- Arch-security - lists.archlinux.org

[arch-security] [ASA-201412-15] python2: multiple issues
by Levente Polyak 15 Dec '14

15 Dec '14

Arch Linux Security Advisory ASA-201412-15 ========================================== Severity: Medium Date : 2014-12-15 CVE-ID : CVE-2013-1752 CVE-2013-1753 CVE-2014-9365 Package : python2 Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package python2 before version 2.7.9-1 is vulnerable to denial of service and man-in-the-middle attacks. Resolution ========== Upgrade to 2.7.9-1. # pacman -Syu "python2>=2.7.9-1" The problems have been fixed upstream in version 2.7.9. Workaround ========== None. Description =========== - CVE-2013-1752 (denial of service) Multiple unbound readline() flaws in python stdlib were found, which can lead to excessive memory usage if a malicious or broken server sends excessively long lines without any line breaks. - CVE-2013-1753 (denial of service) The XMLRPC library is vulnerable to unrestricted decompression of HTTP responses using gzip enconding. A malicious server can send a specially prepared HTTP request that can result in memory exhaustion. - CVE-2014-9365 (man-in-the-middle) When Python's standard library HTTP clients (httplib, urllib, urllib2, xmlrpclib) are used to access resources with HTTPS, by default the certificate is not checked against any trust store, nor is the hostname in the certificate checked against the requested host. It was possible to configure a trust root to be checked against, however there were no faculties for hostname checking. This made MITM attacks against the HTTP clients trivial, and violated RFC 2818. Impact ====== An remote attacker is able to perform a man-in-the-middle attack or cause a denial of service. References ========== https://hg.python.org/cpython/raw-file/v2.7.9/Misc/NEWS https://access.redhat.com/security/cve/CVE-2013-1752 https://access.redhat.com/security/cve/CVE-2013-1753 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9365 https://bugs.python.org/issue16041 https://bugs.python.org/issue16042 https://bugs.python.org/issue16043 https://bugs.python.org/issue22417

1 0

[arch-security] [ASA-201412-14] xorg-server: multiple issues
by Levente Polyak 12 Dec '14

12 Dec '14

Arch Linux Security Advisory ASA-201412-14 ========================================== Severity: Critical Date : 2014-12-12 CVE-ID : CVE-2014-8091 CVE-2014-8092 CVE-2014-8093 CVE-2014-8094 CVE-2014-8095 CVE-2014-8096 CVE-2014-8097 CVE-2014-8098 CVE-2014-8099 CVE-2014-8100 CVE-2014-8101 CVE-2014-8102 CVE-2014-8103 Package : xorg-server Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package xorg-server before version 1.16.2.901-1 is vulnerable to multiple issues including but not limited to denial of service and possibly arbitrary code execution. Resolution ========== Upgrade to 1.16.2.901-1. # pacman -Syu "xorg-server>=1.16.2.901-1" The problems have been fixed upstream in version 1.16.2.901. Workaround ========== None. Description =========== - CVE-2014-8091 (denial of service) X.Org X Window System, when using SUN-DES-1 (Secure RPC) authentication credentials, does not check the return value of a malloc call, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a crafted connection request. - CVE-2014-8092 (arbitrary code execution) A flaw allow remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted request to various affected functions, which triggers an out-of-bounds read or write. - CVE-2014-8093 (arbitrary code execution) Multiple integer overflows allow remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted request to various affected functions, which triggers an out-of-bounds read or write. - CVE-2014-8094 (arbitrary code execution) Integer overflow in the ProcDRI2GetBuffers function in the DRI2 extension allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted request, which triggers an out-of-bounds read or write. - CVE-2014-8095 (arbitrary code execution) The XInput extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8096 (arbitrary code execution) The SProcXCMiscGetXIDList function in the XC-MISC extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value. - CVE-2014-8097 (arbitrary code execution) The DBE extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8098 (arbitrary code execution) The GLX extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8099 (arbitrary code execution) The XVideo extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected function. - CVE-2014-8100 (arbitrary code execution) The Render extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8101 (arbitrary code execution) The RandR extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8102 (arbitrary code execution) The SProcXFixesSelectSelectionInput function in the XFixes extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length value. - CVE-2014-8103 (arbitrary code execution) A flaw allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions in the DRI3 or Present extension. Impact ====== An authenticated attacker, either locally or remotely, is able to cause a denial of service or possibly execute arbitrary code via crafted calls to various affected functions. References ========== http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/ http://lists.x.org/archives/xorg-announce/2014-December/002501.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8091 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8092 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8093 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8094 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8095 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8096 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8097 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8098 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8099 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8100 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8101 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8102 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8103

1 0

[arch-security] [ASA-201412-13] flashplugin: multiple issues
by Levente Polyak 12 Dec '14

12 Dec '14

Arch Linux Security Advisory ASA-201412-13 ========================================== Severity: Critical Date : 2014-12-12 CVE-ID : CVE-2014-0580 CVE-2014-0587 CVE-2014-8443 CVE-2014-9163 CVE-2014-9164 CVE-2014-9162 Package : flashplugin Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package flashplugin before version 11.2.202.425-1 is vulnerable to multiple issues including but not limited to arbitrary code execution, information disclosure and policy bypass. Resolution ========== Upgrade to 11.2.202.425-1. # pacman -Syu "flashplugin>=11.2.202.425-1" The problems have been fixed upstream in version 11.2.202.425. Workaround ========== None. Description =========== - CVE-2014-0580 (policy bypass) A flaw allows remote attackers to bypass the same origin policy via unspecified vectors. - CVE-2014-0587 (arbitrary code execution) A flaw allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. - CVE-2014-8443 (arbitrary code execution) A flaw allows attackers to execute arbitrary code via a use-after-free vulnerability. - CVE-2014-9163 (arbitrary code execution) A flaw allows attackers to execute arbitrary code via a stack-based buffer overflow vulnerability. - CVE-2014-9164 (arbitrary code execution) A flaw allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. - CVE-2014-9162 (information disclosure) A flaw allows attackers to obtain sensitive information via unspecified vectors. Impact ====== A remote attacker is able to execute arbitrary code, bypass the same origin policy, obtain sensitive information or crash the plugin via various unspecified vectors. References ========== https://helpx.adobe.com/security/products/flash-player/apsb14-27.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0580 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0587 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8443 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9162 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9163 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9164

1 0

[arch-security] [ASA-201412-12] nvidia: arbitrary code execution
by Levente Polyak 12 Dec '14

12 Dec '14

Arch Linux Security Advisory ASA-201412-12 ========================================== Severity: Critical Date : 2014-12-12 CVE-ID : CVE-2014-8091 CVE-2014-8098 CVE-2014-8298 Package : nvidia nvidia-lts Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The packages nvidia and nvidia-lts before version 343.36-1 are vulnerable to arbitrary code execution or denial of service. Resolution ========== Upgrade to 343.36-1. # pacman -Syu "nvidia>=343.36-1" # pacman -Syu "nvidia-lts>=343.36-1" The problems have been fixed upstream in version 343.36. Workaround ========== None. Description =========== It was discovered that the NVIDIA graphics drivers incorrectly handled GLX indirect rendering support. An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation. Impact ====== An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation. References ========== https://nvidia.custhelp.com/app/answers/detail/a_id/3610 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8091 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8098 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8298

1 0

[arch-security] [ASA-201412-11] nvidia-340xx: arbitrary code execution
by Levente Polyak 12 Dec '14

12 Dec '14

Arch Linux Security Advisory ASA-201412-11 ========================================== Severity: Critical Date : 2014-12-12 CVE-ID : CVE-2014-8091 CVE-2014-8098 CVE-2014-8298 Package : nvidia-340xx nvidia-340xx-lts Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The packages nvidia-340xx and nvidia-340xx-lts before version 340.65-1 are vulnerable to arbitrary code execution or denial of service. Resolution ========== Upgrade to 340.65-2. # pacman -Syu "nvidia-340xx>=340.65-1" # pacman -Syu "nvidia-340xx-lts>=340.65-1" The problems have been fixed upstream in version 340.65. Workaround ========== None. Description =========== It was discovered that the NVIDIA graphics drivers incorrectly handled GLX indirect rendering support. An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation. Impact ====== An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation. References ========== https://nvidia.custhelp.com/app/answers/detail/a_id/3610 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8091 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8098 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8298

1 0

[arch-security] [ASA-201412-10] nvidia-304xx: arbitrary code execution
by Levente Polyak 12 Dec '14

12 Dec '14

Arch Linux Security Advisory ASA-201412-10 ========================================== Severity: Critical Date : 2014-12-12 CVE-ID : CVE-2014-8091 CVE-2014-8098 CVE-2014-8298 Package : nvidia-304xx nvidia-304xx-lts Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The packages nvidia-304xx and nvidia-304xx-lts before version 304.125-1 are vulnerable to arbitrary code execution or denial of service. Resolution ========== Upgrade to 304.125-2. # pacman -Syu "nvidia-304xx>=304.125-1" # pacman -Syu "nvidia-304xx-lts>=304.125-1" The problems have been fixed upstream in version 304.125. Workaround ========== None. Description =========== It was discovered that the NVIDIA graphics drivers incorrectly handled GLX indirect rendering support. An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation. Impact ====== An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation. References ========== https://nvidia.custhelp.com/app/answers/detail/a_id/3610 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8091 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8098 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8298

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-9] powerdns-recursor: denial of service
by Remi Gacogne 09 Dec '14

09 Dec '14

Arch Linux Security Advisory ASA-201412-9 ========================================= Severity: High Date : 2014-12-09 CVE-ID : CVE-2014-8601 Package : powerdns-recursor Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package powerdns-recursor before version 3.6.2-1 is vulnerable to remote denial of service. Resolution ========== Upgrade to 3.6.2-1. # pacman -Syu "powerdns-recursor>=3.6.2-1" The problem has been fixed upstream in version 3.6.2. Workaround ========== Only clients in allow-from are able to trigger the degraded service, so this should be limited to your user base. Description =========== PowerDNS, while acting as a caching nameserver, can be negatively impacted by sending queries for specially configured, hard to resolve domain names. This is the same issue as the ones found in bind (ASA-201412-7) and unbound (ASA-201412-8). Impact ====== A remote attacker can trick unbound into consuming a lot of resources by sending a specially crafted query. References ========== http://doc.powerdns.com/md/security/powerdns-advisory-2014-02/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8601

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-8] unbound: denial of service
by Remi Gacogne 09 Dec '14

09 Dec '14

Arch Linux Security Advisory ASA-201412-8 ========================================= Severity: High Date : 2014-12-09 CVE-ID : CVE-2014-8602 Package : unbound Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package unbound before version 1.5.1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 1.5.1-1. # pacman -Syu "unbound>=1.5.1-1" The problem has been fixed upstream in version 1.5.1. Workaround ========== A very simple workaround is to ignore the problem and let existing anti-DoS systems in unbound deal with the issue. It will consume a lot of resources, but other customers will (most likely) continue to get service. If affected, unbound-control flush_requestlist provides temporary relief, but the issue could resume (immediately). Putting the maliciously sent query in local-data, or using access-control to block the malicious query sending IP would workaround that exploit set-up. The config statement do-not-query-address: IPorNetblock can be used to block a specific authority server. Description =========== The resolver can be tricked into following an endless series of delegations, this consumes a lot of resources. Resolvers fetch the content for domain names by sending queries to authority servers on the internet. One of the responses that authority servers can return is a referral response, which points to further servers to continue the lookup. To continue the lookup, resolvers may have to perform recursion, where new names, called glue, from the referral response have to be looked up to continue the query resolution. The issue here is a lack of limiting on the recursion fetches performed to figure out a particular query. The authority server is a special set-up that responds with an infinite amount of glue. This then causes the resolver to spend a lot of resources diving into the infinite glue looking up names, only find out it needs to look up even more names. Impact ====== A remote attacker can trick unbound into consuming a lot of resources by sending a specially crafted query. References ========== https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8602 https://unbound.net/downloads/CVE-2014-8602.txt

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-7] bind: denial of service
by Levente Polyak 08 Dec '14

08 Dec '14

Arch Linux Security Advisory ASA-201412-7 ========================================= Severity: High Date : 2014-12-08 CVE-ID : CVE-2014-8500 Package : bind Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package bind before version 9.10.1.P1-1 is vulnerable to denial of service. Resolution ========== Upgrade to 9.10.1.P1-1. # pacman -Syu "bind>=9.10.1.P1-1" The problem has been fixed upstream in version 9.10.1.P1. Workaround ========== None. Description =========== By making use of maliciously-constructed zones or a rogue server, an attacker can exploit an oversight in the code BIND 9 uses to follow delegations in the Domain Name Service, causing BIND to issue unlimited queries in an attempt to follow the delegation. This can lead to resource exhaustion and denial of service (up to and including termination of the named server process). Impact ====== A remote attacker is able to make use of maliciously-constructed zones or a rogue server that can lead to resource exhaustion and denial of service. References ========== https://kb.isc.org/article/AA-01216/0 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8500

1 0

[arch-security] [Arch Linux Security Advisory ASA-201412-6] mantisbt: multiple issues
by Levente Polyak 08 Dec '14

08 Dec '14

Arch Linux Security Advisory ASA-201412-6 ========================================= Severity: Critical Date : 2014-12-08 CVE-ID : CVE-2014-9272 CVE-2014-9270 CVE-2014-8987 CVE-2014-9271 CVE-2014-9281 CVE-2014-8986 CVE-2014-9269 CVE-2014-9280 CVE-2014-9089 CVE-2014-9279 CVE-2014-8988 CVE-2014-8553 CVE-2014-6387 CVE-2014-6316 CVE-2014-9117 Package : mantisbt Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package mantisbt before version 1.2.18-1 is suffering from multiple issues including but not limited to code execution, sql injection, authentication bypass, cross-site scripting and information disclosure. Resolution ========== Upgrade to 1.2.18-1. # pacman -Syu "mantisbt>=1.2.18-1" The problems have been fixed upstream in version 1.2.18. Workaround ========== None. Description =========== - CVE-2014-9272 (cross-side scripting) The function "string_insert_hrefs" doesn't validate the protocol, which is why one can make a link that executes arbitrary JavaScript code. - CVE-2014-9270 (cross-side scripting) The Projax library does not properly escape html strings. An attacker could take advantage of this to perform an XSS attack using the profile/Platform field. - CVE-2014-8987 (cross-side scripting) The MantisBT Configuration Report page (adm_config_report.php) did not escape a parameter before displaying it on the page, allowing an attacker to execute arbitrary JavaScript code. - CVE-2014-9271 (cross-side scripting) It's possible to upload Flash files and make open them inline by using an image extension. Since Flash files can execute JavaScript this becomes a persistent XSS. - CVE-2014-9281 (cross-side scripting) A missing sanity check in copy_field.php is leading to a reflected XSS vulnerability which could be exploited f.e. by the dest_id parameter. - CVE-2014-8986 (cross-side scripting) Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm_config_report.php) allows remote administrators to inject arbitrary web script or HTML via a crafted config option. - CVE-2014-9269 (cross-side scripting) Extended project browser allows projects to be passed in as A;B. helper_get_current_project() and helper_get_current_project_trace() then explodes the string by ';' and doesn't check that A is an int (representing a project/sub-project id). Finally, print_extended_project_browser() prints the result of the split into a JavaScript array. - CVE-2014-9280 (code execution) PHP Object Injection in filter API in the function current_user_get_bug_filter (core\current_user_api.php line 212). The code loads a variable from $_GET['filter']/$_POST['filter'] and if it's not numeric, feeds it straight into unserialize() on line 223. The current_user_get_bug_filter function is called in 10 places, easiest is just to access /view_filters_page.php. A PoC initializing a class that's loaded could look like this: /view_filters_page.php?filter=O:16:"MantisPHPSession":2:{s:2:"id";s:1:"1";s:3:"key";s:3:"wee";} - CVE-2014-9089 (sql injection) Multiple SQL injection vulnerabilities in view_all_bug_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the 'sort' or 'dir' parameter to view_all_set.php. Both parameters are split into chunks on ','. After splitting, only the first two values are validated. By supplying a third value, SQL injection can be performed. - CVE-2014-9279 (information disclosure) Database credentials leak via unattended upgrade script will connect to arbitrary host with the current DB config credentials. The unattended upgrade script retrieved DB connection settings from POST parameters, allowing an attacker to get the script to connect to their host with the current DB config credentials. - CVE-2014-8988 (information disclosure) It is possible to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL. - CVE-2014-8553 (information disclosure) No public information is available yet. - CVE-2014-6387 (authentication bypass) A flaw in gpc_api.php allows remote attackers to bypass authentication via a password starting will a null byte, which triggers an unauthenticated bind. A malicious user can exploit this vulnerability to login as any registered user and without knowing their password, to systems relying on LDAP for user authentication (e.g. Active Directory or OpenLDAP with "allow bind_anon_cred"). - CVE-2014-6316 (cross-site redirection) When Mantis is installed at the web server's root, $g_short_path is set to '/'. string_sanitize_url() removes the trailing '/' from the short path, which causes the URL to be incorrectly categorized as "type 2", thus allowing cross-site redirection to occur. - CVE-2014-9117 (captcha bypass) MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection mechanism by leveraging knowledge of a CAPTCHA answer for a public_key parameter value, as demonstrated by E4652 for the public_key value 0. Impact ====== A remote attacker is able to bypass the authentication, execute arbitrary code, perform sql injection, steal sessions via cross-site scripting or disclosure sensitive information. References ========== https://www.mantisbt.org/bugs/changelog_page.php?version_id=191 http://seclists.org/oss-sec/2014/q4/955 https://access.redhat.com/security/cve/CVE-2014-9272 https://www.mantisbt.org/bugs/view.php?id=17297 https://access.redhat.com/security/cve/CVE-2014-9270 https://www.mantisbt.org/bugs/view.php?id=17583 https://access.redhat.com/security/cve/CVE-2014-8987 https://www.mantisbt.org/bugs/view.php?id=17870 https://access.redhat.com/security/cve/CVE-2014-9271 https://www.mantisbt.org/bugs/view.php?id=17874 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9281 https://www.mantisbt.org/bugs/view.php?id=17876 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8986 https://www.mantisbt.org/bugs/view.php?id=17889 https://access.redhat.com/security/cve/CVE-2014-9269 https://www.mantisbt.org/bugs/view.php?id=17890 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9280 https://www.mantisbt.org/bugs/view.php?id=17875 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9089 https://www.mantisbt.org/bugs/view.php?id=17841 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9279 https://www.mantisbt.org/bugs/view.php?id=17877 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8988 https://www.mantisbt.org/bugs/view.php?id=17742 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8553 https://www.mantisbt.org/bugs/view.php?id=17243 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6387 https://www.mantisbt.org/bugs/view.php?id=17640 https://access.redhat.com/security/cve/CVE-2014-6316 https://www.mantisbt.org/bugs/view.php?id=17648 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9117 https://www.mantisbt.org/bugs/view.php?id=17811

1 0