The OVAL Repository 5.4 2015-09-03T06:25:39.053-04:00 Oracle Linux 4 bash [3.0-27.0.3] - Rework env function definition for safety (Florian Weimer) [CVE-2014-7169] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 4 bash [3.0-27.0.2] - Preliminary fix for CVE-2014-7169 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 4 bash The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-6271) For additional information on the CVE-2014-6271 flaw, refer to the Knowledgebase article at <A HREF="https://access.redhat.com/articles/1200223">https://access.redhat.com/articles/1200223</A> Red Hat would like to thank Stephane Chazelas for reporting this issue. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 4 The operating system installed on the system is Oracle Linux 4.x Dragos Prisaca DRAFT INTERIM ACCEPTED Chandan M C INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 Oracle Linux 4 libvorbis Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 3 Oracle Linux 4 Oracle Linux 5 wireshark The SigComp Universal Decompressor Virtual Machine (UDVM) in Wireshark 0.10.8 through 1.0.14 and 1.2.0 through 1.2.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to sigcomp-udvm.c and an off-by-one error, which triggers a buffer overflow, different vulnerabilities than CVE-2010-2287. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 4 Oracle Linux 5 firefox xulrunner Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. The RHSA-2011:1242 Firefox update rendered HTTPS certificates signed by a certain Certificate Authority (CA) as untrusted, but made an exception for a select few. This update removes that exception, rendering every HTTPS certificate signed by that CA as untrusted. (BZ#735483) All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.22. After installing the update, Firefox must be restarted for the changes to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 The operating system installed on the system is Oracle Linux 6.x Dragos Prisaca DRAFT INTERIM ACCEPTED Chandan M C INTERIM ACCEPTED ACCEPTED Oracle Linux 4 Oracle Linux 5 Oracle Linux 3 openoffice.org openoffice.org2 Integer overflow in the TIFF parser in OpenOffice.org (OOo) before 2.3; and Sun StarOffice 6, 7, and 8 Office Suite (StarSuite); allows remote attackers to execute arbitrary code via a TIFF file with crafted values of unspecified length fields, which triggers allocation of an incorrect amount of memory, resulting in a heap-based buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 The operating system installed on the system is Oracle Linux 5.x Danny Haynes DRAFT INTERIM ACCEPTED Dragos Prisaca INTERIM ACCEPTED Chandan M C INTERIM ACCEPTED ACCEPTED