The OVAL Repository 5.4 2015-09-03T06:25:07.437-04:00 Debian GNU/Linux 7 chromium-browser Several vulnerabilties have been discovered in the chromium web browser. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 openjdk-7 Several vulnerabilities have been discovered in OpenJDK, animplementation of the Oracle Java platform, resulting in the executionof arbitrary code, breakouts of the Java sandbox, information disclosureor denial of service. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 openssl It was discovered that incorrect memory handling in OpenSSL'sdo_ssl3_write() function could result in denial of service. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 mysql-5.5 Several issues have been discovered in the MySQL database server. Thevulnerabilities are addressed by upgrading MySQL to the new upstreamversion 5.5.37. Please see the MySQL 5.5 Release Notes and Oracle'sCritical Patch Update advisory for further details. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 icedove Multiple security issues have been found in Icedove, Debian's versionof the Mozilla Thunderbird mail and news client: multiple memory safetyerrors, buffer overflows, missing permission checks, out of bound reads,use-after-frees and other implementation errors may lead to theexecution of arbitrary code, privilege escalation, cross-site scriptingor denial of service. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 icedove Multiple security issues have been found in Icedove, Debian's version ofthe Mozilla Thunderbird mail and news client. Multiple memory safetyerrors, out of bound reads, use-after-frees and other implementationerrors may lead to the execution of arbitrary code, informationdisclosure or denial of service. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 chromium-browser Several vulnerabilities were discovered in the chromium web browser. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 ruby-actionpack-3.2 Several vulnerabilities were discovered in Action Pack, a componentof Ruby on Rails. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 linux Several vulnerabilities have been discovered in the Linux kernel thatmay lead to a denial of service, information leaks or privilegeescalation. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 iceweasel Multiple security issues have been found in Iceweasel, Debian's versionof the Mozilla Firefox web browser: Multiple memory safety errors,buffer overflows, missing permission checks, out of bound reads,use-after-frees and other implementation errors may lead to theexecution of arbitrary code, privilege escalation, cross-site scriptingor denial of service. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 tomcat7 Multiple security issues were found in the Tomcat servlet and JSP engine. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 qemu Several vulnerabilities were discovered in qemu, a fast processor emulator. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 jbigkit Florian Weimer of the Red Hat product security team discovered multiplebuffer overflows in jbigkit, which could lead to the execution ofarbitrary code when processing malformed images. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 chromium-browser Several vulnerabilities have been discovered in the chromium web browser. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 openssl A vulnerability has been discovered in OpenSSL's support for theTLS/DTLS Heartbeat extension. Up to 64KB of memory from either client orserver can be recovered by an attacker. This vulnerability might allow anattacker to compromise the private key and other sensitive data inmemory. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 qemu-kvm Several vulnerabilities were discovered in qemu-kvm, a fullvirtualization solution on x86 hardware. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 drupal7 An information disclosure vulnerability was discovered in Drupal, afully-featured content management framework. When pages are cached foranonymous users, form state may leak between anonymous users. Sensitiveor private information recorded for one anonymous user could thus bedisclosed to other users interacting with the same form at the sametime. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 prosody A denial-of-service vulnerability has been reported in Prosody, a XMPPserver. If compression is enabled, an attacker might send highly-compressed XMLelements (attack known as <q>zip bomb</q>) over XMPP streams and consume allthe resources of the server. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 python2.7 Multiple security issues were discovered in Python. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 openssl Multiple vulnerabilities have been discovered in OpenSSL. The followingCommon Vulnerabilities and Exposures project ids identify them. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 ruby-actionmailer-3.2 Aaron Neyer discovered that missing input sanitising in the loggingcomponent of Ruby Actionmailer could result in denial of service througha malformed e-mail message. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 ruby-actionpack-3.2 Toby Hsieh, Peter McLarnan, Ankit Gupta, Sudhir Rao and Kevin Reintjesdiscovered multiple cross-site scripting and denial of servicevulnerabilities in Ruby Actionpack. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian GNU/Linux 7 kfreebsd-9 Several vulnerabilities have been discovered in the FreeBSD kernel that may lead to a denial of service or privilege escalation. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Debian 7 Debian 7 (wheezy) is installed Maria Kedovskaya DRAFT INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED Sergey Artykhov INTERIM ACCEPTED ACCEPTED