November 2015 - Arch-security - lists.archlinux.org

[arch-security] [ASA-201511-11] jenkins: multiple issues
by Levente Polyak 18 Nov '15

18 Nov '15

Arch Linux Security Advisory ASA-201511-11 ========================================== Severity: Critical Date : 2015-11-18 CVE-ID : CVE-2015-5317 CVE-2015-5318 CVE-2015-5319 CVE-2015-5320 CVE-2015-5321 CVE-2015-5322 CVE-2015-5323 CVE-2015-5324 CVE-2015-5325 CVE-2015-5326 CVE-2015-8103 Package : jenkins Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package jenkins before version 1.638-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, information leakage, cross-side request forgery, XML external entity injection, access restriction bypass, cross-side scripting and directory traversal. Resolution ========== Upgrade to 1.638-1. # pacman -Syu "jenkins>=1.638-1" The problems have been fixed upstream in version 1.638. Workaround ========== None. Description =========== - CVE-2015-5317 (information leakage) The Jenkins UI allowed users to see the names of jobs and builds otherwise inaccessible to them on the "Fingerprints" pages if those shared file fingerprints with fingerprinted files in accessible jobs. - CVE-2015-5318 (cross-side request forgery) The salt used to generate the CSRF protection tokens was a publicly accessible value, allowing malicious users to circumvent CSRF protection by generating the correct token. - CVE-2015-5319 (XML external entity injection) When creating a job using the create-job CLI command, external entities are not discarded (nor processed). If these job configurations are processed by another user with an XML-aware tool (e.g. using get-job/update-job), information from that user's computer may be disclosed to Jenkins and the attacker. - CVE-2015-5320 (access restriction bypass) JNLP slave connections did not verify that the correct secret was supplied, which allowed malicious users to connect their own machines as slaves to Jenkins knowing only the name of the slave. This enables attackers to take over Jenkins (unless the slave-to-master security subsystem is enabled) or gain access to private data like keys and source code. - CVE-2015-5321 (information leakage) The CLI command overview and help pages in Jenkins were accessible without Overall/Read permission, resulting in disclosure of the names of configured slaves (and contents of other sidepanel widgets, if present) to unauthorized users. - CVE-2015-5322 (directory traversal) Access to the /jnlpJars/ URL was not limited to the specific JAR files users needed to access, allowing browsing directories and downloading other files in the Jenkins servlet resources, such as web.xml. - CVE-2015-5323 (access restriction bypass) API tokens of other users were exposed to admins by default. On instances that don't implicitly grant RunScripts permission to admins, this allowed admins to run scripts with another user's credentials. - CVE-2015-5324 (information leakage) The /queue/api URL could return information about items not accessible to the current user (such as parameter names and values, build names, project descriptions). - CVE-2015-5325 (access restriction bypass) Slaves connecting via JNLP were not subject to the optional slave-to-master access control documented at http://jenkins-ci.org/security-144 (CVE-2014-3665). - CVE-2015-5326 (cross-side scripting) Users with the permission to take slave nodes offline can enter arbitrary HTML that gets shown unescaped to users visiting the slave overview page. - CVE-2015-8103 (arbitrary code execution) Unsafe deserialization allows unauthenticated remote attackers to run arbitrary code on the Jenkins master. Impact ====== A remote attacker is able to execution arbitrary code, disclose sensitive information, bypass the cross-side request forgery protection, perform XML external entity injection, bypass multiple access restrictions, perform a cross-side scripting attack and make use of a directory traversal issue to download arbitrary files. References ========== https://access.redhat.com/security/cve/CVE-2015-5317 https://access.redhat.com/security/cve/CVE-2015-5318 https://access.redhat.com/security/cve/CVE-2015-5319 https://access.redhat.com/security/cve/CVE-2015-5320 https://access.redhat.com/security/cve/CVE-2015-5321 https://access.redhat.com/security/cve/CVE-2015-5322 https://access.redhat.com/security/cve/CVE-2015-5323 https://access.redhat.com/security/cve/CVE-2015-5324 https://access.redhat.com/security/cve/CVE-2015-5325 https://access.redhat.com/security/cve/CVE-2015-5326 https://access.redhat.com/security/cve/CVE-2015-8103 https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015…

1 0

[arch-security] [ASA-201511-10] lib32-libpng: multiple issues
by Levente Polyak 17 Nov '15

17 Nov '15

Arch Linux Security Advisory ASA-201511-10 ========================================== Severity: High Date : 2015-11-17 CVE-ID : CVE-2015-7981 CVE-2015-8126 Package : lib32-libpng Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package lib32-libpng before version 1.6.19-1 is vulnerable to denial-of-service and arbitrary code execution. Resolution ========== Upgrade to 1.6.19-1. # pacman -Syu "lib32-libpng>=1.6.19-1" The problems have been fixed upstream in version 1.6.19. Workaround ========== None. Description =========== - CVE-2015-7981 (out-of-bounds read) This is an array indexing error, which can lead to an out-of-bounds read of a static buffer. The result is now unsigned (no longer negative, but now a huge positive number). - CVE-2015-8126 (arbitrary code execution) Buffer overflow vulnerabilities in functions png_get_PLTE/png_set_PLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bit_depth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8. Impact ====== A remote attacker is able to create specially crafted png files that, when opened or processed, may lead to denial-of-service or possibly arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2015-7981 https://access.redhat.com/security/cve/CVE-2015-8126 http://seclists.org/oss-sec/2015/q4/161 http://seclists.org/oss-sec/2015/q4/264 https://bugs.archlinux.org/task/47069

1 0

[arch-security] [ASA-201511-9] libpng: multiple issues
by Levente Polyak 17 Nov '15

17 Nov '15

Arch Linux Security Advisory ASA-201511-9 ========================================= Severity: High Date : 2015-11-17 CVE-ID : CVE-2015-7981 CVE-2015-8126 Package : libpng Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libpng before version 1.6.19-1 is vulnerable to denial-of-service and arbitrary code execution. Resolution ========== Upgrade to 1.6.19-1. # pacman -Syu "libpng>=1.6.19-1" The problems have been fixed upstream in version 1.6.19. Workaround ========== None. Description =========== - CVE-2015-7981 (out-of-bounds read) This is an array indexing error, which can lead to an out-of-bounds read of a static buffer. The result is now unsigned (no longer negative, but now a huge positive number). - CVE-2015-8126 (arbitrary code execution) Buffer overflow vulnerabilities in functions png_get_PLTE/png_set_PLTE, allowing remote attackers to cause DoS to application or have unspecified other impact. These functions failed to check for an out-of-range palette when reading or writing PNG files with a bit_depth less than 8. Some applications might read the bit depth from the IHDR chunk and allocate memory for a 2^N entry palette, while libpng can return a palette with up to 256 entries even when the bit depth is less than 8. Impact ====== A remote attacker is able to create specially crafted png files that, when opened or processed, may lead to denial-of-service or possibly arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2015-7981 https://access.redhat.com/security/cve/CVE-2015-8126 http://seclists.org/oss-sec/2015/q4/161 http://seclists.org/oss-sec/2015/q4/264 https://bugs.archlinux.org/task/47069

1 0

[arch-security] [ASA-201511-8] chromium: information leakage
by Levente Polyak 13 Nov '15

13 Nov '15

Arch Linux Security Advisory ASA-201511-8 ========================================= Severity: Medium Date : 2015-11-13 CVE-ID : CVE-2015-1302 Package : chromium Type : information leakage Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 46.0.2490.86-1 is vulnerable to information leakage and cross-origin restriction bypass. Resolution ========== Upgrade to 46.0.2490.86-1. # pacman -Syu "chromium>=46.0.2490.86-1" The problem has been fixed upstream in version 46.0.2490.86. Workaround ========== None. Description =========== The PDF viewer does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc. Impact ====== A remote attacker is able to bypass the cross-origin restriction via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc allowing unauthorized disclosure of information. References ========== https://access.redhat.com/security/cve/CVE-2015-1302 http://googlechromereleases.blogspot.fr/2015/11/stable-channel-update.html https://codereview.chromium.org/1316803003

1 0

[arch-security] [ASA-201511-7] putty: arbitrary code execution
by Levente Polyak 12 Nov '15

12 Nov '15

Arch Linux Security Advisory ASA-201511-7 ========================================= Severity: Medium Date : 2015-11-12 CVE-ID : CVE-2015-5309 Package : putty Type : arbitrary code execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package putty before version 0.66-1 is vulnerable to an integer overflow that results in denial of service or, under certain circumstances, could potentially lead to arbitrary code execution. Resolution ========== Upgrade to 0.66-1. # pacman -Syu "putty>=0.66-1" The problem has been fixed upstream in version 0.66. Workaround ========== None. Description =========== A potential memory-corrupting integer overflow has been discovered in the handling of the ECH (erase characters) control sequence in the terminal emulator. To exploit a vulnerability in the terminal emulator, an attacker must be able to insert a carefully crafted escape sequence into the terminal stream. For a PuTTY SSH session, this must be before encryption, so the attacker likely needs access to the server you're connecting to. For instance, an attacker on a multi-user machine that you connect to could trick you into running cat on a file they control containing a malicious escape sequence. (Unix write(1) is not a vector for this, if implemented correctly.) The purpose of ECH is to erase multiple characters within a single line. To this end, it includes a numeric parameter to specify the number of characters to be erased. PuTTY accumulates this one digit at a time in an integer variable. As part of the processing of ECH, the check_boundary function checks whether the start or end of the erased range falls in the middle of a double-width character (such as a kanji ideograph) so that it can ensure that the whole character is erased. Each character cell in the live terminal is held as a structure containing among other things the character code and a word of attributes. A double-width character is recorded by having a special value called UCSWIDE as the character code in the second cell, and when check_boundary detects that value, it resets the character code of both cells to a fixed value and copies the attributes from the left one to the right one. The vulnerability arises because PuTTY uses signed integer variables to hold the number of characters to be erased and doesn't adequately check for overflow. This means that by passing a very large parameter to ECH, an attacker could cause check_boundary to inspect memory outside the terminal buffer. Were it to find UCSWIDE there, it would corrupt some nearby memory. This might be exploitable if the attacker could arrange for UCSWIDE to be in memory somewhere near a sensitive data structure. Impact ====== An attacker is able to prepare a specially crafted file and trick the victim on the same local machine to output the malicious escape sequence (for example via cat) to trigger an integer overflow that is resulting in memory corruption ultimately leading to either denial of service or, under certain circumstances, potentially arbitrary code execution. References ========== https://access.redhat.com/security/cve/CVE-2015-5309 http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-ech-overflo…

1 0

[arch-security] [ASA-201511-6] powerdns: denial of service
by Levente Polyak 12 Nov '15

12 Nov '15

Arch Linux Security Advisory ASA-201511-6 ========================================= Severity: Medium Date : 2015-11-12 CVE-ID : CVE-2015-5311 Package : powerdns Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package powerdns before version 3.4.7-1 is vulnerable to denial of service. Resolution ========== Upgrade to 3.4.7-1. # pacman -Syu "powerdns>=3.4.7-1" The problems have been fixed upstream in version 3.4.7. Workaround ========== When the PowerDNS Authoritative Server is run inside the guardian (--guardian), or inside a supervisor like supervisord or systemd, it will be automatically restarted, limiting the impact to a somewhat degraded service. Description =========== This bug was found using afl-fuzz in the packet parsing code. This bug, when exploited, causes an assertion error and consequent termination of the the pdns_server process, causing a denial-of-service. Impact ====== A remote attacker is able to send specially crafted query packets to crash the powerdns server process, causing a denial-of-service. References ========== https://access.redhat.com/security/cve/CVE-2015-5311 https://doc.powerdns.com/md/security/powerdns-advisory-2015-03/ https://bugs.archlinux.org/task/47014

1 0

[arch-security] [ASA-201511-5] flashplugin: multiple issues
by Levente Polyak 11 Nov '15

11 Nov '15

Arch Linux Security Advisory ASA-201511-5 ========================================= Severity: Critical Date : 2015-11-11 CVE-ID : CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7659 CVE-2015-7660 CVE-2015-7661 CVE-2015-7662 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package flashplugin before version 11.2.202.548-1 is vulnerable to multiple issues including but not limited to arbitrary code execution and access restriction bypass. Resolution ========== Upgrade to 11.2.202.548-1. # pacman -Syu "flashplugin>=11.2.202.548-1" The problems have been fixed upstream in version 11.2.202.548. Workaround ========== None. Description =========== - CVE-2015-7651 CVE-2015-7652 CVE-2015-7653 CVE-2015-7654 CVE-2015-7655 CVE-2015-7656 CVE-2015-7657 CVE-2015-7658 CVE-2015-7660 CVE-2015-7661 CVE-2015-7663 CVE-2015-8042 CVE-2015-8043 CVE-2015-8044 CVE-2015-8046 (arbitrary code execution) It has been discovered that multiple use-after-free vulnerabilities could lead to arbitrary code execution. - CVE-2015-7659 (arbitrary code execution) A type confusion vulnerability has been discovered that could lead to arbitrary code execution. - CVE-2015-7662 (access restriction bypass) A security bypass vulnerability has been discovered that could be exploited to write arbitrary data to the file system under user permissions. Impact ====== A remote attacker is able to craft a special flash file that, when visited, executes arbitrary code via multiple vectors or writes arbitrary data to the file system. References ========== https://access.redhat.com/security/cve/CVE-2015-7651 https://access.redhat.com/security/cve/CVE-2015-7652 https://access.redhat.com/security/cve/CVE-2015-7653 https://access.redhat.com/security/cve/CVE-2015-7654 https://access.redhat.com/security/cve/CVE-2015-7655 https://access.redhat.com/security/cve/CVE-2015-7656 https://access.redhat.com/security/cve/CVE-2015-7657 https://access.redhat.com/security/cve/CVE-2015-7658 https://access.redhat.com/security/cve/CVE-2015-7659 https://access.redhat.com/security/cve/CVE-2015-7660 https://access.redhat.com/security/cve/CVE-2015-7661 https://access.redhat.com/security/cve/CVE-2015-7662 https://access.redhat.com/security/cve/CVE-2015-7663 https://access.redhat.com/security/cve/CVE-2015-8042 https://access.redhat.com/security/cve/CVE-2015-8043 https://access.redhat.com/security/cve/CVE-2015-8044 https://access.redhat.com/security/cve/CVE-2015-8046 https://helpx.adobe.com/security/products/flash-player/apsb15-28.html

1 0

[arch-security] [ASA-201511-4] nspr: arbitrary code execution
by Remi Gacogne 06 Nov '15

06 Nov '15

Arch Linux Security Advisory ASA-201511-4 ========================================= Severity: Critical Date : 2015-11-06 CVE-ID : CVE-2015-7183 Package : nspr Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nspr before version 4.10.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.10.10-1. # pacman -Syu "nspr>=4.10.10-1" The problem has been fixed upstream in version 4.10.10. Workaround ========== None. Description =========== A logic bug in the handling of large allocations would allow exceptionally large allocations to be reported as successful, without actually allocating the requested memory. This may allow attackers to bypass security checks and obtain control of arbitrary memory. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.org/msg12386.html https://access.redhat.com/security/cve/CVE-2015-7183

1 0

[arch-security] [ASA-201511-3] nss: arbitrary code execution
by Remi Gacogne 06 Nov '15

06 Nov '15

Arch Linux Security Advisory ASA-201511-3 ========================================= Severity: Critical Date : 2015-11-06 CVE-ID : CVE-2015-7181 CVE-2015-7182 Package : nss Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package nss before version 3.20.1-1 is vulnerable to a heap-overflow vulnerability leading to arbitrary code execution. Resolution ========== Upgrade to 3.20.1-1. # pacman -Syu "nss>=3.20.1-1" The problem has been fixed upstream in version 3.20.1. Workaround ========== None. Description =========== Several issues existed within the ASN.1 decoder used by NSS for handling streaming BER data. While the majority of NSS uses a separate, unaffected DER decoder, several public routines also accept BER data, and thus are affected. An attacker that successfully exploited these issues can overflow the heap and may be able to obtain remote code execution. Impact ====== A remote attacker, by submitting crafted ASN.1 data in BER format, can execute arbitrary code on the affected host. References ========== http://www.mail-archive.com/dev-tech-crypto@lists.mozilla.org/msg12386.html https://access.redhat.com/security/cve/CVE-2015-7181 https://access.redhat.com/security/cve/CVE-2015-7182

1 0

[arch-security] [ASA-201511-2] firefox: multiple issues
by Remi Gacogne 04 Nov '15

04 Nov '15

Arch Linux Security Advisory ASA-201511-2 ========================================= Severity: Critical Date : 2015-11-04 CVE-ID : CVE-2015-4513 CVE-2015-4514 CVE-2015-4515 CVE-2015-4518 CVE-2015-7181 CVE-2015-7182 CVE-2015-7183 CVE-2015-7187 CVE-2015-7188 CVE-2015-7189 CVE-2015-7193 CVE-2015-7194 CVE-2015-7195 CVE-2015-7196 CVE-2015-7197 CVE-2015-7198 CVE-2015-7199 CVE-2015-7200 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 42.0-1 is vulnerable to multiple issues, including but no limited to information leak, policy bypass and remote code execution. Resolution ========== Upgrade to 42.0-1. # pacman -Syu "firefox>=42.0-1" The problem has been fixed upstream in version 42.0. Workaround ========== None. Description =========== - CVE-2015-4513 (Miscellaneous memory safety hazards): Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky, Randell Jesup, Olli Pettay, Karl Tomlinson, Jeff Walden, and Gary Kwong reported memory safety problems and crashes that affect Firefox ESR 38.3 and Firefox 41. - CVE-2015-4514 (Miscellaneous memory safety hazards): Christian Holler, Andrew McCreight, Georg Fritzsche, Tyson Smith, and Carsten Book reported crash and memory safety problems that affect Firefox 41. - CVE-2015-4515 (Information disclosure through NTLM authentication): Security researcher Tim Brown reported that Firefox discloses the hostname and possibly the Windows domain through NTLM-based HTTP authentication when sending type 3 messages as part of the authentication exchange. This is because the Workstation field is populated with the hostname of the system making the request. An attacker can craft a malicious page to send a silent NTLM request that will disclose the information without visibility in the client, leading to information disclosure. This is mitigated because NTLM v1 is disabled by default configurations. - CVE-2015-4518 (CSP bypass due to permissive Reader mode whitelist): Security researcher Mario Heiderich reported an issue where the security protections of Reader mode in Firefox can be bypassed, allowing scripts to be run. Mozilla developer Frederik Braun independently discovered and reported this same issue as well. This issue happens even though Reader View explicitly disables script for rendered pages through a whitelist of allowed HTML content. Mario discovered that the whitelist was too permissive and a malicious site could manipulate content to bypass CSP protections, allowing for possible cross-site scripting (XSS) attacks. - CVE-2015-7181, CVE-2015-7182 (NSS memory corruption issues): Mozilla engineers Tyson Smith and David Keeler reported a use-after-poison and buffer overflow in the ASN.1 decoder in Network Security Services (NSS). These issues were in octet string parsing and were found through fuzzing and code inspection. If these issues were triggered, they would lead to a potentially exploitable crash. These issues were fixed in NSS version 3.19.2.1 and 3.19.4, shipped in Firefox and Firefox ESR, respectively, as well as NSS 3.20.1. - CVE-2015-7183 (NSPR overflow in PL_ARENA_ALLOCATE can lead to crash, potential memory corruption): Google security engineer Ryan Sleevi reported an integer overflow in the Netscape Portable Runtime (NSPR) due to a lack of checks during memory allocation. This leads to a potentially exploitable crash. This issue is fixed in NSPR 4.10.10. - CVE-2015-7187 (Disabling scripts in Add-on SDK panels has no effect): Add-on authors Jason Hamilton and Peter Arremann with AMO editor Sylvain Giroux reported a vulnerability when a panel is created using the Add-on SDK in a browser extension. Defining a panel with script: false is supposed to disable script execution but it was found that inline script would still execute. This flaw allows for the potential execution of script content in an extension when it was been explicitly disallowed. The potential impact of this flaw would depend on whether the add-on was relying on script: false as a security mechanism and from location the panel content was loaded. No add-ons served from addons.mozilla.org are vulnerable to this flaw but add-ons installed from third party sites may be. - CVE-2015-7188 (Trailing whitespace in IP address hostnames can bypass same-origin policy): Security researcher Michał Bentkowski reported that adding white-space characters to hostnames that are IP addresses can bypass same-origin policy. This flaw was caused by trailing whitespaces being evaluated differently when parsing IP addresses instead of alphanumeric hostnames. This could lead to a cross-site script (XSS) attack. - CVE-2015-7189 (Buffer overflow during image interactions in canvas): Security researcher Looben Yang reported a buffer overflow in the JPEGEncoder function during script interactions with a canvas element. This is caused by a race condition and incorrectly matched sizes following image interactions. This leads to a potentially exploitable crash. - CVE-2015-7193 (CORS preflight is bypassed when non-standard Content-Type headers are received): Security researcher Shinto K Anto reported an issue with cross-origin resource sharing (CORS) "preflight" requests when receiving certain Content-Type headers. This is due to an error in implementation resulting in trying to process multiple media types when they are returned in the Content-Type headers from a server. This is disallowed in the CORS specification and results in a simple instead of a "preflight" request, leading to potential same-origin policy violation. - CVE-2015-7194 (Memory corruption in libjar through zip files): Security researcher Gustavo Grieco reported a buffer underflow in libjar triggered through a maliciously crafted ZIP format file. This results in a potentially exploitable crash. - CVE-2015-7195 (Certain escaped characters in host of Location-header are being treated as non-escaped): Security researcher Frans Rosén reported that URLs with certain escaped characters in hostnames are parsed incorrectly. This leads to parsing being abandoned when an effected escaped character is encountered followed by a navigation to the previously parsed version of the URL. When combined with a site allowing for navigation redirection that allows for escaped characters, this could lead to potential extraction of site specific tokens. - CVE-2015-7196 (JavaScript garbage collection crash with Java applet): Mozilla community member Vytautas Staraitis reported an issue with the interaction of Java applets and JavaScript. The Java plugin can deallocate a JavaScript wrapper when it is still in use, which leads to a JavaScript garbage collection crash. This crash is potentially exploitable. This issue only affects systems where Java is installed and enabled as a browser plugin. Other systems are unaffected. - CVE-2015-7197 (Mixed content WebSocket policy bypass through workers): Mozilla developer Ehsan Akhgari reported a mechanism through which a web worker could be used to bypass secure requirements for WebSockets when workers are used to create WebSockets. This allows for the bypassing of mixed content WebSocket policy. - CVE-2015-7198, CVE-2015-7199 CVE-2015-7200 (Vulnerabilities found through code inspection): Security researcher Ronald Crane reported three vulnerabilities affecting released code that were found through code inspection. These included a buffer overflow in the ANGLE graphics library and two issues of missing status checks in SVG rendering and during cryptographic key manipulation. These do not all have clear mechanisms to be exploited through web content but are vulnerable if a mechanism can be found to trigger them. Impact ====== A remote attacker can cause a denial of service, access sensitive information or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2015-116/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-117/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-118/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-121/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-122/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-123/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-127/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-128/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-129/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-130/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-131/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-132/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-133/ https://access.redhat.com/security/cve/CVE-2015-4513 https://access.redhat.com/security/cve/CVE-2015-4514 https://access.redhat.com/security/cve/CVE-2015-4515 https://access.redhat.com/security/cve/CVE-2015-4518 https://access.redhat.com/security/cve/CVE-2015-7181 https://access.redhat.com/security/cve/CVE-2015-7182 https://access.redhat.com/security/cve/CVE-2015-7183 https://access.redhat.com/security/cve/CVE-2015-7187 https://access.redhat.com/security/cve/CVE-2015-7188 https://access.redhat.com/security/cve/CVE-2015-7189 https://access.redhat.com/security/cve/CVE-2015-7193 https://access.redhat.com/security/cve/CVE-2015-7194 https://access.redhat.com/security/cve/CVE-2015-7195 https://access.redhat.com/security/cve/CVE-2015-7196 https://access.redhat.com/security/cve/CVE-2015-7197 https://access.redhat.com/security/cve/CVE-2015-7198 https://access.redhat.com/security/cve/CVE-2015-7199 https://access.redhat.com/security/cve/CVE-2015-7200

1 0