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Task Management Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2528. 1033494 MS15-102 38202 Task Scheduler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to bypass intended filesystem restrictions and delete arbitrary files via unspecified vectors, aka "Windows Task File Deletion Elevation of Privilege Vulnerability." 76653 1033494 MS15-102 38200 Microsoft .NET Framework 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to cause a denial of service to an ASP.NET web site via crafted requests, aka "MVC Denial of Service Vulnerability." 76567 1033493 MS15-101 The process-initialization implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability." 76599 1033485 MS15-097 38199 Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Task Management Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2524. 1033494 MS15-102 38201 The kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Kernel ASLR Bypass Vulnerability." 76602 1033485 MS15-097 Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2514. 1033484 MS15-098 Cross-site scripting (XSS) vulnerability in the jQuery engine in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Information Disclosure Vulnerability." 1033497 MS15-104 Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability." 1033497 MS15-104 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Hyper-V in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows 10 improperly processes ACL settings, which allows local users to bypass intended network-traffic restrictions via a crafted application, aka "Hyper-V Security Feature Bypass Vulnerability." 1033496 MS15-105 Active Directory in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of service (service outage) by creating multiple machine accounts, aka "Active Directory Denial of Service Vulnerability." 1033492 MS15-096 Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 and Skype for Business Server 2015 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Skype for Business Server and Lync Server XSS Elevation of Privilege Vulnerability." 1033497 MS15-104 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2491. 76583 1033487 http://www.zerodayinitiative.com/advisories/ZDI-15-428 MS15-094 Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability." 76571 1033487 MS15-094 MS15-095 Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability." 1033495 MS15-103 Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, aka "Exchange Spoofing Vulnerability." 1033495 MS15-103 Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability." http://blog.morphisec.com/exploit-bypass-emet-cve-2015-2545 1033488 MS15-099 The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2511, CVE-2015-2517, and CVE-2015-2518. 76608 1033485 MS15-097 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Microsoft Tablet Input Band Use After Free Vulnerability." <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> 1033799 MS15-109 The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Corruption Vulnerability." 1033805 MS15-111 The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability." 1033805 MS15-111 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows physically proximate attackers to bypass the Trusted Boot protection mechanism, and consequently interfere with the integrity of code, BitLocker, Device Encryption, and Device Health Attestation, via a crafted Boot Configuration Data (BCD) setting, aka "Trusted Boot Security Feature Bypass Vulnerability." http://packetstormsecurity.com/files/133962/Microsoft-Trusted-Boot-Security-Feature-Bypass.html 20151014 [CVE-2015-2552] Windows 8+ - Trusted Boot Security Feature Bypass Vulnerability 1033805 MS15-111 The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 mishandles junctions during mountpoint creation, which makes it easier for local users to gain privileges by leveraging certain sandbox access, aka "Windows Mount Point Elevation of Privilege Vulnerability." http://packetstormsecurity.com/files/133971/Windows-Sandboxed-Mount-Reparse-Point-Creation-Mitigation-Bypass.html 1033805 MS15-111 38474 The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Object Reference Elevation of Privilege Vulnerability." 76998 1033805 MS15-111 38580 Use-after-free vulnerability in Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted calculatedColumnFormula object in an Office document, aka "Microsoft Office Memory Corruption Vulnerability." <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> 1033803 http://www.zerodayinitiative.com/advisories/ZDI-15-517 MS15-110 The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka "Microsoft SharePoint Information Disclosure Vulnerability." 1033804 MS15-110 Buffer overflow in Microsoft Visio 2007 SP3 and 2010 SP2 allows remote attackers to execute arbitrary code via crafted UML data in an Office document, aka "Microsoft Office Memory Corruption Vulnerability." 1033803 http://www.zerodayinitiative.com/advisories/ZDI-15-519 MS15-110 Use-after-free vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, Excel Viewer, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a long fileVersion element in an Office document, aka "Microsoft Office Memory Corruption Vulnerability." <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> 1033803 http://www.zerodayinitiative.com/advisories/ZDI-15-516 MS15-110 Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL. DSA-3200 73219 https://www.drupal.org/SA-CORE-2015-001 Manage Engine Desktop Central 9 before build 90135 allows remote attackers to change passwords of users with the Administrator role via an addOrModifyUser operation to servlets/DCOperationsServlet. http://packetstormsecurity.com/files/131062/Manage-Engine-Desktop-Central-9-Unauthorized-Administrative-Password-Reset.html 20150327 Manage Engine Desktop Central 9 - CVE-2015-2560 - Unauthorised administrative password reset 73380 https://www.manageengine.com/products/desktop-central/unauthorized-admin-credential-modification.html Multiple SQL injection vulnerabilities in the Web-Dorado ECommerce WD (com_ecommercewd) component 1.2.5 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) search_category_id, (2) sort_order, or (3) filter_manufacturer_ids in a displayproducts action to index.php. http://packetstormsecurity.com/files/130896/Joomla-ECommerce-WD-1.2.5-SQL-Injection.html 20150319 Web-Dorado ECommerce-WD for Joomla plugin multiple unauthenticated SQL injections 73285 36439 SQL injection vulnerability in groups.php in Vastal I-Tech phpVID 0.9.9 and 1.2.3 allows remote attackers to execute arbitrary SQL commands via the order_by parameter. NOTE: The cat parameter vector is already covered by CVE-2008-4157. http://packetstormsecurity.com/files/130754/Vastal-I-tech-phpVID-1.2.3-SQL-Injection.html 20150310 Vastal I-tech phpVID 1.2.3 SQL Injection Security Vulnerabilities http://tetraph.com/security/sql-injection-vulnerability/vastal-i-tech-phpvid-1-2-3-sql-injection-security-vulnerabilities/ SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php. http://packetstormsecurity.com/files/130691/ProjectSend-r561-SQL-Injection.html 20150305 ProjectSend r561 - SQL injection vulnerability 36303 http://www.itas.vn/news/itas-team-found-out-a-SQL-Injection-vulnerability-in-projectsend-r561-76.html 20150310 ProjectSend r561 - SQL injection vulnerability Unspecified vulnerability in the Oracle Installed Base component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Create Item Instance. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74080 1032129 Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via vectors related to DML. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges. SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 GLSA-201507-19 Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote attackers to affect availability via unknown vectors related to Server : Security : Privileges. SUSE-SU-2015:0946 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1647 RHSA-2015:1665 DSA-3229 DSA-3311 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74073 1032121 USN-2575-1 GLSA-201507-19 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 11.5.10, 12.0, 12.1, and 12.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74116 1032124 Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. SUSE-SU-2015:0946 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1647 RHSA-2015:1665 DSA-3229 DSA-3311 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74095 1032121 USN-2575-1 https://mariadb.com/kb/en/mariadb/mariadb-5543-release-notes/ GLSA-201507-19 Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running on Windows, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core. http://packetstormsecurity.com/files/131507/Oracle-Hyperion-Smart-View-For-Office-11.1.2.3.000-DoS.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74071 1032123 36783 Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL. SUSE-SU-2015:0946 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1647 RHSA-2015:1665 DSA-3229 DSA-3311 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74078 1032121 USN-2575-1 GLSA-201507-19 Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality via unknown vectors related to Text Utilities. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74142 1032132 Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Connector/J. SUSE-SU-2015:0946 openSUSE-SU-2015:0967 DSA-3621 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74075 1032121 https://security.netapp.com/advisory/ntap-20150417-0003/ Unspecified vulnerability in the MySQL Utilities component in Oracle MySQL 1.5.1 and earlier, when running on Windows, allows local users to affect integrity via unknown vectors related to Installation. Per Oracle: This vulnerability is only applicable on Windows operating system (http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html) SUSE-SU-2015:0946 http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 1032121 Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Accounting commands. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74122 1032132 Unspecified vulnerability in Oracle Sun Solaris 11.2 allows remote attackers to affect availability via vectors related to Kernel IDMap. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74143 1032132 Unspecified vulnerability in the Oracle Health Sciences Argus Safety component in Oracle Health Sciences Applications 8.0 allows local users to affect confidentiality via vectors related to BIP Installer. http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html 74113 1032130 Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via vectors related to NFSv4. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75889 1032914 Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 5.1 and 5.2 allows remote attackers to affect confidentiality and availability via unknown vectors related to JServer. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to GIS. openSUSE-SU-2015:1629 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1630 RHSA-2015:1646 RHSA-2015:1647 RHSA-2015:1665 DSA-3308 DSA-3311 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75751 1032911 USN-2674-1 GLSA-201610-06 Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Hyperion Enterprise Performance Management Architect component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-2592. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032924 Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0 allows remote authenticated users to affect availability via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032903 Unspecified vulnerability in the Application Express component in Oracle Database Server before 4.2.1 allows remote attackers to affect availability via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032903 Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect integrity via vectors related to SWSE Server Infrastructure. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75876 1032916 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote attackers to affect integrity via vectors related to PIA Core Technology. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032917 Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via vectors related to S10 Branded Zone. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75878 1032914 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. </a> openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1228 RHSA-2015:1229 RHSA-2015:1230 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1243 RHSA-2015:1485 RHSA-2015:1486 RHSA-2015:1488 RHSA-2015:1526 RHSA-2015:1544 RHSA-2015:1604 DSA-3316 DSA-3339 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75818 1032910 USN-2696-1 USN-2706-1 GLSA-201603-11 GLSA-201603-14 Unspecified vulnerability in the PeopleSoft Enterprise Portal - Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote authenticated users to affect integrity via unknown vectors related to Enterprise Portal. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032917 Unspecified vulnerability in the Hyperion Enterprise Performance Management Architect component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-2584. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032924 Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Configuration Service. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core. openSUSE-SU-2015:1400 DSA-3359 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75899 Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 12.1.0.1 and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032903 Unspecified vulnerability in Oracle Java SE 7u80 allows remote attackers to affect integrity via unknown vectors related to Hotspot. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. </a> openSUSE-SU-2015:1288 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1242 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75887 1032910 Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Install. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to Mac OS X only.</a> openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75856 1032910 Unspecified vulnerability in the mobile app in Oracle Business Intelligence Enterprise Edition in Oracle Fusion Middleware before 11.1.1.7.0 (11.6.39) allows remote authenticated users to affect integrity via unknown vectors related to Mobile - iPad. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the RDBMS Scheduler component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors. SUSE-SU-2015:1353 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032903 Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032916 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.</a> http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727 openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1228 RHSA-2015:1229 RHSA-2015:1230 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1243 RHSA-2015:1485 RHSA-2015:1486 RHSA-2015:1488 RHSA-2015:1526 RHSA-2015:1544 RHSA-2015:1604 DSA-3316 DSA-3339 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75867 1032910 1037732 USN-2696-1 USN-2706-1 https://kc.mcafee.com/corporate/index?page=content&id=SB10139 GLSA-201603-11 GLSA-201603-14 Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2603, CVE-2015-2604, CVE-2015-2605, CVE-2015-2606, and CVE-2015-4745. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75755 http://www.zerodayinitiative.com/advisories/ZDI-15-355 Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2604, CVE-2015-2605, CVE-2015-2606, and CVE-2015-4745. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75754 http://www.zerodayinitiative.com/advisories/ZDI-15-356 Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2605, CVE-2015-2606, and CVE-2015-4745. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75757 http://www.zerodayinitiative.com/advisories/ZDI-15-354 Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2604, CVE-2015-2606, and CVE-2015-4745. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75756 http://www.zerodayinitiative.com/advisories/ZDI-15-353 Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2604, CVE-2015-2605, and CVE-2015-4745. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75758 http://www.zerodayinitiative.com/advisories/ZDI-15-352 Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.0.2, 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to affect confidentiality via unknown vectors related to Content Acquisition System. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in (1) the Oracle Communications Diameter Signaling Router (DSR) component in Oracle Communications Applications 4.1.6 and earlier, 5.1.0 and earlier, 6.0.2 and earlier, and 7.1.0 and earlier; (2) the Oracle Communications Performance Intelligence Center Software component in Oracle Communications Applications 9.0.3 and earlier and 10.1.5 and earlier; (3) the Oracle Communications Policy Management component in Oracle Communications Applications 9.9.0 and earlier, 10.5.0 and earlier, 11.5.0 and earlier, and 12.1.0 and earlier; and (4) the Oracle Communications Tekelec HLR Router component in Oracle Communications Applications 4.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to PMAC. http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 1033900 Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to CPU performance counters drivers. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032914 Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Popup windows. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032926 Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML. openSUSE-SU-2015:1629 RHSA-2015:1630 RHSA-2015:1646 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75762 1032911 USN-2674-1 GLSA-201610-06 Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect confidentiality via vectors related to LDAP Security Adapter. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032916 Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JCE. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.</a> http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727 openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1485 RHSA-2015:1488 DSA-3316 DSA-3339 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75871 1032910 USN-2696-1 USN-2706-1 https://kc.mcafee.com/corporate/index?page=content&id=SB10139 GLSA-201603-11 GLSA-201603-14 Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to NVM Express SSD driver. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032914 Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.0.6, 12.1.3, and 12.2.3 allows remote attackers to affect confidentiality via unknown vectors related to Portal. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032926 Unspecified vulnerability in Oracle Sun Solaris 3.3 and 4.2 allows local users to affect availability via unknown vectors related to DevFS. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032914 Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Partition. openSUSE-SU-2015:1629 RHSA-2015:1630 RHSA-2015:1646 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75774 1032911 USN-2674-1 GLSA-201610-06 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect integrity via unknown vectors related to Input validation. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032926 Unspecified vulnerability in Oracle Java SE 7u80 and 8u45, JavaFX 2.2.80, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. </a> openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1485 RHSA-2015:1488 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75881 1032910 GLSA-201603-11 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698 openSUSE-SU-2015:1629 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1630 RHSA-2015:1646 RHSA-2015:1647 RHSA-2015:1665 DSA-3308 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75837 1032911 USN-2674-1 GLSA-201610-06 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33, allows remote attackers to affect confidentiality via vectors related to JMX. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. </a> openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1228 RHSA-2015:1229 RHSA-2015:1230 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1243 RHSA-2015:1485 RHSA-2015:1486 RHSA-2015:1488 RHSA-2015:1526 RHSA-2015:1544 RHSA-2015:1604 DSA-3316 DSA-3339 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75874 1032910 USN-2696-1 USN-2706-1 GLSA-201603-11 GLSA-201603-14 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.54 allows remote attackers to affect integrity via unknown vectors related to Fluid Core. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032917 Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 3.0.1 and 3.1.2, and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.1.0, 12.1.2.0, and 12.1.3.0, allows remote attackers to affect integrity via unknown vectors related to Java Server Faces. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032953 Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via vectors related to JSSE. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client and server deployment of JSSE.</a> http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727 openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 SUSE-SU-2015:2166 SUSE-SU-2015:2192 SUSE-SU-2016:0113 RHSA-2015:1228 RHSA-2015:1229 RHSA-2015:1230 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1243 RHSA-2015:1485 RHSA-2015:1486 RHSA-2015:1488 RHSA-2015:1526 RHSA-2015:1604 DSA-3316 DSA-3339 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75895 1032910 USN-2696-1 USN-2706-1 https://kc.mcafee.com/corporate/index?page=content&id=SB10139 GLSA-201603-11 GLSA-201603-14 Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to installation. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to installation process on client deployment of Java.</a> openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1243 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75893 1032910 GLSA-201603-11 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1228 RHSA-2015:1229 RHSA-2015:1230 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1243 RHSA-2015:1526 DSA-3316 DSA-3339 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75796 1032910 USN-2696-1 USN-2706-1 GLSA-201603-11 GLSA-201603-14 Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0457. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">The CVSS score is 9.0 only on Windows for Database versions prior to 12c. The CVSS is 6.5 (Confidentiality, Integrity and Availability is "Partial+") for Database 12c on Windows and for all versions of Database on Linux, Unix and other platforms.</a> SUSE-SU-2015:1353 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032903 Unspecified vulnerability in the Technology stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Applet startup. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032926 Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to rmformat. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75855 1032914 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. </a> openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1228 RHSA-2015:1229 RHSA-2015:1230 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1243 RHSA-2015:1485 RHSA-2015:1486 RHSA-2015:1488 RHSA-2015:1526 RHSA-2015:1544 RHSA-2015:1604 DSA-3316 DSA-3339 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75861 1032910 USN-2696-1 USN-2706-1 USN-2740-1 GLSA-201603-11 GLSA-201603-14 GLSA-201701-58 Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.0.1 and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Ops Center. http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 1033897 Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-4758, and CVE-2015-4759. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality via unknown vectors related to 2D. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. </a> openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1243 RHSA-2015:1485 RHSA-2015:1486 RHSA-2015:1488 RHSA-2015:1544 RHSA-2015:1604 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75883 1032910 GLSA-201603-11 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JavaFX 2.2.80; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets. </a> openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1243 RHSA-2015:1485 RHSA-2015:1486 RHSA-2015:1488 RHSA-2015:1544 RHSA-2015:1604 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75833 1032910 GLSA-201603-11 Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Firewall. openSUSE-SU-2015:1629 RHSA-2015:1630 RHSA-2015:1646 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75760 1032911 USN-2674-1 GLSA-201610-06 Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges. openSUSE-SU-2015:1629 RHSA-2015:1630 RHSA-2015:1646 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75815 1032911 USN-2674-1 GLSA-201610-06 Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Gzip. http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html 1033881 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer. openSUSE-SU-2015:1629 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1630 RHSA-2015:1646 RHSA-2015:1647 RHSA-2015:1665 DSA-3308 DSA-3311 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75830 1032911 USN-2674-1 GLSA-201610-06 Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect confidentiality via unknown vectors related to Security. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032915 Unspecified vulnerability in the Oracle Web Applications Desktop Integrator component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect integrity via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032926 Unspecified vulnerability in the Enterprise Manager for Oracle Database component in Oracle Enterprise Manager Grid Control EM Base Platform: 11.1.0.1; EM Plugin for DB: 12.1.0.5, 12.1.0.6, 12.1.0.7; EM DB Control: 11.1.0.7, 11.2.0.3, and 11.2.0.4 allows remote attackers to affect integrity via unknown vectors related to Content Management. SUSE-SU-2015:1353 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032918 Unspecified vulnerability in the Enterprise Manager for Oracle Database component in Oracle Enterprise Manager Grid Control EM Base Platform 11.1.0.1; EM Plugin for DB 12.1.0.5, 12.1.0.6, 12.1.0.7; and EM DB Control 11.1.0.7, 11.2.0.3, and 11.2.0.4 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Content Management. SUSE-SU-2015:1353 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032918 Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to DML. openSUSE-SU-2015:1629 RHSA-2015:1628 RHSA-2015:1629 RHSA-2015:1630 RHSA-2015:1646 RHSA-2015:1647 RHSA-2015:1665 DSA-3308 DSA-3311 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75822 1032911 USN-2674-1 GLSA-201610-06 Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1, 8.22, and 15.0 allows remote authenticated users to affect confidentiality via vectors related to UIF Open UI. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032916 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect confidentiality via unknown vectors related to Multichannel Framework. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032917 Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to Kernel Zones virtualized NIC driver. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032914 Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect integrity via unknown vectors related to Web Management. 20151008 CVE-2015-2652 - Unauthenticated File Upload in Oracle E-business Suite. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032926 Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.1.1, 3.1.2, 11.0, and 11.1 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Content Acquisition System. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Application Express component in Oracle Database Server before 4.2.3.00.08 allows remote authenticated users to affect confidentiality and integrity via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75864 1032903 Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, and 6.3.0 through 6.3.7 allows remote authenticated users to affect confidentiality via unknown vectors related to Business Process Automation. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032915 Unspecified vulnerability in the Web Cache component in Oracle Fusion Middleware 11.1.1.7.0 allows remote attackers to affect confidentiality via vectors related to SSL/TLS Support. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032945 Unspecified vulnerability in Oracle Java SE 8u45 and Java SE Embedded 8u33 allows remote attackers to affect availability via unknown vectors related to Security. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.</a> http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727 openSUSE-SU-2015:1289 RHSA-2015:1228 RHSA-2015:1241 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75877 1032910 GLSA-201603-11 Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect confidentiality and integrity via vectors related to Oracle Agile PLM Framework. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032915 Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows local users to affect availability via unknown vectors related to Client. openSUSE-SU-2015:1629 RHSA-2015:1630 RHSA-2015:1646 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75813 1032911 USN-2674-1 GLSA-201610-06 Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via vectors related to DHCP Server. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75886 1032914 Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, and 6.3.0 through 6.3.7 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Business Process Automation. http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 1032915 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Per Advisory: <a href="http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html">Applies to client deployment of Java only. This vulnerability can be exploited only through sandboxed Java Web Start applications and sandboxed Java applets.</a> openSUSE-SU-2015:1288 openSUSE-SU-2015:1289 SUSE-SU-2015:1319 SUSE-SU-2015:1320 RHSA-2015:1241 RHSA-2015:1242 RHSA-2015:1243 RHSA-2015:1485 RHSA-2015:1486 RHSA-2015:1488 RHSA-2015:1544 RHSA-2015:1604 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 75857 1032910 GLSA-201603-11 Cross-site scripting (XSS) vulnerability in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. FEDORA-2016-a8e2be0fe6 FEDORA-2016-4a5ce6a6c0 FEDORA-2016-852a39e085 http://www.cacti.net/release_notes_0_8_8d.php DSA-3295 http://www.fortiguard.com/advisory/FG-VD-15-017/ 75309 1032672 Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4 FEDORA-2015-4457 RHSA-2015:1534 [oss-security] 20150320 Re: CVE Request: Linux kernel execution in the early microcode loader. 1032414 https://bugzilla.redhat.com/show_bug.cgi?id=1204722 https://github.com/torvalds/linux/commit/f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4 Untrusted search path vulnerability in GNS3 1.2.3 allows local users to gain privileges via a Trojan horse uuid.dll in an unspecified directory. <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a> http://packetstormsecurity.com/files/131731/GNS3-1.2.3-DLL-Hijacking.html 74710 ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file. http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html openSUSE-SU-2015:0906 USN-2594-1 74472 GLSA-201512-08 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2015. Notes: none. The xsave/xrstor implementation in arch/x86/include/asm/xsave.h in the Linux kernel before 3.19.2 creates certain .altinstr_replacement pointers and consequently does not provide any protection against instruction faulting, which allows local users to cause a denial of service (panic) by triggering a fault, as demonstrated by an unaligned memory operand or a non-canonical address memory operand. http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06c8173eb92bbfc03a0fe8bb64315857d0badd06 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.2 [oss-security] 20150321 Re: CVE Request: Linux kernel unprivileged denial-of-service due to mis-protected xsave/xrstor instructions. https://bugzilla.redhat.com/show_bug.cgi?id=1204729 https://github.com/torvalds/linux/commit/06c8173eb92bbfc03a0fe8bb64315857d0badd06 The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote attackers to gain administrator privileges and execute arbitrary code via the option_name and option_value parameters. http://blog.rastating.com/wp-easycart-privilege-escalation-information-disclosure/ Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CERT_NONE value for the cert_reqs argument. [oss-security] 20150323 Re: Assign a CVE for Python's restkit Please https://bugzilla.redhat.com/show_bug.cgi?id=1202837 https://github.com/benoitc/restkit/issues/140 The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function, which allows remote attackers to cause a denial of service (application crash) via running the EnsureCredentials method from the org.gnome.OnlineAccounts.Account interface on an object representing a Flickr account. RHSA-2015:2237 [oss-security] 20150323 Re: CVE request: Invalid pointer dereference in the GNOME librest library https://bugzilla.gnome.org/show_bug.cgi?id=742644 https://bugzilla.redhat.com/show_bug.cgi?id=1183982 https://bugzilla.redhat.com/show_bug.cgi?id=1199049 https://git.gnome.org/browse/librest/commit/?id=b50ace7738ea03817acdad87fb2b338a86018329 Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via a request to start_apply.htm. http://packetstormsecurity.com/files/130724/ASUS-RT-G32-Cross-Site-Request-Forgery-Cross-Site-Scripting.html 20150307 Fw: Vulnerabilities in ASUS RT-G32 http://websecurity.com.ua/7644/ 73294 Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the (1) title or (2) text field in the cms_calendar page to cms/index.php; unspecified fields in (3) the cms_polls page to cms/index.php or (4) a new topic in the topics page to forum/index.php; or (5) a new PT (private topic/private message) in the topics page to forum/index.php. http://ocportal.com/site/news/view/new-releases/ocportal-9-0-17-released.htm http://ocportal.com/site/news/view/security_issues/xss-vulnerability-patch.htm http://packetstormsecurity.com/files/130729/ocPortal-9.0.16-Cross-Site-Scripting.html 20150308 ocPortal 9.0.16 Multiply XSS Vulnerabilities 1031962 Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter in the categories page to gxadmin/index.php or (2) page parameter to index.php. http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17 http://packetstormsecurity.com/files/130771/GeniXCMS-0.0.1-Cross-Site-Scripting.html 36321 73301 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5233.php https://github.com/semplon/GeniXCMS/commit/698245488343396185b1b49e7482ee5b25541815 https://github.com/semplon/GeniXCMS/issues/7 Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php or (2) username parameter to gxadmin/login.php. http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17 http://blog.metalgenix.com/update-security-fix-and-add-newsletter-module/16 http://packetstormsecurity.com/files/130770/GeniXCMS-0.0.1-SQL-Injection.html 36321 73297 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5232.php https://github.com/semplon/GeniXCMS/commit/698245488343396185b1b49e7482ee5b25541815 https://github.com/semplon/GeniXCMS/issues/7 Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gxadmin/index.php. http://blog.metalgenix.com/genixcms-v0-0-2-release-security-and-bug-fixes/17 http://blog.metalgenix.com/update-security-fix-and-add-newsletter-module/16 http://packetstormsecurity.com/files/130772/GeniXCMS-0.0.1-Cross-Site-Request-Forgery.html 36321 73299 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5234.php https://github.com/semplon/GeniXCMS/commit/698245488343396185b1b49e7482ee5b25541815 https://github.com/semplon/GeniXCMS/issues/7 Multiple cross-site scripting (XSS) vulnerabilities in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) next_page, (2) group_id, (3) action_script, or (4) flag parameter to start_apply.htm. http://packetstormsecurity.com/files/130724/ASUS-RT-G32-Cross-Site-Request-Forgery-Cross-Site-Scripting.html 20150307 Fw: Vulnerabilities in ASUS RT-G32 http://websecurity.com.ua/7644/ 73296 Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml. http://packetstormsecurity.com/files/130928/Citrix-Command-Center-Configuration-Disclosure.html 20150319 Citrix Command Center allows downloading of configuration files http://support.citrix.com/article/CTX200584 73309 1031993 36441 https://www.securify.nl/advisory/SFY20140802/citrix_command_center_allows_downloading_of_configuration_files.html Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 does not properly restrict access to the Advent Java Management Extensions (JMX) Servlet, which allows remote attackers to execute arbitrary code via unspecified vectors to servlets/Jmx_dynamic. http://packetstormsecurity.com/files/130930/Citrx-Command-Center-Advent-JMX-Servlet-Accessible.html 20150319 Advent JMX Servlet of Citrx Command Center is accessible to unauthenticated users http://support.citrix.com/article/CTX200584 20150319 Advent JMX Servlet of Citrx Command Center is accessible to unauthenticated users 73313 1031993 https://www.securify.nl/advisory/SFY20140804/advent_jmx_servlet_of_citrx_command_center_is_accessible_to_unauthenticated_users.html Shibboleth Service Provider (SP) before 2.5.4 allows remote authenticated users to cause a denial of service (crash) via a crafted SAML message. DSA-3207 73314 https://shibboleth.net/community/advisories/secadv_20150319.txt net/socket.c in the Linux kernel 3.19 before 3.19.3 does not validate certain range data for (1) sendto and (2) recvfrom system calls, which allows local users to gain privileges by leveraging a subsystem that uses the copy_from_iter function in the iov_iter interface, as demonstrated by the Bluetooth subsystem. http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4de930efc23b92ddf88ce91c405ee645fe6e27ea http://grsecurity.net/~spender/viro.txt http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.3 [oss-security] 20150323 CVE Request: Linux kernel: sys_sendto/sys_recvfrom does not validate the user provided ubuf pointer 73286 https://bugzilla.redhat.com/show_bug.cgi?id=1205242 https://github.com/torvalds/linux/commit/4de930efc23b92ddf88ce91c405ee645fe6e27ea OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for. [oss-security] 20150324 Re: CVE request for OpenStack Compute (nova) [oss-security] 20150325 Re: CVE request for OpenStack Compute (nova) 77505 https://bugs.launchpad.net/nova/+bug/1419577 https://bugzilla.redhat.com/show_bug.cgi?id=1205313 https://review.openstack.org/#/c/338929/ Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the (1) add_license_key, (2) add_license_first_name, (3) add_license_last_name, (4) add_license_company, (5) add_license_address1, (6) add_license_address2, (7) add_license_city, (8) add_license_state, (9) add_license_post_code, (10) add_license_country, (11) add_license_phone, or (12) add_license_email parameter in an add-license-form page to admin/config.php. http://git.freepbx.org/projects/FREEPBX/repos/digiumaddoninstaller/commits/2aad006024b74c9ff53943d3e68527a3dffac855 http://packetstormsecurity.com/files/131591/FreePBX-12.0.43-Cross-Site-Scripting.html 20150422 Multiple Cross-Site Scripting (XSS) in FreePBX 74279 https://www.htbridge.com/advisory/HTB23253 AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters. https://github.com/kzar/watchadblock/commit/5b77de6ea77e0eff2aa726d9722d64fb4964b985 https://www.greinr.com/blog/2015/cve-2015-2692-adblock-filter-injection/ The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthentication requirement by providing (1) zero bytes of data or (2) an arbitrary realm name, related to plugins/preauth/otp/main.c and plugins/preauth/pkinit/pkinit_srv.c. http://krbdev.mit.edu/rt/Ticket/Display.html?id=8160 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 74824 USN-2810-1 https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604 lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call. http://krbdev.mit.edu/rt/Ticket/Display.html?id=8244 SUSE-SU-2015:1897 SUSE-SU-2015:1898 openSUSE-SU-2015:1928 openSUSE-SU-2015:1997 DSA-3395 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 90687 1034084 USN-2810-1 https://github.com/krb5/krb5/commit/b51b33f2bc5d1497ddf5bd107f791c101695000d GLSA-201611-14 lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call. http://krbdev.mit.edu/rt/Ticket/Display.html?id=8244 SUSE-SU-2015:1897 openSUSE-SU-2015:1928 openSUSE-SU-2015:1997 DSA-3395 90675 1034084 USN-2810-1 https://github.com/krb5/krb5/commit/e04f0283516e80d2f93366e0d479d13c9b5c8c2a GLSA-201611-14 The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request. http://krbdev.mit.edu/rt/Ticket/Display.html?id=8252 SUSE-SU-2015:1897 openSUSE-SU-2015:1928 openSUSE-SU-2015:1997 DSA-3395 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 77581 1034084 USN-2810-1 https://github.com/krb5/krb5/commit/f0c094a1b745d91ef2f9a4eae2149aac026a5789 GLSA-201611-14 The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss_export_sec_context function. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-2696. http://krbdev.mit.edu/rt/Ticket/Display.html?id=8273 openSUSE-SU-2015:2055 openSUSE-SU-2015:2376 USN-2810-1 https://github.com/krb5/krb5/commit/3db8dfec1ef50ddd78d6ba9503185995876a39fd Cross-site request forgery (CSRF) vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/. 36358 72658 Cross-site scripting (XSS) vulnerability in the Message Log in the Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attackers to inject arbitrary web script or HTML via the sender address in an email. http://packetstormsecurity.com/files/130898/Websense-Email-Security-Cross-Site-Scripting.html 20150318 Websense Email Security vulnerable to persistent Cross-Site Scripting in audit log details view 20150318 Websense Email Security vulnerable to persistent Cross-Site Scripting in audit log details view 73345 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 https://www.securify.nl/advisory/SFY20140905/websense_email_security_vulnerable_to_persistent_cross_site_scripting_in_audit_log_details_view.html Multiple cross-site scripting (XSS) vulnerabilities in Websense TRITON AP-WEB before 8.0.0 and V-Series 7.7 appliances allow remote attackers to inject arbitrary web script or HTML via the (1) ws-userip in the ws-encdata parameter to cve-bin/moreBlockInfo.cgi in the Data Security block page or (2) admin_msg parameter to configure/ssl_ui/eva-config/client-cert-import_wsoem.html in the Content Gateway, which is not properly handled in an error message. http://packetstormsecurity.com/files/130902/Websense-Data-Security-Cross-Site-Scripting.html http://packetstormsecurity.com/files/130908/Websense-Content-Gateway-Error-Message-Cross-Site-Scripting.html 20150318 Error messages of Websense Content Gateway are vulnerable to Cross-Site Scripting 20150318 Cross-Site Scripting vulnerability in Websense Data Security block page 20150318 Cross-Site Scripting vulnerability in Websense Data Security block page 20150318 Error messages of Websense Content Gateway are vulnerable to Cross-Site Scripting http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 https://www.securify.nl/advisory/SFY20140910/cross_site_scripting_vulnerability_in_websense_data_security_block_page.html https://www.securify.nl/advisory/SFY20140916/error_messages_of_websense_content_gateway_are_vulnerable_to_cross_site_scripting.html realmd allows remote attackers to inject arbitrary configurations in to sssd.conf and smb.conf via a newline character in an LDAP response. FEDORA-2015-6124 FEDORA-2015-6387 http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html 73352 https://bugs.freedesktop.org/show_bug.cgi?id=89207 Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted plugin that does not properly complete initialization. openSUSE-SU-2015:0761 openSUSE-SU-2015:0763 http://www.mozilla.org/security/announce/2015/mfsa2015-45.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74247 1032171 USN-2571-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1141081 GLSA-201512-10 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. openSUSE-SU-2015:0892 SUSE-SU-2015:0960 SUSE-SU-2015:0978 openSUSE-SU-2015:1266 openSUSE-SU-2015:0934 RHSA-2015:0988 RHSA-2015:1012 DSA-3260 DSA-3264 http://www.mozilla.org/security/announce/2015/mfsa2015-46.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74615 USN-2602-1 USN-2603-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1120655 https://bugzilla.mozilla.org/show_bug.cgi?id=1143299 https://bugzilla.mozilla.org/show_bug.cgi?id=1151139 https://bugzilla.mozilla.org/show_bug.cgi?id=1152177 GLSA-201605-06 https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. SUSE-SU-2015:0960 SUSE-SU-2015:0978 openSUSE-SU-2015:0934 RHSA-2015:1012 http://www.mozilla.org/security/announce/2015/mfsa2015-46.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74615 USN-2602-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1111251 https://bugzilla.mozilla.org/show_bug.cgi?id=1117977 https://bugzilla.mozilla.org/show_bug.cgi?id=1128064 https://bugzilla.mozilla.org/show_bug.cgi?id=1135066 https://bugzilla.mozilla.org/show_bug.cgi?id=1143194 https://bugzilla.mozilla.org/show_bug.cgi?id=1146101 https://bugzilla.mozilla.org/show_bug.cgi?id=1149526 https://bugzilla.mozilla.org/show_bug.cgi?id=1153688 https://bugzilla.mozilla.org/show_bug.cgi?id=1155474 GLSA-201605-06 https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7 Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS) token sequence. openSUSE-SU-2015:0892 SUSE-SU-2015:0960 SUSE-SU-2015:0978 openSUSE-SU-2015:1266 openSUSE-SU-2015:0934 RHSA-2015:0988 RHSA-2015:1012 DSA-3260 DSA-3264 http://www.mozilla.org/security/announce/2015/mfsa2015-48.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74611 USN-2602-1 USN-2603-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1149542 GLSA-201605-06 https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7 Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a URL, as demonstrated by a private path component. openSUSE-SU-2015:0934 http://www.mozilla.org/security/announce/2015/mfsa2015-49.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74611 USN-2602-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1113431 GLSA-201605-06 The asm.js implementation in Mozilla Firefox before 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped, which allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary code, or trigger out-of-bounds read operations and possibly obtain sensitive information from process memory, via crafted JavaScript. openSUSE-SU-2015:0934 http://www.mozilla.org/security/announce/2015/mfsa2015-50.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74611 USN-2602-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1152280 GLSA-201605-06 Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing crafted text in conjunction with a Cascading Style Sheets (CSS) token sequence containing properties related to vertical text. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:0892 SUSE-SU-2015:0960 SUSE-SU-2015:0978 openSUSE-SU-2015:1266 openSUSE-SU-2015:0934 RHSA-2015:0988 RHSA-2015:1012 DSA-3260 DSA-3264 http://www.mozilla.org/security/announce/2015/mfsa2015-51.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74611 USN-2602-1 USN-2603-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1153478 GLSA-201605-06 https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7 Mozilla Firefox before 38.0 on Android does not properly restrict writing URL data to the Android logging system, which allows attackers to obtain sensitive information via a crafted application that has a required permission for reading a log, as demonstrated by the READ_LOGS permission for the mixed-content violation log on Android 4.0 and earlier. http://www.mozilla.org/security/announce/2015/mfsa2015-52.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74611 https://bugzilla.mozilla.org/show_bug.cgi?id=1149094 GLSA-201605-06 Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown. openSUSE-SU-2015:0934 http://www.mozilla.org/security/announce/2015/mfsa2015-53.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74611 USN-2602-1 https://bugzilla.mozilla.org/show_bug.cgi?id=988698 GLSA-201605-06 Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283. openSUSE-SU-2015:0892 SUSE-SU-2015:0960 SUSE-SU-2015:0978 openSUSE-SU-2015:1266 openSUSE-SU-2015:0934 RHSA-2015:0988 RHSA-2015:1012 DSA-3260 DSA-3264 http://www.mozilla.org/security/announce/2015/mfsa2015-54.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74611 USN-2602-1 USN-2603-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1140537 https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c GLSA-201605-06 https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird31.7 https://www.tenable.com/security/tns-2016-20 Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and out-of-bounds read) via an MP4 video file containing invalid metadata. openSUSE-SU-2015:0934 http://www.mozilla.org/security/announce/2015/mfsa2015-55.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74611 USN-2602-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1154683 GLSA-201605-06 The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data. openSUSE-SU-2015:0934 http://www.mozilla.org/security/announce/2015/mfsa2015-56.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74611 USN-2602-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1146724 GLSA-201605-06 The update implementation in Mozilla Firefox before 38.0 on Windows does not ensure that the pathname for updater.exe corresponds to the application directory, which might allow local users to gain privileges via a Trojan horse file. http://www.mozilla.org/security/announce/2015/mfsa2015-58.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 74611 https://bugzilla.mozilla.org/show_bug.cgi?id=1127481 Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1185 RHSA-2015:1664 DSA-3324 DSA-3336 http://www.mozilla.org/security/announce/2015/mfsa2015-71.html http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html 75541 83398 91787 1032783 1032784 USN-2656-1 USN-2656-2 USN-2672-1 USN-2673-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1086145 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19_release_notes GLSA-201512-10 GLSA-201701-46 https://smacktls.com Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a shared worker. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 http://www.mozilla.org/security/announce/2015/mfsa2015-65.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 https://bugzilla.mozilla.org/show_bug.cgi?id=1166924 GLSA-201512-10 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-4000. Reason: This candidate is a duplicate of CVE-2015-4000. Notes: All CVE users should reference CVE-2015-4000 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 RHSA-2015:1455 DSA-3300 DSA-3324 http://www.mozilla.org/security/announce/2015/mfsa2015-59.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 USN-2673-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1143679 https://bugzilla.mozilla.org/show_bug.cgi?id=1154876 https://bugzilla.mozilla.org/show_bug.cgi?id=1160884 https://bugzilla.mozilla.org/show_bug.cgi?id=1164567 GLSA-201512-10 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. openSUSE-SU-2015:1229 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 RHSA-2015:1455 http://www.mozilla.org/security/announce/2015/mfsa2015-59.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 https://bugzilla.mozilla.org/show_bug.cgi?id=1056410 https://bugzilla.mozilla.org/show_bug.cgi?id=1151650 https://bugzilla.mozilla.org/show_bug.cgi?id=1156861 https://bugzilla.mozilla.org/show_bug.cgi?id=1159321 https://bugzilla.mozilla.org/show_bug.cgi?id=1159973 https://bugzilla.mozilla.org/show_bug.cgi?id=1163359 https://bugzilla.mozilla.org/show_bug.cgi?id=1163852 https://bugzilla.mozilla.org/show_bug.cgi?id=1172076 https://bugzilla.mozilla.org/show_bug.cgi?id=1172397 GLSA-201512-10 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. openSUSE-SU-2015:1229 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 http://www.mozilla.org/security/announce/2015/mfsa2015-59.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 https://bugzilla.mozilla.org/show_bug.cgi?id=1059081 https://bugzilla.mozilla.org/show_bug.cgi?id=1132265 https://bugzilla.mozilla.org/show_bug.cgi?id=1145781 https://bugzilla.mozilla.org/show_bug.cgi?id=1146416 https://bugzilla.mozilla.org/show_bug.cgi?id=1155985 GLSA-201512-10 Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions. NOTE: this vulnerability exists because of a CVE-2015-0821 regression. openSUSE-SU-2015:1229 RHSA-2015:1207 http://www.mozilla.org/security/announce/2015/mfsa2015-60.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html 75541 1032783 USN-2656-1 USN-2656-2 https://bugzilla.mozilla.org/show_bug.cgi?id=1163422 GLSA-201512-10 The IndexedDatabaseManager class in the IndexedDB implementation in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 misinterprets an unspecified IDBDatabase field as a pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors, related to a "type confusion" issue. <a href="http://cwe.mitre.org/data/definitions/843.html">CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')</a> openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 DSA-3300 http://www.mozilla.org/security/announce/2015/mfsa2015-61.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 USN-2656-1 USN-2656-2 https://bugzilla.mozilla.org/show_bug.cgi?id=1142210 GLSA-201512-10 The AudioParamTimeline::AudioNodeInputValue function in the Web Audio implementation in Mozilla Firefox before 39.0 and Firefox ESR 38.x before 38.1 does not properly calculate an oscillator rendering range, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors. openSUSE-SU-2015:1229 RHSA-2015:1207 http://www.mozilla.org/security/announce/2015/mfsa2015-62.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 USN-2656-1 USN-2656-2 https://bugzilla.mozilla.org/show_bug.cgi?id=1122218 GLSA-201512-10 Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1664 RHSA-2015:1699 DSA-3336 http://www.mozilla.org/security/announce/2015/mfsa2015-64.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html 75541 83399 1032783 USN-2656-1 USN-2656-2 USN-2672-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1125025 https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.19.1_release_notes GLSA-201512-10 Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:1229 RHSA-2015:1207 RHSA-2015:1455 DSA-3300 http://www.mozilla.org/security/announce/2015/mfsa2015-63.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 https://bugzilla.mozilla.org/show_bug.cgi?id=1149891 GLSA-201512-10 Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 allows remote attackers to execute arbitrary code via vectors involving attachment of an XMLHttpRequest object to a dedicated worker. <a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a> openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 http://www.mozilla.org/security/announce/2015/mfsa2015-65.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 https://bugzilla.mozilla.org/show_bug.cgi?id=1169867 GLSA-201512-10 The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 RHSA-2015:1455 DSA-3300 DSA-3324 http://www.mozilla.org/security/announce/2015/mfsa2015-66.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 USN-2673-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1166082 GLSA-201512-10 nsZipArchive.cpp in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 RHSA-2015:1455 DSA-3300 DSA-3324 http://www.mozilla.org/security/announce/2015/mfsa2015-66.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 USN-2673-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1166900 GLSA-201512-10 The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which allows remote attackers to have an unspecified impact via a crafted ZIP archive. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 RHSA-2015:1455 DSA-3300 DSA-3324 http://www.mozilla.org/security/announce/2015/mfsa2015-66.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 USN-2673-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1167888 GLSA-201512-10 The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 RHSA-2015:1455 DSA-3300 DSA-3324 http://www.mozilla.org/security/announce/2015/mfsa2015-66.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 USN-2673-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1167332 GLSA-201512-10 The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 RHSA-2015:1455 DSA-3300 DSA-3324 http://www.mozilla.org/security/announce/2015/mfsa2015-66.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 USN-2673-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1167356 GLSA-201512-10 The ArrayBufferBuilder::append function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which has unspecified impact and attack vectors. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 RHSA-2015:1455 DSA-3300 DSA-3324 http://www.mozilla.org/security/announce/2015/mfsa2015-66.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 USN-2673-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1168207 GLSA-201512-10 Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 RHSA-2015:1455 DSA-3300 DSA-3324 http://www.mozilla.org/security/announce/2015/mfsa2015-66.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 USN-2673-1 https://bugzilla.mozilla.org/show_bug.cgi?id=1170809 GLSA-201512-10 Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled. openSUSE-SU-2015:1229 RHSA-2015:1207 RHSA-2015:1455 http://www.mozilla.org/security/announce/2015/mfsa2015-67.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 1032784 USN-2656-1 USN-2656-2 https://bugzilla.mozilla.org/show_bug.cgi?id=1147497 GLSA-201512-10 Mozilla Firefox before 39.0 on OS X includes native key press information during the logging of crashes, which allows remote attackers to obtain sensitive information by leveraging access to a crash-reporting data stream. http://www.mozilla.org/security/announce/2015/mfsa2015-68.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 https://bugzilla.mozilla.org/show_bug.cgi?id=1138669 GLSA-201512-10 PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass. openSUSE-SU-2015:1229 openSUSE-SU-2015:1266 SUSE-SU-2015:1268 SUSE-SU-2015:1269 SUSE-SU-2015:1449 RHSA-2015:1207 DSA-3300 http://www.mozilla.org/security/announce/2015/mfsa2015-69.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html 75541 1032783 USN-2656-1 USN-2656-2 https://bugzilla.mozilla.org/show_bug.cgi?id=1163109 GLSA-201512-10 Cross-site scripting (XSS) vulnerability in the Search app in Gaia in Mozilla Firefox OS before 2.2 allows remote attackers to inject arbitrary HTML via a crafted search link that is mishandled after re-opening the browser or opening the tab view. http://www.mozilla.org/security/announce/2015/mfsa2015-72.html https://bugzilla.mozilla.org/show_bug.cgi?id=1102204 Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or (2) title field in card content associated with a search link that is mishandled after a HOME button press or a Show Windows action, as demonstrated by embedding an arbitrary application or spoofing the account-creation page. http://www.mozilla.org/security/announce/2015/mfsa2015-73.html https://bugzilla.mozilla.org/show_bug.cgi?id=1101158 https://github.com/mozilla-b2g/gaia/commit/0f72a8c31df9f3d8f609a7c58ca91139051d44eb The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON 7.8.3 and V-Series appliances before 7.8.4 Hotfix 02 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the "second" parameter of a command, as demonstrated by the Destination parameter in the ping command. http://packetstormsecurity.com/files/130899/Websense-Appliance-Manager-Command-Injection.html 20150318 Command injection vulnerability in network diagnostics tool of Websense Appliance Manager 20150318 Command injection vulnerability in network diagnostics tool of Websense Appliance Manager http://www.websense.com/support/article/kbarticle/October-2014-Hotfix-Summary-for-Websense-Solutions 36423 https://www.securify.nl/advisory/SFY20140906/command_injection_vulnerability_in_network_diagnostics_tool_of_websense_appliance_manager.html Multiple cross-site scripting (XSS) vulnerabilities in the data loss prevention (DLP) incident Forensics Preview in Websense Triton 7.8.3 and V-Series 7.7 appliances allow remote attackers to inject arbitrary web script or HTML via a crafted (1) email or (2) HTTP request, which triggers a DLP Policy. http://packetstormsecurity.com/files/130897/Websense-Data-Security-DLP-Incident-Forensics-Preview-XSS.html 20150318 Websense Data Security DLP incident Forensics Preview is vulnerable to Cross-Site Scripting 20150318 Websense Data Security DLP incident Forensics Preview is vulnerable to Cross-Site Scripting https://www.securify.nl/advisory/SFY20140904/websense_data_security_dlp_incident_forensics_preview_is_vulnerable_to_cross_site_scripting.html Websense TRITON AP-WEB before 8.0.0 does not properly restrict access to files in explorer_wse/, which allows remote attackers to obtain sensitive information via a direct request to a (1) Web Security incident report or the (2) Explorer configuration (websense.ini) file. http://packetstormsecurity.com/files/130901/Websense-Explorer-Missing-Access-Control.html 20150318 Missing access control on Websense Explorer web folder 20150318 Missing access control on Websense Explorer web folder http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 https://www.securify.nl/advisory/SFY20140909/missing_access_control_on_websense_explorer_web_folder.html Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter. http://cgit.drupalcode.org/drupal/commit/?id=d2304f840c43c190c6e136ee9901ed9797b4c3ca DSA-3200 [oss-security] 20150326 Re: CVE requests for Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 73219 https://bugzilla.redhat.com/show_bug.cgi?id=1204753 https://www.drupal.org/SA-CORE-2015-001 Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence. http://cgit.drupalcode.org/drupal/commit/includes/common.inc?h=7.x&id=b44056d2f8e8c71d35c85ec5c2fb8f7c8a02d8a8 http://cgit.drupalcode.org/drupal/commit/includes/menu.inc?h=6.x&id=8ffc5db3c0ab926f3d4b2cf8bc51714c8c0f3c93 DSA-3200 [oss-security] 20150326 Re: CVE requests for Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001 73219 https://www.drupal.org/SA-CORE-2015-001 Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations. FEDORA-2015-5208 FEDORA-2015-5402 FEDORA-2015-5295 SUSE-SU-2015:0923 73443 1031997 http://xenbits.xen.org/xsa/advisory-127.html GLSA-201504-04 The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm). FEDORA-2015-5208 FEDORA-2015-5402 FEDORA-2015-5295 openSUSE-SU-2015:0732 SUSE-SU-2015:0923 73448 1031994 http://xenbits.xen.org/xsa/advisory-125.html GLSA-201504-04 FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) or possibly execute arbitrary code via a crafted sector in a workbook. DSA-3208 [oss-security] 20150324 CVE Request: Multiple vulnerabilities in freexl 1.0.0g [oss-security] 20150327 Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g 73330 GLSA-201606-15 https://www.gaia-gis.it/fossil/freexl/fdiff?v1=2e167b337481dda3&v2=61618ce51a9b0c15&sbs=1 FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF." DSA-3208 [oss-security] 20150324 CVE Request: Multiple vulnerabilities in freexl 1.0.0g [oss-security] 20150327 Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g 73330 GLSA-201606-15 https://www.gaia-gis.it/fossil/freexl/fdiff?v1=2e167b337481dda3&v2=61618ce51a9b0c15&sbs=1 Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) lat (Latitude), (2) long (Longitude), (3) map_width, (4) map_height, or (5) zoom (Map Zoom) parameter in the ab_map_options page to wp-admin/admin.php. http://packetstormsecurity.com/files/130960/WordPress-AB-Google-Map-Travel-CSRF-XSS.html http://packetstormsecurity.com/files/131155/WordPress-Google-Map-Travel-3.4-XSS-CSRF.html 20150321 CSRF/Stored XSS Vulnerability in AB Google Map Travel (AB-MAP) Wordpress Plugin 20150327 CVE-2015-2755 WordPress AB Google Map Travel CSRF / XSS 71417 https://wordpress.org/plugins/ab-google-map-travel/changelog/ QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response. FEDORA-2015-5208 FEDORA-2015-5402 FEDORA-2015-5295 [Qemu-devel] 20150331 [PATCH][XSA-126] xen: limit guest control of PCI command register openSUSE-SU-2015:0732 http://support.citrix.com/article/CTX201145 DSA-3259 72577 1031998 USN-2608-1 http://xenbits.xen.org/xsa/advisory-126.html GLSA-201504-04 https://support.citrix.com/article/CTX206006 The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to cause a denial of service (database lock or license corruption) via unspecified vectors. 73399 https://kc.mcafee.com/corporate/index?page=content&id=SB10111 The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to obtain sensitive information, modify the database, or possibly have other unspecified impact via a crafted URL. 73397 https://kc.mcafee.com/corporate/index?page=content&id=SB10111 Multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allow remote attackers to hijack the authentication of users for requests that (1) obtain sensitive information or (2) modify the database via unspecified vectors. 73403 https://kc.mcafee.com/corporate/index?page=content&id=SB10111 Cross-site scripting (XSS) vulnerability in the ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. 73193 https://kc.mcafee.com/corporate/index?page=content&id=SB10111 Cross-site scripting (XSS) vulnerability in the Exceptions and Scanning Exceptions Pages in Websense TRITON AP-WEB before 8.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 73414 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 Websense TRITON AP-WEB before 8.0.0 allows remote attackers to enumerate Windows domain user accounts via vectors related to HTTP authentication. 73412 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to port 17703. 73415 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 Multiple cross-site scripting (XSS) vulnerabilities in Websense TRITON AP-DATA before 8.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to the DSS (1) Mobile or (2) DLP report catalog. 73424 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 The Email Security Gateway in Websense TRITON AP-EMAIL before 8.0.0 allows remote attackers to conduct clickjacking attacks via unspecified vectors. 73427 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 The Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allows attackers to have unspecified impact via a brute force attack. 73426 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to "Autocomplete Enabled." 73418 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 Cross-site scripting (XSS) vulnerability in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 73429 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 Multiple cross-site request forgery (CSRF) vulnerabilities in the Personal Email Manager (PEM) in Websense TRITON AP-EMAIL before 8.0.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 Cross-site request forgery (CSRF) vulnerability in the command line page in Websense TRITON V-Series appliances before 8.0.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 The Mail Server in Websense TRITON AP-EMAIL and V-Series appliances before 8.0.0 uses plaintext credentials, which allows remote attackers to obtain sensitive information via unspecified vectors. 73428 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers to upload arbitrary files via unspecified vectors. 73439 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 SVM in Websense TRITON V-Series appliances before 8.0.0 allows attackers to read arbitrary files via unspecified vectors. 73406 http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). openSUSE-SU-2016:0523 [oss-security] 20150327 CVE request: Erlang POODLE TLS vulnerability [oss-security] 20150327 Re: CVE request: Erlang POODLE TLS vulnerability http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html 73398 USN-3571-1 https://web.archive.org/web/20150905124006/http://www.erlang.org/news/85 https://www.imperialviolet.org/2014/12/08/poodleagain.html Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name. FEDORA-2015-5333 FEDORA-2015-5216 RHSA-2015:1153 RHSA-2015:1417 DSA-3214 73922 1032033 USN-2558-1 https://bugs.launchpad.net/mailman/+bug/1437145 [Mailman-Announce] 20150327 Mailman 2.1.20 release [Mailman-Developers] 20150327 Security patch and Mailman 2.1.20 to be released on 31 March [Mailman-Developers] 20150331 Security patch and Mailman 2.1.20 to be released on 31 March The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook. DSA-3208 [oss-security] 20150324 CVE Request: Multiple vulnerabilities in freexl 1.0.0g [oss-security] 20150327 Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g [oss-security] 20150327 Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g 73330 GLSA-201606-15 https://www.gaia-gis.it/fossil/freexl/fdiff?v1=2e167b337481dda3&v2=61618ce51a9b0c15&sbs=1 Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters. openSUSE-SU-2015:0687 [oss-security] 20150320 CVE request: denial of service in Quassel [oss-security] 20150327 Re: CVE request: denial of service in Quassel [oss-security] 20150328 Re: CVE request: denial of service in Quassel 73305 https://github.com/quassel/quassel/commit/b5e38970ffd55e2dd9f706ce75af9a8d7730b1b8 Stack consumption vulnerability in the message splitting functionality in Quassel before 0.12-rc1 allows remote attackers to cause a denial of service (uncontrolled recursion) via a crafted massage. FEDORA-2015-4689 FEDORA-2015-4531 openSUSE-SU-2015:0687 [oss-security] 20150320 CVE request: denial of service in Quassel [oss-security] 20150327 Re: CVE request: denial of service in Quassel [oss-security] 20150328 Re: CVE request: denial of service in Quassel 74048 https://github.com/quassel/quassel/commit/b5e38970ffd55e2dd9f706ce75af9a8d7730b1b8 Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in an unspecified directory. 20150326 Insecure file upload in Berta CMS [oss-security] 20150328 Re: Fwd: Insecure file upload in Berta CMS 36520 Cross-site scripting (XSS) vulnerability in cgi-bin/hotspotlogin.cgi in Hotspot Express hotEx Billing Manager 73 allows remote attackers to inject arbitrary web script or HTML via the reply parameter. http://packetstormsecurity.com/files/131297/HotExBilling-Manager-73-Cross-Site-Scripting.html 20150408 HotExBilling Manager - Cross-site scriptin g (XSS) vulnerability 20150405 HotExBilling Manager Cross-site scripting (XSS) vulnerability 73941 Buffer overflow in Open-source ARJ archiver 3.10.22 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ARJ archive. FEDORA-2015-5603 FEDORA-2015-5546 FEDORA-2015-5524 DSA-3213 MDVSA-2015:201 [oss-security] 20150328 CVE Request: arj: free on invalid pointer due to to buffer overflow [oss-security] 20150329 Re: CVE Request: arj: free on invalid pointer due to to buffer overflow 73413 GLSA-201612-15 ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions. APPLE-SA-2015-08-13-2 APPLE-SA-2015-09-30-3 openSUSE-SU-2015:0855 SUSE-SU-2015:0868 SSRT102066 http://php.net/ChangeLog-5.php RHSA-2015:1066 RHSA-2015:1135 RHSA-2015:1186 RHSA-2015:1187 RHSA-2015:1218 DSA-3280 http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html 74239 1032146 USN-2572-1 https://bugs.php.net/bug.php?id=69324 GLSA-201606-10 https://support.apple.com/HT205267 https://support.apple.com/kb/HT205031