The OVAL Repository 5.4 2015-09-03T06:25:39.673-04:00 Oracle Linux 5 xen The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm-83 The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM. SecPod Team DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm kmod-kvm kmod-kvm-debug kvm-qemu-img kvm-tools [kvm-83-273.0.1.el5] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch [kvm-83.273.el5] - kvm-pcnet-Properly-handle-TX-requests-during-Link-Fail.patch [bz#1225896] - kvm-pcnet-fix-Negative-array-index-read.patch [bz#1225896] - kvm-pcnet-force-the-buffer-access-to-be-in-bounds-during.patch [bz#1225896] - Resolves: bz#1225896 (EMBARGOED CVE-2015-3209 kvm: qemu: pcnet: multi-tmd buffer overflow in the tx path [rhel-5.11.z) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek [2.6.32-400.36.13uek] - net: guard tcp_set_keepalive() to tcp sockets (Eric Dumazet) [Orabug: 20224099] {CVE-2012-6657} - isofs: Fix unbounded recursion when processing relocated directories (Jan Kara) [Orabug: 20224061] {CVE-2014-5471} {CVE-2014-5472} - x86_64, traps: Stop using IST for #SS (Andy Lutomirski) [Orabug: 20224029] {CVE-2014-9090} {CVE-2014-9322} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 glibc [2.5-123.0.1.el5_11.1] - Switch to use malloc when the input line is too long [Orabug 19951108] - Use a /sys/devices/system/cpu/online for _SC_NPROCESSORS_ONLN implementation [Orabug 17642251] (Joe Jin) [2.5-123.1] - Fix parsing of numeric hosts in gethostbyname_r (CVE-2015-0235, #1183532). Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel kernel [2.6.18-400.1.1.0.1] - [net] fix tcp_trim_head() (James Li) [orabug 14512145, 19219078] - ocfs2: dlm: fix recovery hung (Junxiao Bi) [orabug 13956772] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 xorg-x11-server [1.1.1-48.107.0.1.el5_11] - Added oracle-enterprise-detect.patch - Replaced 'Red Hat' in spec file [1.1.1-48.107] - CVE-2014-8091 denial of service due to unchecked malloc in client authentication (#1168680) - CVE-2014-8092 integer overflow in X11 core protocol requests when calculating memory needs for requests (#1168684) - CVE-2014-8097 out of bounds access due to not validating length or offset values in DBE extension (#1168705) - CVE-2014-8095 out of bounds access due to not validating length or offset values in XInput extension (#1168694) - CVE-2014-8096 out of bounds access due to not validating length or offset values in XC-MISC extension(#1168700) - CVE-2014-8099 out of bounds access due to not validating length or offset values in XVideo extension (#1168710) - CVE-2014-8100 out of bounds access due to not validating length or offset values in Render extension (#1168711) - CVE-2014-8102 out of bounds access due to not validating length or offset values in XFixes extension (#1168714) - CVE-2014-8101 out of bounds access due to not validating length or offset values in RandR extension (#1168713) - CVE-2014-8093 xorg-x11-server: integer overflow in GLX extension requests when calculating memory needs for requests (#1168688) - CVE-2014-8098 xorg-x11-server: out of bounds access due to not validating length or offset values in GLX extension (#1168707) [1.1.1-48.104] - xserver-1.1.1-randr-config-timestamps.patch: Backport timestamp comparison fix from upstream RANDR code (#1006076) [1.1.1-48.103] - CVE-2013-6424: Fix OOB in trapezoid rasterization Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek [2.6.39-400.215.15] - isofs: Fix unbounded recursion when processing relocated directories (Jan Kara) [Orabug: 20224060] {CVE-2014-5471} {CVE-2014-5472} - x86_64, traps: Stop using IST for #SS (Andy Lutomirski) [Orabug: 20224028] {CVE-2014-9090} {CVE-2014-9322} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 Oracle Linux 7 bind [32:9.9.4-14.0.1.el7_0.1] - Rebuild to fix libmysqlclient dependency [32:9.9.4-14.1] - Fix CVE-2014-8500 (#1171975) Sergey Artykhov DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek [2.6.39-400.215.14] - HID: magicmouse: sanity check report size in raw_event() callback (Jiri Kosina) [Orabug: 19849355] {CVE-2014-3181} - ALSA: control: Protect user controls against concurrent access (Lars-Peter Clausen) [Orabug: 20192542] {CVE-2014-4652} - target/rd: Refactor rd_build_device_space + rd_release_device_space (Nicholas Bellinger) [Orabug: 20192517] {CVE-2014-4027} - media-device: fix infoleak in ioctl media_enum_entities() (Salva Peiro) [Orabug: 20192501] {CVE-2014-1739} {CVE-2014-1739} - udf: Avoid infinite loop when processing indirect ICBs (Jan Kara) [Orabug: 20192449] {CVE-2014-6410} - ALSA: control: Make sure that id->index does not overflow (Lars-Peter Clausen) [Orabug: 20192418] {CVE-2014-4656} - ALSA: control: Handle numid overflow (Lars-Peter Clausen) [Orabug: 20192376] {CVE-2014-465} - HID: picolcd: sanity check report size in raw_event() callback (Jiri Kosina) [Orabug: 20192205] {CVE-2014-3186} - net: sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann) [Orabug: 20192059] {CVE-2014-3688} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 libXfont [1.2.2-1.0.6] - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601) - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601) - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel kernel [2.6.18-400.1.1] - [x86] traps: stop using IST for #SS (Petr Matousek) [1172809] {CVE-2014-9322} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mysql55-mysql [5.5.40-2] filter perl(GD) from Requires (perl-gd is not available for RHEL5) Resolves: #1160514 [5.5.40-1] - Rebase to 5.5.40 Also fixes: CVE-2014-4274 CVE-2014-4287 CVE-2014-6463 CVE-2014-6464 CVE-2014-6469 CVE-2014-6484 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520 CVE-2014-6530 CVE-2014-6551 CVE-2014-6555 CVE-2014-6559 CVE-2014-6564 Resolves: #1160514 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek [2.6.39-400.215.13] - net: sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann) [Orabug: 20010591] {CVE-2014-3687} - net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann) [Orabug: 20010578] {CVE-2014-3673} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sudo [1.6.9p17-6] - added patches for CVE-2010-0426 and CVE-2010-0427 Resolves: #567689 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 systemtap [0.9.7-5.3] - rhbz556564-2: CVE-2009-4273 cont'd aka CVE-2010-0412 - rhbz559719: CVE-2010-0411 - pr11286: stap-client --server operation [0.9.7-5.2] - rhbz556564: CVE-2009-4273 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 openldap [2.3.43-12] - updated spec file, so the compat-libs linking patch applies correctly [2.3.43-11] - backported patch to handle null character in TLS certificates (#560912) [2.3.43-10] - updated chase-referral patch to compile cleanly - updated init script (#562714) [2.3.43-9] - updated ldap.sysconf to include SLAPD_LDAP, SLAPD_LDAPS and SLAPD_LDAPI options (#559520) [2.3.43-8] - fixed connection freeze when TLSVerifyClient = allow (#509230) [2.3.43-7] - fixed chasing referrals in libldap (#510522) [2.3.43-6] - fixed possible double free() in rwm overlay (#495628) - updated slapd man page and slapcat usage string (#468206) - updated default config for slapd - deleted syncprov module (#466937) - fixed migration tools autofs generated format (#460331) - fixed migration tools numbers detection in /etc/shadow (#113857) - fixed migration tools base ldif (#104585) [2.3.43-5] - implementation of limit adjustment before starting slapd (#527313) - init script no longer executes script in /tmp (#483356) - slapd not starting with ldap:/// every time (#481003) - delay between TERM and KILL when shutting down slapd (#452064) [2.3.43-4] - fixed compat libs linking (#503734) - activated lightweight dispatcher feature (#507276) - detection of timeout after failed result (#495701 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk [1:1.6.0.0-1.11.b16.0.1.el5] - Add oracle-enterprise.patch [1:1.6.0.0-1.11.b16.el5] - Remove javaws alternative due to conflict with java-1.6.0-sun's alternatives [1:1.6.0-1.10.b16] - Update to openjdk build b16 - Update to icedtea6-1.6 - Added tzdata-java requirement - Added autoconf and automake build requirement - Added tzdata-java requirement - Added java-1.6.0-openjdk-gcc-stack-markings.patch - Added java-1.6.0-openjdk-memory-barriers.patch - Added java-1.6.0-openjdk-jar-misc.patch - Added java-1.6.0-openjdk-linux-separate-debuginfo.patch - Added java-1.6.0-openjdk-securitypatches-20100323.patch - Added STRIP_KEEP_SYMTAB=libjvm* to install section, fix bz530402 - Resolves: rhbz#576124 [1:1.6.0-1.8.b09] - Added java-1.6.0-openjdk-debuginfo.patch - Added java-1.6.0-openjdk-elf-debuginfo.patch Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bash [3.2-33.4.0.1] - Fix segfaults from CVE-2014-6277 and CVE-2014-6278 completely. [orabug 19905421] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 rpm [4.4.2.3-36.0.1] - Add missing files in /usr/share/doc/ [4.8.0-36] - Fix warning when applying the patch for #1163057 [4.8.0-35] - Fix race condidition where unchecked data is exposed in the file system (CVE-2013-6435)(#1163057) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mysql [5.0.77-4.2] - Add fixes for CVE-2009-4019, CVE-2009-4028, CVE-2009-4030 Resolves: #556505 - Use non-expired certificates for SSL testing (upstream bug 50702) - Emit explicit error message if user tries to build RPM as root - Add comment suggesting disabling symbolic links in /etc/my.cnf Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-164.10.1.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb ( John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina yang) [orabug 6993043] [bz 7258] - [MM] shrink zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - FP register state is corrupted during the handling a SIGSEGV (Chuck Anderson) [orabug 7708133] [2.6.18-164.10.1.el5] - [net] e1000, r9169: fix rx length check errors (Cong Wang ) [550914 550915] - [net] e1000e: fix rx length check errors (Amerigo Wang ) [551222 551223] - [net] ipv6: fix ipv6_hop_jumbo remote system crash (Amerigo Wang ) [548642 548643] {CVE-2007-4567} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 openssl [0.9.8e-12.1] - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables (#510197) - fix CVE-2009-4355 - do not leak memory when CRYPTO_cleanup_all_ex_data() is called prematurely by application (#546707) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 avahi [0.6.16-9.el5] - Related: #609318 - Fixes CVE-2010-2244 [0.6.16-8.el5] - Related: #609318 - Fixes CVE-2010-2244 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 libvirt [0.6.3-33.0.1.el5_5.3] - Replaced docs/et.png in tarball [0.6.3-33.el5_5.3] - Explicitly set qcow2 backing store format (CVE-2010-2239) - Remap privileged source ports from guests behind NAT (CVE-2010-2242) - Eliminate memory leak in xenUnifiedDomainInfoListFree (rhbz 619711) [0.6.3-33.el5_5.2] - Fix discrepancy between xm list and virsh list (rhbz 618200) - Set a stable & high MAC addr for guest TAP devices on host (rhbz 617243) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-194.3.1.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb (John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - [nfs] -revert return code check to avoid EIO (Chuck Lever, Guru Anbalagane) [Orabug 9448515] - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524] - [mm] Set hugepages dirty bit so vm.drop_caches does not corrupt (John Sobecki) [orabug 9461825] - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() [2.6.18-194.3.1.el5] - [net] bnx2: fix lost MSI-X problem on 5709 NICs (John Feeney) [587799 511368] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-194.17.4.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb (John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524] - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki, Chris Mason, Herbert van den Bergh) [orabug 9245919] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] [2.6.18-194.17.4.el5] - [net] rds: fix local privilege escalation (Eugene Teo) [642897 642898] {CVE-2010-3904} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bind [30:9.3.6-4.P1.3] - fixes for CVE-2010-3762, CVE-2010-3613 and CVE-2010-3614 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sudo [1.7.2p1-8] - added patch for CVE-2010-2956 (#628628) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gcc [4.1.2-50.el5] - fix up fastjar directory traversal bugs (CVE-2010-0831) [4.1.2-49.el5] - fix ICE in set_uids_in_ptset (#605803) - fix ICE in make_rtl_for_nonlocal_decl (#582682, #508735, #503565, PR c++/33094) - dont build gcjwebplugin (#596097) - fix IPP handling in libgcj (#578382) - document -print-multi-os-directory (#529659, PR other/25507) - fix ICE in output_die with function local types (#527510, PR debug/41063) - speed up locale::locale() ctor if _S_global hasnt been changed (#635708, PR libstdc++/40088) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel This update fixes the following security issues: * A NULL pointer dereference flaw was found in the igb driver in the Linux kernel. If both the Single Root I/O Virtualization (SR-IOV) feature and promiscuous mode were enabled on an interface using igb, it could result in a denial of service when a tagged VLAN packet is received on that interface. (CVE-2010-4263, Important) * A missing sanity check was found in vbd_create() in the Xen hypervisor implementation. As CD-ROM drives are not supported by the blkback back-end driver, attempting to use a virtual CD-ROM drive with blkback could trigger a denial of service (crash) on the host system running the Xen hypervisor. (CVE-2010-4238, Moderate) * A flaw was found in the Linux kernel execve() system call implementation. A local, unprivileged user could cause large amounts of memory to be allocated but not visible to the OOM (Out of Memory) killer, triggering a denial of service. (CVE-2010-4243, Moderate) * A flaw was found in fixup_page_fault() in the Xen hypervisor implementation. If a 64-bit para-virtualized guest accessed a certain area of memory, it could cause a denial of service on the host system running the Xen hypervisor. (CVE-2010-4255, Moderate) * A missing initialization flaw was found in the bfa driver used by Brocade Fibre Channel Host Bus Adapters. A local, unprivileged user could use this flaw to cause a denial of service by reading a file in the "/sys/class/fc_host/host#/statistics/" directory. (CVE-2010-4343, Moderate) * Missing initialization flaws in the Linux kernel could lead to information leaks. (CVE-2010-3296, CVE-2010-3877, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4158, Low) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ntp [4.2.2p1-18.el5] - don't generate weak control key for resolver (CVE-2014-9293) - don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294) - fix buffer overflows via specially-crafted packets (CVE-2014-9295) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 NetworkManager [1:0.7.0-9.el5_4] - Ensure a connection is not used after its CA certificate has been deleted - Resolves: CVE-2009-4144 - Fix possible information disclosure by nm-connection-editor - Resolves: CVE-2009-4145 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk [1.6.0.0-1.16.b17.0.1.el5] - Add oracle-enterprise.patch [1.6.0.0-1.16.b17.el5] - Updated 1.7.5 tarball (contains additional security fixes) - Resolves: bz639951 [1.6.0.0-1.15.b17.el5] - Rebuild - Resolves: bz639951 [1.6.0.0-1.14.b17.el5] - Synched with el6 branch - Updated to IcedTea 1.7.5 - Resolves: bz639951 - Also resolves 619800 and 621303 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 postgresql84 [8.4.4-1.el5_5.1] - Update to PostgreSQL 8.4.4, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-4.html including fixes for CVE-2010-1169 and CVE-2010-1170 Resolves: #586060 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 dbus [1.1.2-12.el5_4.1] - CVE-2009-1189 dbus: invalid fix for CVE-2008-3834 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xorg-x11-server [1.1.1-48.76.0.1.el5_5.1 ] - Added oracle-enterprise-detect.patch - Replaced 'Red Hat' in spec file [1.1.1-48.76.1] - xserver-1.1.1-mod-macro-parens.patch: Fix insufficient parentheses in Render and arc computation code. (#495733) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-238.9.1.0.1.el5] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - fix missing aio_complete() in end_io (Joel Becker) [orabug 10365195] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [nfs] too many getattr and access calls after direct I/O [orabug 9348191] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [aio] patch removes limit on number of retries (Srinivas Eeda) [orabug 10044782] - [loop] Do not call loop_unplug for not configured loop device (orabug 10314497) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 openswan [2.6.32-4.4] Resolves: #748969 CVE-2011-4073 updated patch by upstream [2.6.32-4.3] Resolves: #748969 CVE-2011-4073 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 subversion [1.6.11-7.3] - add fix for svnadmin hotcopy (#681522) [1.6.11-7.2] - add security fix for CVE-2011-0715 (#681171) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 icu [4.2.1-9.1] - Resolves: rhbz#766539 CVE-2011-4599 localeID overflow Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc [2.5-49.el5_5.7] - Require suid bit on audit objects in privileged programs (#645677, CVE-2010-3856) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-200.20.1.el6uek] - af_packet: prevent information leak {CVE-2011-2898} - gro: Only reset frag0 when skb can be pulled {CVE-2011-2723} - vm: fix vm_pgoff wrap in stack expansion {CVE-2011-2496} - vm: fix vm_pgoff wrap in upward expansion {CVE-2011-2496} - taskstats: don't allow duplicate entries in listener mode {CVE-2011-2484} - Ecryptfs: Add mount option to check uid of device being mounted {CVE-2011-1833} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-200.19.1.el6uek] - Apply new fix for CVE-2011-1576. [2.6.32-200.18.1.el6uek] - Revert 'proc: fix a race in do_io_accounting' [2.6.32-200.17.1.el6uek] - net: Fix memory leak/corruption on VLAN GRO_DROP {CVE-2011-1576} - iommu-api: Extension to check for interrupt remapping {CVE-2011-1898} - KVM: IOMMU: Disable device assignment without interrupt remapping {CVE-2011-1898} - ext4: Fix max file size and logical block counting of extent format file {CVE-2011-2695} - nl80211: fix overflow in ssid_len {CVE-2011-2517} - Bluetooth: Prevent buffer overflow in l2cap config request {CVE-2011-2497} - proc: fix a race in do_io_accounting() {CVE-2011-2495} - proc: restrict access to /proc/PID/io {CVE-2011-2495} - Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace {CVE-2011-2492} - NLM: Don't hang forever on NLM unlock requests {CVE-2011-2491} - ksm: fix NULL pointer dereference in scan_get_next_rmap_item() {CVE-2011-2183} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 systemtap [1.3-9] - bz716489 (patch) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 krb5 - add upstream patch to fix hang or crash in the KDC when using the LDAP kdb backend (CVE-2011-0281, CVE-2011-0282, #671096) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 subversion [1.6.11-2.4] - add security fixes for CVE-2011-1752, CVE-2011-1783, CVE-2011-1921 (#709220) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-238.1.1.0.1.el5] - fix filp_close() race (Joe Jin) [orabug 10335998] - fix missing aio_complete() in end_io (Joel Becker) [orabug 10365195] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [nfs] too many getattr and access calls after direct I/O [orabug 9348191] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [aio] patch removes limit on number of retries (Srinivas Eeda) [orabug 10044782] - [loop] Do not call loop_unplug for not configured loop device (orabug 10314497) [2.6.18-238.1.1.el5] - [scsi] megaraid: give FW more time to recover from reset (Tomas Henzl) [667141 665427] - [fs] gfs2: fix statfs error after gfs2_grow (Robert S Peterson) [666792 660661] - [mm] prevent file lock corruption using popen(3) (Larry Woodman) [667050 664931] - [net] sctp: fix panic from bad socket lock on icmp error (Neil Horman) [665476 665477] {CVE-2010-4526} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 curl [7.15.5-9] - http://curl.haxx.se/docs/adv_20100209.html (#565408) [7.15.5-8] - mention lack of IPv6, FTPS and LDAP support while using a socks proxy (#473128) - avoid tight loop if an upload connection is broken (#479967) - add options --ftp-account and --ftp-alternative-to-user to program help (#517084) - fix crash when reusing connection after negotiate-auth (#517199) - support for CRL loading from a PEM file (#532069) [7.15.5-7] - sync patch for CVE-2007-0037 with 5.3.Z Related: #485290 [7.15.5-6] - fix CVE-2009-2417 Resolves: #516258 [7.15.5-5] - forwardport one hunk from upstream curl-7.15.1 Related: #485290 [7.15.5-4] - fix hunk applied to wrong place due to nonzero patch fuzz Related: #485290 [7.15.5-3] - fix CVE-2007-0037 Resolves: #485290 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 firefox xulrunner firefox: [3.6.7-3.0.1.el5] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat ones [3.6.7-3] - Rebuild xulrunner: [1.9.2.7-3.0.1.el5] - Added xulrunner-oracle-default-prefs.js and removed the corresponding RedHat one. [1.9.2.7-3] - Include fix for 575836 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel: [2.6.18-274.7.1.0.1.el5] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [scsi] add additional scsi medium error handling (John Sobecki) [orabug 12904887] - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - bonding: reread information about speed and duplex when interface goes up (John Haxby) [orabug 11890822] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [aio] patch removes limit on number of retries (Srinivas Eeda) [orabug 10044782] - [loop] Do not call loop_unplug for not configured loop device (orabug 10314497) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-238.5.1.0.1.el5] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - fix missing aio_complete() in end_io (Joel Becker) [orabug 10365195] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [nfs] too many getattr and access calls after direct I/O [orabug 9348191] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [aio] patch removes limit on number of retries (Srinivas Eeda) [orabug 10044782] - [loop] Do not call loop_unplug for not configured loop device (orabug 10314497) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 dbus [1:1.2.24-5] - Merge changes from RHEL-6 branch: * Drop default patch fuzz * Merge CVE-2010-4352.patch from RHEL-6_0-Z - Apply patches for CVE-2011-2200 - Resolves: #725313 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libXfont [1.4.1-2] - cve-2011-2895.patch: LZW decompression heap corruption Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 php53 php [5.3.3-3.3] - improve CVE-2011-1466 fix to cover CAL_GREGORIAN, CAL_JEWISH [5.3.3-3.1] - add security fixes for CVE-2011-2483, CVE-2011-0708, CVE-2011-1148, CVE-2011-1466, CVE-2011-1468, CVE-2011-1469, CVE-2011-1470, CVE-2011-1471, CVE-2011-1938, and CVE-2011-2202 (#740731) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ruby [1.8.5-19.el5_6.1] - Address CVE-2011-1004 'Symlink race condition by removing directory trees in fileutils module' * ruby-1.8.7-CVE-2011-1004.patch - Address CVE-2011-1005 'Untrusted codes able to modify arbitrary strings' * ruby-1.8.7-CVE-2011-1005.patch - Address CVE-2011-0188 'memory corruption in BigDecimal on 64bit platforms' * ruby-1.8.7-CVE-2011-0188.patch - Address CVE-CVE-2010-0541 'Ruby WEBrick javascript injection flaw' * ruby-1.8.7-CVE-2010-0541.patch - Address CVE-CVE-2009-4492 'ruby WEBrick log escape sequence' * ruby-1.8.6-CVE-2009-4492.patch - Resolves: rhbz#709957 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 avahi [0.6.16-10] - Fix for CVE-2011-1002 - Resolves: #684884 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 perl [4:5.8.8-32.el5.1] - third version of patch fix change of behaviour of rmtree for common user - Resolves: rhbz#597203 [4:5.8.8-32.el5] - rhbz#595416 change documentation of File::Path - Related: rhbz#591167 [4:5.8.8-31.el5] - remove previous fix - Related: rhbz#591167 [4:5.8.8-30.el5] - change config to file on Util.so - Related: rhbz#594406 [4:5.8.8-29.el5] - CVE-2008-5302 - use latest patch without Cwd module - 507378 because of our paths we need to overload old Util.so in case customer installed Scalar::Util from cpan. In this case we marked new Util.so as .rpmnew. - Related: rhbz#591167 - Resolves: rhbz#594406 [4:5.8.8-28.el5] - CVE-2008-5302 perl: File::Path rmtree race condition (CVE-2005-0448) reintroduced after upstream rebase to 5.8.8-1 - CVE-2010-1168 perl Safe: Intended restriction bypass via object references - CVE-2010-1447 Safe 2.26 and earlier: Intended restriction bypass via Perl object references in code executed outside safe compartment - Related: rhbz#591167 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-194.8.1.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb (John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524] - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [mm] Enahance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki, Chris Mason, Herbert van den Bergh) [orabug 9245919] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 python [2.4.3-43] - add missing patch 206 Related: rhbz#549372 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-194.32.1.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb (John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524] - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki, Chris Mason, Herbert van den Bergh) [orabug 9245919] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - make xenkbd.abs_pointer=1 by default (John Haxby) [orabug 67188919] - fix filp_close() race (Joe Jin) [orabug 10335998] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk [1:1.6.0.0-1.22.1.9.8.0.1.el5_6] - Add oracle-enterprise.patch [1:1.6.0.0-1.22.1.9.8] - Resolves: rhbz#668488 - Bumped to IcedTea6 1.9.8 - RH706250, S6213702, CVE-2011-0872: (so) non-blocking sockets with TCP urgent disabled get still selected for read ops (win) - RH706106, S6618658, CVE-2011-0865: Vulnerability in deserialization - RH706111, S7012520, CVE-2011-0815: Heap overflow vulnerability in FileDialog.show() - RH706139, S7013519, CVE-2011-0822, CVE-2011-0862: Integer overflows in 2D code - RH706153, S7013969, CVE-2011-0867: NetworkInterface.toString can reveal bindings - RH706234, S7013971, CVE-2011-0869: Vulnerability in SAAJ - RH706239, S7016340, CVE-2011-0870: Vulnerability in SAAJ - RH706241, S7016495, CVE-2011-0868: Crash in Java 2D transforming an image with scale close to zero - RH706248, S7020198, CVE-2011-0871: ImageIcon creates Component with null acc - RH706245, S7020373, CVE-2011-0864: JSR rewriting can overflow memory address size variables [1:1.6.0.0-1.22.1.9.7] - Resolves bz690289 - Import from RHEL-5_6-Z - Updated to IcedTea6 1.9.7 - Removed all plugin/webstart related commented lines - Modified bz entry format in previous logs to get around cvs ack checking bug Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 Oracle Linux 7 firefox [31.3.0-4.0.1] - Add firefox-oracle-default-prefs.js and firefox-oracle-default-bookmarks.html and remove the corresponding Red Hat ones [31.3.0-4] - Update to 31.3.0 ESR Build 2 - Fix for geolocation API (rhbz#1063739) [31.2.0-5] - splice workaround (rhbz#1150082) [31.2.0-4] - ppc build fix (rhbz#1151959) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 rsync [3.0.6-4] - fix #700450 - free parsed hostnames - fix #575022 - set TZ variable after chroot [3.0.6-3] - Add upstream patch to fix CVE-2011-1097 - Incremental file-list corruption due to temporary file_extra_cnt increments Resolves: #688923 [3.0.6-2] - Remove BuildRequires dependency on popt-devel, until the package is being shipped with RHEL-5 (resolve build issues) [3.0.6-1] - Rebase to upstream version 3.0.6 Resolves: #339971, #471182, #575022, #616093 - Make '-d, --dirs options' behaviour backward-compatible with 2.6.8 Resolves: #339971 (comment #5) - Truncate a copied sparse file at the end of transaction (-S, --sparse option) Resolves: #530866 - Add -fno-strict-aliasing to CFLAGS - Remove obsolete rsync-2.6.8-xattr_bug.patch - Switch license to GPLv3+ (upstream change beginning with 3.0.0) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 dbus [1:1.2.24-4] - Apply patch for CVE-2010-4352 - Resolves: #684852 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk [1:1.6.0.0-1.40.1.9.10] - Resolves: rhbz#744788 - Bumped to IcedTea6 1.9.8 -removed font copying Security fixes - S7000600, CVE-2011-3547: InputStream skip() information leak - S7019773, CVE-2011-3548: mutable static AWTKeyStroke.ctor - S7023640, CVE-2011-3551: Java2D TransformHelper integer overflow - S7032417, CVE-2011-3552: excessive default UDP socket limit under SecurityManager - S7046823, CVE-2011-3544: missing SecurityManager checks in scripting engine - S7055902, CVE-2011-3521: IIOP deserialization code execution - S7057857, CVE-2011-3554: insufficient pack200 JAR files uncompress error checks - S7064341, CVE-2011-3389: JSSE - S7070134, CVE-2011-3558: Hotspot unspecified issue - S7077466, CVE-2011-3556: RMI DGC server remote code execution - S7083012, CVE-2011-3557: RMI registry privileged code execution - S7096936, CVE-2011-3560: missing checkSetFactory calls in HttpsURLConnection NetX - PR794: javaws does not work if a Web Start app jar has a Class-Path element in the manifest Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 lftp [3.7.11-4.el5_5.3] - Related: CVE-2010-2251 - document change of xfer:clobber default value in manpage, respect xfer:clobber on with xfer:auto-rename on (old behaviour) [3.7.11-4.el5_5.2] - Related: CVE-2010-2251 - describe new option xfer:auto-rename which could restore old behaviour in manpage [3.7.11-4.el5_5.1] - Resolves: CVE-2010-2251 - multiple HTTP client download filename vulnerability (#617870) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm [kvm-83-164.0.1.el5_5.25] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-add-oracle-workaround-for-libvirt-bug.patch [kvm-83-164.el5_5.25] - Adding load_gs_index to kmod symbol greylist - Related: bz#639886 (CVE-2010-3698 kvm: invalid selector in fs/gs causes kernel panic [rhel-5.5.z]) [kvm-83-164.el5_5.24] - Updated kversion to 2.6.18-194.17.1.el5 to match build root - kvm.spec: fix ./configure arguments (ensure spice, kvm-cap-pit and kvm-cap-device-assignment are always enabled) - kvm-kernel-KVM-Fix-fs-gs-reload-oops-with-invalid-ldt.patch [bz#639886] - Resolves: bz#639886 (CVE-2010-3698 kvm: invalid selector in fs/gs causes kernel panic [rhel-5.5.z]) - CVE: CVE-2010-3698 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 mysql [5.0.77-4.3] - Add fixes for CVE-2010-1626, CVE-2010-1848, CVE-2010-1850 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 rpm [4.4.2.3-20.el5_5.1] - make the sbits removal behavior consistent with all the RHELs - add proper suffix for Z branch [4.4.2.3-19] - fix CVE-2010-2059, fails to drop SUID/SGID bits on package upgrade (#626707) - fix SELinux memory leak (#627630), patch from Florian Festi Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-200.23.1.el6uek] - net: Remove atmclip.h to prevent break kabi check. - KConfig: add CONFIG_UEK5=n to ol6/config-generic [2.6.32-200.22.1.el6uek] - ipv6: make fragment identifications less predictable (Joe Jin) {CVE-2011-2699} - vlan: fix panic when handling priority tagged frames (Joe Jin) {CVE-2011-3593} - ipv6: udp: fix the wrong headroom check (Maxim Uvarov) {CVE-2011-4326} - b43: allocate receive buffers big enough for max frame len + offset (Maxim Uvarov) {CVE-2011-3359} - fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message (Maxim Uvarov) {CVE-2011-3353} - cifs: fix possible memory corruption in CIFSFindNext (Maxim Uvarov) {CVE-2011-3191} - crypto: md5 - Add export support (Maxim Uvarov) {CVE-2011-2699} - fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops (Maxim Uvarov) {CVE-2011-1577} - block: use struct parsed_partitions *state universally in partition check code (Maxim Uvarov) - net: Compute protocol sequence numbers and fragment IDs using MD5. (Maxim Uvarov) {CVE-2011-3188} - crypto: Move md5_transform to lib/md5.c (Maxim Uvarov) {CVE-2011-3188} - perf tools: do not look at ./config for configuration (Maxim Uvarov) {CVE-2011-2905} - Make TASKSTATS require root access (Maxim Uvarov) {CVE-2011-2494} - TPM: Zero buffer after copying to userspace (Maxim Uvarov) {CVE-2011-1162} - TPM: Call tpm_transmit with correct size (Maxim Uvarov){CVE-2011-1161} - fnic: fix panic while booting in fnic(Xiaowei Hu) - Revert 'PCI hotplug: acpiphp: set current_state to D0 in register_slot' (Guru Anbalagane) - xen: drop xen_sched_clock in favour of using plain wallclock time (Jeremy Fitzhardinge) [2.6.32-200.21.1.el6uek] - PCI: Set device power state to PCI_D0 for device without native PM support (Ajaykumar Hotchandani) [orabug 13033435] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 NetworkManager dbus-glib NetworkManager: [1:0.7.0-10.el5_5.1] - Rebuild to fix D-Bus property access (for dbus-glib CVE-2010-1172) dbus-glib: [0.73-10] - Add patch to fix CVE-2010-1172 Drop broken-xml.patch which this one now incorporates Resolves: #588397 (and #585395) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 squid [7:2.6.STABLE21-6] - Resolves: #561828 - CVE-2009-2855 CVE-2010-0308 squid various flaws [rhel-5.5] [7:2.6.STABLE21-5] - Resolves: #538738 - improved patch [7:2.6.STABLE21-4] - Resolves: #521926 - squid 'stop after stop' is not LSB compliant - Resolves: #496170 - Add arp filter option - Resolves: #516245 - negotiate support not enabled in squid - Resolves: #538738 - Squid accelerator mode works only if port 80 is opened - Resolves: #470843 - Squid 'error_map' does not work when used 'Accep-Encoding: gzip' Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bind97 [32:9.7.0-21.P2.1] - Fix CVE-2014-8500 (#1171972) Sergey Artykhov DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 bind [32:9.7.3-2.3.P3] - fix DOS against recursive servers (#754398) [32:9.7.3-2.2.P3] - update to 9.7.3-P3 (CVE-2011-2464) [32:9.7.3-2.1.P1] - update to 9.7.3-P1 (CVE-2011-1910) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xulrunner [1.9.2.11-4.0.1.el5_5] - Added xulrunner-oracle-default-prefs.js and removed the corresponding RedHat one. [1.9.2.11-4.el5_5] - Add upstream patch for CVE-2010-3765 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 cups [1.3.7-18:.8] - Applied patch to fix cupsd memory corruption vulnerability (CVE-2010-2941, STR #3648, bug #624438). - Fix latent privilege escalation vulnerability (CVE-2010-2431, STR #3510, bug #605397). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 qt4 [4.2.1-1.1] - Resolves: #737815, qt/harfbuzz buffer overflow, CVE-2011-3193 - Resolves: #234633, UTF-8 overlong sequence decoding vulnerability, CVE-2007-0242 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 python [2.4.3-44] - add patch adapted from upstream (patch 208) to add support for building against system expat; add --with-system-expat to configure invocation; remove embedded copy of expat-1.95.8 from the source tree during prep - ensure pyexpat.so gets built by explicitly listing all C modules in the payload in %files, rather than using dynfiles Resolves: CVE-2009-3720 - backport three security fixes to 2.4 (patches 209, 210, 211): Resolves: CVE-2011-1521 Resolves: CVE-2011-1015 Resolves: CVE-2010-3493 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sysstat [7.0.2-11] - Related: #716959 fix cve-2007-3852 - sysstat insecure temporary file usage [7.0.2-10] - Resolves: #716959 fix cve-2007-3852 - sysstat insecure temporary file usage [7.0.2-9] - Related: #622557 sar interrupt count goes backward [7.0.2-8] - Resolves: #694767 iostat doesn't report statistics for shares with long names - Related: #703095 iostat -n - values in output overflows - problem with long device names on i386 [7.0.2-7] - Resolves: #706095 iostat -n - values in output overflows [7.0.2-6] - Resolves: #696672 cifsstat resource leak [7.0.2-5] - Resolves: #604637 extraneous newline in iostat report for long device names - Resolves: #630559 'sar -P ALL -f xxxx' does not display activity information - Resolves: #591530 add cifsiostat tool - Resolves: #598794 Enable parametrization of sadc arguments - Resolves: #675058 iostat: bogus value appears when device is unmounted/mounted - Resolves: #622557 sar interrupt count goes backward [7.0.2-4] - Resolves: #454617 Though function write() executed sucessful, sadc end with an error - Resolves: #468340 The output of sar -I ALL/XALL is wrong in ia64 machine of RHEL5 - Resolves: #517490 The 'sar -d ' command outputs invalid data - Resolves: #578929 March sar data was appended to February data - Resolves: #579409 The sysstat's programs such as mpstat shows one extra cpu - Resolves: #484439 iostat -n enhancement not report NFS client stats correctly Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk [1.6.0.0-1.36.b17] - removed plugin. How it comes in?! - Resolves: rhbz#676295 [1.6.0.0-1.33.b17] - bumped release number, it was accidentaly reduced, and now lower version then last one was released. - Resolves: rhbz#676295 [1.6.0.0-1.22.b17] - Updated to 1.7.9 tarball - removed patch6, fixed upstrream - Resolves: rhbz#676295 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-194.11.4.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb (John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524] - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki, Chris Mason, Herbert van den Bergh) [orabug 9245919] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] [2.6.18-194.11.4.el5] - [misc] make compat_alloc_user_space() incorporate the access_ok() (Don Howard) [634463 634464] {CVE-2010-3081} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel This update fixes the following security issues: * a race condition was found in the mac80211 implementation, a framework used for writing drivers for wireless devices. An attacker could trigger this flaw by sending a Delete Block ACK (DELBA) packet to a target system, resulting in a remote denial of service. Note: This issue only affected users on 802.11n networks, and that also use the iwlagn driver with Intel wireless hardware. (CVE-2009-4027, Important) * a flaw was found in the gfs2_lock() implementation. The GFS2 locking code could skip the lock operation for files that have the S_ISGID bit (set-group-ID on execution) in their mode set. A local, unprivileged user on a system that has a GFS2 file system mounted could use this flaw to cause a kernel panic. (CVE-2010-0727, Moderate) * a divide-by-zero flaw was found in the ext4 file system code. A local attacker could use this flaw to cause a denial of service by mounting a specially-crafted ext4 file system. (CVE-2009-4307, Low) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 libxml2 [2.6.26-2.1.25.0.1.el5_11] - Add libxml2-enterprise.patch - Replaced doc/redhat.gif in tarball with updated image [2.6.26-2.1.25.el5] - CVE-2014-3660 denial of service via recursive entity expansion (rhbz#1161841) [2.6.26-2.1.24.el5] - fixed one regexp bug and added a (rhbz#922450) - Another small change on the algorithm for the elimination of epsilon (rhbz#922450) [2.6.26-2.1.23.el5] - detect and stop excessive entities expansion upon replacement (rhbz#912573) [2.6.26-2.1.22.el5] - fix validation issues with some XSD (rhbz#877348) - xmlDOMWrapCloneNode discards namespace of the node parameter (rhbz#884707) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm [kvm-83-164.0.1.el5_5.21] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch [kvm-83-164.el5_5.21] - kvm-Fix-segfault-in-mmio-subpage-handling-code.patch [bz#619412] - Resolves: bz#619412 (CVE-2010-2784 qemu: insufficient constraints checking in exec.c:subpage_register() [rhel-5.5.z]) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gfs-kmod [0.1.34-12] - Fixes a problem where improper locking commands can crash the system. - Resolves: rhbz#571298 [0.1.34-11] - Fixes 'Resource tempory unavailable' for EWOULDBLOCK message with flocks on gfs file - Resolves: rhbz#515717 [0.1.34-10] - Fixes 'Resource tempory unavailable' for EWOULDBLOCK message with flocks on gfs file - Resolves: rhbz#515717 [0.1.34-9] - Change gfs freeze/unfreeze to use new standard - Resolves: rhbz#487610 [0.1.34-8] - Fixes problem that produces this error message: fatal: assertion 'gfs_glock_is_locked_by_me(gl) && gfs_glock_is_held_excl(gl)' failed - Resolves: rhbz#471258 [0.1.34-7] - GFS kernel panic, suid + nfsd with posix ACLs enabled - Resolves: rhbz#513885 [0.1.34-5] - GFS: New mount option: -o errors=withdraw|panic - Resolves: rhbz#517145 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 libvirt [0.8.2-22.0.1.el5] - Replaced docs/et.png in tarball [libvirt-0.8.2-22.el5] - Fix auditing of disk hotunplug operations (rhbz#710151) [libvirt-0.8.2-21.el5] - remote: Protect against integer overflow (rhbz#717207) [0.8.2-20.el5] - Support enabling or disabling the HPET for Xen domains (rhbz#703193) - SMBIOS support (rhbz#661365) [0.8.2-19.el5] - xen: Plug memory leak in multiple serial ports support (rhbz#670789) - Manually kill gzip if restore fails before starting qemu (rhbz#681623) - qemu: Avoid double close on domain restore (rhbz#681623) - virterror: Avoid API breakage with vmware (rhbz#665075) - nwfilter: Resolve deadlock between VM ops and filter update (rhbz#697749) [0.8.2-18.el5] - xen: Prevent updating device when attaching a device (rhbz#662908) - Add PCI sysfs reset access (rhbz#689880) - xencapstest: Don't fail when Xen is installed (rhbz#690459) - Make error reporting in libvirtd thread safe (rhbz#690733) [0.8.2-17.el5] - Fix event-handling data race (rhbz#671569) - Add support for multiple serial ports into the Xen driver (rhbz#670789) - Add missing checks for read only connections (CVE-2011-1146) - Guess rhel macro based on dist macro (rhbz#665325) [0.8.2-16.el5] - Fix possible crash in virExec (rhbz#665549) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 libpng [2:1.2.10-7.1.el5_7.5] - Install the correct fix for CVE-2011-2690 Resolves: #721303 [2:1.2.10-7.1.el5_7.4] - Back-port fixes for CVE-2011-2690, CVE-2011-2692 Note: CVE-2011-2691, announced at the same time, does not apply to 1.2.10; likewise for CVE-2011-2501 Resolves: #721303 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 cups [1:1.3.7-11:.6] - Applied patch for CVE-2010-0302 (incomplete fix for CVE-2009-3553, bug #557775). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel [2.6.18-194.17.1.0.2.el5] - [rds] fix access issue with rds (Chris Mason) {CVE-2010-3904} [orabug 10226701] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 xorg-x11-server-utils [7.4-15.el6_0.1] - cve-2011-0465: Sanitize cpp macro expansion. (CVE 2011-0465) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 krb5 [1.6.1-36.el5_5.3] - add upstream patch to fix a few use-after-free bugs, including one in kadmind (CVE-2010-0629, #578185) [1.6.1-36.el5_5.2] - pull changes to libkrb5 to properly handle and chase off-path referrals back from 1.7 (#574387) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bind [30:9.3.6-4.P1.2] - NSEC validation code could cause wrong NXDOMAIN responses (#554851, CVE-2010-0097) - improve fix for CVE-2009-4022 (#538744) - {C,D}NAMEs could be returned to clients without proper DNSSEC validation - don't validate + cache out-of-bailiwick data returned with a secure answer. Refetch it instead. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-100.28.11.el6] - fs/partitions: Validate map_count in Mac partition tables {CVE-2011-1010} - nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab (v3) {CVE-2011-1090} [2.6.32-100.28.10.el6] - Use cciss for some Smart Array controller for OL5 [orabug 11899706] - CVEs from RHSA-2011-0421 - install_special_mapping skips security_file_mmap check {CVE-2010-4346} - orinoco: fix TKIP countermeasure behaviour {CVE-2010-4648} - net: clear heap allocation for ethtool_get_regs() {CVE-2010-4655} - usb: iowarrior: don't trust report_size for buffer size {CVE-2010-4656} - [media] [v3,media] av7110: check for negative array offset {CVE-2011-0521} - RDMA/cma: Fix crash in request handlers {CVE-2011-0695} - IB/cm: Bump reference count on cm_id before invoking callback {CVE-2011-0695} - gro: reset skb_iif on reuse {CVE-2011-1478} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-100.28.15.el6] - sctp: fix to calc the INIT/INIT-ACK chunk length correctly is set {CVE-2011-1573} - dccp: fix oops on Reset after close {CVE-2011-1093} - bridge: netfilter: fix information leak {CVE-2011-1080} - Bluetooth: bnep: fix buffer overflow {CVE-2011-1079} - net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules {CVE-2011-1019} - ipip: add module alias for tunl0 tunnel device - gre: add module alias for gre0 tunnel device - drm/radeon/kms: check AA resolve registers on r300 {CVE-2011-1016} - drm/radeon: fix regression with AA resolve checking {CVE-2011-1016} - drm: fix unsigned vs signed comparison issue in modeset ctl ioctl {CVE-2011-1013} - proc: protect mm start_code/end_code in /proc/pid/stat {CVE-2011-0726} - ALSA: caiaq - Fix possible string-buffer overflow {CVE-2011-0712} - xfs: zero proper structure size for geometry calls {CVE-2011-0711} - xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 {CVE-2011-0711} - ima: fix add LSM rule bug {CVE-2011-0006} - IB/uverbs: Handle large number of entries in poll CQ {CVE-2010-4649, CVE-2011-1044} - CAN: Use inode instead of kernel address for /proc file {CVE-2010-4565} [2.6.32-100.28.14.el6] - IB/qib: fix qib compile warning. - IB/core: Allow device-specific per-port sysfs files. - dm crypt: add plain64 iv. - firmware: add firmware for qib. - Infiniband: Add QLogic PCIe QLE InfiniBand host channel adapters support. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sudo [1.7.2p1-6] - added second patch for CVE-2010-0426 (#580441) Resolves: #580525 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 bind97 bind [32:9.7.3-2.2.P3] - update to 9.7.3-P3 (CVE-2011-2464) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 hplip hplip3 [3.9.8-33:.1] - Applied patch to fix CVE-2010-4267, remote stack overflow vulnerability (bug #662740). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 libvirt [0.8.2-15.0.1.el5_6.4] - Replaced docs/et.png in tarball [0.8.2-15.el5_6.4] - Make error reporting in libvirtd thread safe (CVE-2011-1486) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 cpio [2.6-23.1] - CVE-2010-0624 fix heap-based buffer overflow by expanding a specially-crafted archive - CVE-2007-4476 fix stack crashing in safer_name_suffix Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 nss_db [2.2-35.4] - import Kees Cook's patch to fix accidental leakage of part of ./DB_CONFIG (#580542, CVE-2010-0826) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-400] - [net] bridge: disable snooping if there is no querier (Frantisek Hrbata) [902454] - [s390] kernel: sysinfo: convert /proc/sysinfo to seqfile (Alexander Gordeev) [1131283] - [net] netlink: verify permisions of socket creator (Jiri Benc) [1094266] {CVE-2014-0181} - [net] netlink: store effective caps at socket() time (Jiri Benc) [1094266] {CVE-2014-0181} - [net] netlink: Rename netlink_capable netlink_allowed (Jiri Benc) [1094266] {CVE-2014-0181} - [net] netlink: Fix permission check in netlink_connect() (Jiri Benc) [1094266] {CVE-2014-0181} - [net] netlink: fix possible spoofing from non-root processes (Jiri Benc) [1094266] {CVE-2014-0181} - [net] netlink: Make NETLINK_USERSOCK work again (Jiri Benc) [1094266] {CVE-2014-0181} - [net] netlink: fix for too early rmmod (Jiri Benc) [1094266] {CVE-2014-0181} [2.6.18-399] - [kernel] do_setitimer: cancel real_timer if try_to_cancel fails (Oleg Nesterov) [1134654] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 brltty [3.7.2-4] - use rpm macros more consistently - add manual page for brltty.conf - add more documentation - install the default brltty-pm.conf to docdir only - Resolves: #530554 - silence the postinstall scriptlet - Resolves: #529163 [3.7.2-3] - escape rpm macros in the rpm change log - remove bogus rpath from libbrlttybba.so (CVE-2008-3279, #457942) - add dependencies to bind the subpackages from one build together [3.7.2-2] - fix building with newer kernel-headers (#456247) - do not strip debug info during install (#500545) - Resolves: rhbz #456247 #500545 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 httpd [2.2.3-43.0.1.el5_5.3 ] - replace index.html with Oracle's index page oracle_index.html - update vstring and distro in specfile [2.2.3-43.3] - mod_ssl: improved fix for SSLRequire's OID() function (#625452) [2.2.3-43.2] - add security fixes for CVE-2010-1452, CVE-2010-2791 (#623210) - mod_deflate: rebase to 2.2.15 (#625435) - stop multiple invocations of filter init functions (#625451) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek [2.6.32-400.36.11uek] - net: sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann) [Orabug: 20010592] {CVE-2014-3687} - net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann) [Orabug: 20010579] {CVE-2014-3673} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 poppler [0.5.4-4.4.el5_5.14] - Add poppler-0.5.4-CVE-2010-3702.patch (Properly initialize parser) - Add poppler-0.5.4-CVE-2010-3704.patch (Fix crash in broken pdf (code < 0)) - Resolves: #639839 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 postgresql [8.1.21-1.el5_5.1] - Update to PostgreSQL 8.1.21 to fix CVE-2010-1169, CVE-2010-1170, CVE-2009-4136, CVE-2010-0733, CVE-2010-0442, and assorted other bugs described at http://www.postgresql.org/docs/8.1/static/release.html Resolves: #586058 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk [1.6.0.0-1.39.b17] - respin of IcedTea6 1.7.10 - Resolves: rhbz#676276 [1.6.0.0-1.37.b17] - Updated to IcedTea6 1.7.10 - Resolves: rhbz#676276 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gimp [2:2.2.13-2.0.7.2] - fix various overflows (#537356, #666793, #689831, #703403, #703405, #703407, - unfuzz gimphelpmissing, icontheme patches Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-100.28.9.el6] - sync up the version [2.6.32-100.28.8.el6] - [block] check for proper length of iov entries earlier in blk_rq_map_user_iov (Xiaotian Feng) {CVE-2010-4668} - scm: lower SCM_MAX_FD (Eric Dumazet) {CVE-2010-4249} - perf_events: Fix perf_counter_mmap() hook in mprotect() (Pekka Enberg) {CVE-2010-4169} - tcp: Increase TCP_MAXSEG socket option minimum (David S. Miller) {CVE-2010-4165} - Enable module force load option [orabug 11782146] - Enable vmw balloon and pvscsi (Guru Anbalagane) [orabug 11697522] [2.6.32-100.28.7.el6] - build from git [2.6.32-100.28.6.el6] - Remove crashkernel option if it is present [bug 11714928] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 tomcat5 [0:5.5.23-0jpp.22] - Resolves: CVE-2011-0013 rhbz 675931 - Resolves: CVE-2010-3718 rhbz 675931 - Resolves: CVE-2011-1184 rhbz 744983 - Resolves: CVE-2011-2204 rhbz 719181 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 tomcat5 [0:5.5.23-0jpp.9] - Resolves: rhbz#619424 fixed servlet-api typo. serve4-api to servlet-api - RHSA-2010:9748 [0:5.5.23-0jpp.8] - Patches backported from RHEL-5 tomcat5-5.5.23-0jpp.10.el5 - Updated init script for LSB compliance, catalina.log permissions - Resolves: CVE-2009-2693, CVE-2009-2902, CVE-2010-2227 - CVE_2010-0781 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers mlnx_en kernel-uek [2.6.32-300.4.1.el6uek] - [pci] intel-iommu: Default to non-coherent for domains unattached to iommus (Joe Jin) - [dm] do not forward ioctls from logical volumes to the underlying device (Joe Jin) {CVE-2011-4127} - [block] fail SCSI passthrough ioctls on partition devices (Joe Jin) {CVE-2011-4127} - [block] add and use scsi_blk_cmd_ioctl (Joe Jin) {CVE-2011-4127} - [net] gro: reset vlan_tci on reuse (Dan Carpenter) {CVE-2011-1576} - [net] rose: Add length checks to CALL_REQUEST parsing (Ben Hutchings) {CVE-2011-1493} - [net] rose_loopback_timer sets VC number <= ROSE_DEFAULT_MAXVC (Bernard Pidoux F6BVP) {CVE-2011-1493} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 automake automake14 automake15 automake16 automake17 [1.9.6-2.3] - increase delay in self checks - add delays in aclocal7 self check http://osdir.com/ml/sysutils.automake.bugs/2006-09/msg00012.html - preserve timestamps of configure files [1.9.6-2.2] - add fix for CVE-2009-4029 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm A flaw was found in the way QEMU-KVM handled erroneous data provided by the Linux virtio-net driver, used by guest operating systems. Due to a deficiency in the TSO (TCP segment offloading) implementation, a guest's virtio-net driver would transmit improper data to a certain QEMU-KVM process on the host, causing the guest to crash. A remote attacker could use this flaw to send specially-crafted data to a target guest system, causing that guest to crash. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 qspice [0.3.0-54.el5_5.2] - Fix unsafe accesses + spice: drop libpng from windows components (537849) + libspice: fix unsafe guest data accessing Resolves: #568719 + fix unsafe free() call. Resolves: #568723 + spice server: fix unsafe cursor items handling. Resolves: #568719 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 tomcat5 [0:5.5.23-0jpp.17] - Resolves: rhbz 674599 JDK Double.parseDouble DoS Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 ecryptfs-utils [82-6.3] - do not forget to set the group id in mount.ecryptfs_private [82-6.2] - fix regression in ecryptfs-setup-private [82-6.1] - security fixes: - privilege escalation via mountpoint race conditions (CVE-2011-1831, CVE-2011-1832) - race condition when checking source during mount (CVE-2011-1833) - mtab corruption via improper handling (CVE-2011-1834) - key poisoning via insecure temp directory handling (CVE-2011-1835) - arbitrary file overwrite via lock counter race (CVE-2011-1837) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 pam [0.99.6.2-6.2] - fix insecure dropping of priviledges in pam_xauth and pam_mail - CVE-2010-3316 (#637898), CVE-2010-3435 (#641335) - fix insecure executing of scripts with user supplied environment variables in pam_namespace - CVE-2010-3853 (#643043) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xen [3.0.3-132.el5_7.2] - Release device backends before restarting guest on the destination machine (rhbz 743850) - Fix SCSI buffer overflow and disable SCSI CD-ROMs (rhbz 736289) [3.0.3-132.el5_7.1] - hotplug: set netback/tap MTU to the same value as the bridge MTU (rhbz 738608) - copy the MTU of the physical interface to the Xen bridge (rhbz 738610) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ImageMagick [6.2.8.0-4.el5_5.2] - Fix SGI image decoding (625058) [6.2.8.0-4.el5_5.1] - Add fix for CVE-2009-1882 (504304) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc [2.5-65.el5_7.3] - Use correct type when casting d_tag (#767687) - Report write error in addmnt even for cached streams (#767687) - ldd: Never run file directly (#767687). - Workaround misconfigured system (#767687) [2.5-65.el5_7.2] - Check values from TZ file header (#767687) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 libxml2 [2.6.26-2.1.12.0.1.el5_7.2] - Add libxml2-enterprise.patch - Replaced docs/redhat.gif in tarball with updated image [2.6.26-2.1.12.el5_7.2] - Fix the semantic of XPath axis for namespace/attribute nodes CVE-2010-4008 - Fix an off by one error in encoding CVE-2011-0216 - Fix some potential problems on reallocation failures CVE-2011-1944 - Fix missing error status in XPath evaluation CVE-2011-2834 - Make sure the parser returns when getting a Stop order CVE-2011-3905 - Fix an allocation error when copying entities CVE-2011-3919.patch - Resolves: rhbz#771906 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 mysql [5.0.95-1.el5_7.1] - Update to 5.0.95, to get the last upstream bugfixes in this release series including numerous CVEs announced in January 2012 Resolves: #787140 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc [2.5-58.el5_6.2] - Avoid too much stack use in fnmatch (#681054, CVE-2011-1071) - Properly quote output of locale (#625893, CVE-2011-1095) - Don't leave empty element in rpath when skipping the first element, ignore rpath elements containing non-isolated use of when privileged (#667974, CVE-2011-0536) - Fix handling of newline in addmntent (#559579, CVE-2010-0296) [2.5-58.el5_6.1] - Don't ignore in libraries (#682991) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-300.3.1.el6uek] - proc: fix oops on invalid /proc/<pid>/maps access (Linux Torvalds) - Revert 'capabilities: do not grant full privs for setuid w/ file caps + no effective caps' (Joe Jin) - [mm]: Use MMF_COMPAT instead ia32_compat to prevent kabi be broken (Joe Jin) - proc: enable writing to /proc/pid/mem (Stephen Wilson) - proc: make check_mem_permission() return an mm_struct on success (Stephen Wilson) - proc: hold cred_guard_mutex in check_mem_permission() (Joe Jin) - proc: disable mem_write after exec (Stephen Wilson) - mm: implement access_remote_vm (Stephen Wilson) - mm: factor out main logic of access_process_vm (Stephen Wilson) - mm: use mm_struct to resolve gate vma's in __get_user_pages (Stephen Wilson) - mm: arch: rename in_gate_area_no_task to in_gate_area_no_mm (Stephen Wilson) - mm: arch: make in_gate_area take an mm_struct instead of a task_struct (Stephen Wilson) - mm: arch: make get_gate_vma take an mm_struct instead of a task_struct (Stephen Wilson) - x86: mark associated mm when running a task in 32 bit compatibility mode (Stephen Wilson) - x86: add context tag to mark mm when running a task in 32-bit compatibility mode (Stephen Wilson) - auxv: require the target to be tracable (or yourself) (Al Viro) - close race in /proc/*/environ (Al Viro) - report errors in /proc/*/*map* sanely (Al Viro) - pagemap: close races with suid execve (Al Viro) - make sessionid permissions in /proc/*/task/* match those in /proc/* (Al Viro) - Revert 'report errors in /proc/*/*map* sanely' (Joe Jin) - Revert 'proc: fix oops on invalid /proc/<pid>/maps access' (Joe Jin) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-300.11.1.el6uek] - [fs] xfs: Fix possible memory corruption in xfs_readlink (Carlos Maiolino) {CVE-2011-4077} - [scsi] increase qla2xxx firmware ready time-out (Joe Jin) - [scsi] qla2xxx: Module parameter to control use of async or sync port login (Joe Jin) - [net] tg3: Fix single-vector MSI-X code (Joe Jin) - [net] qlge: fix size of external list for TX address descriptors (Joe Jin) - [net] e1000e: Avoid wrong check on TX hang (Joe Jin) - crypto: ghash - Avoid null pointer dereference if no key is set (Nick Bowler) {CVE-2011-4081} - jbd/jbd2: validate sb->s_first in journal_get_superblock() (Eryu Guan) {CVE-2011-4132} - KVM: Device assignment permission checks (Joe Jin) {CVE-2011-4347} - KVM: x86: Prevent starting PIT timers in the absence of irqchip support (Jan Kiszka) {CVE-2011-4622} - xfs: validate acl count (Joe Jin) {CVE-2012-0038} - KVM: x86: fix missing checks in syscall emulation (Joe Jin) {CVE-2012-0045} - KVM: x86: extend 'struct x86_emulate_ops' with 'get_cpuid' (Joe Jin) {CVE-2012-0045} - igmp: Avoid zero delay when receiving odd mixture of IGMP queries (Ben Hutchings) {CVE-2012-0207} - ipv4: correct IGMP behavior on v3 query during v2-compatibility mode (David Stevens) - fuse: fix fuse request unique id (Srinivas Eeda) [orabug 13816349] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel [2.6.18-308.4.1.el5] - [net] ipv6: fix skb double free in xfrm6_tunnel (Jiri Benc) [752305 743375] {CVE-2012-1583} [2.6.18-308.3.1.el5] - [net] be2net: cancel be_worker during EEH recovery (Ivan Vecera) [805462 773735] - [net] be2net: add vlan/rx-mode/flow-control config to be_setup (Ivan Vecera) [805462 773735] - [x86] disable TSC synchronization when using kvmclock (Marcelo Tosatti) [805460 799170] - [fs] vfs: fix LOOKUP_DIRECTORY not propagated to managed_dentry (Ian Kent) [801726 798809] - [fs] vfs: fix d_instantiate_unique (Ian Kent) [801726 798809] - [fs] nfs: allow high priority COMMITs to bypass inode commit lock (Jeff Layton) [799941 773777] - [fs] nfs: don't skip COMMITs if system under is mem pressure (Jeff Layton) [799941 773777] - [scsi] qla2xxx: Read the HCCR register to flush any PCIe writes (Chad Dupuis) [798748 772192] - [scsi] qla2xxx: Complete mbox cmd timeout before next reset cycle (Chad Dupuis) [798748 772192] - [s390] qdio: wrong buffers-used counter for ERROR buffers (Hendrik Brueckner) [801724 790840] - [net] bridge: Reset IPCB when entering IP stack (Herbert Xu) [804721 749813] - [fs] procfs: add hidepid= and gid= mount options (Jerome Marchand) [770649 770650] - [fs] procfs: parse mount options (Jerome Marchand) [770649 770650] [2.6.18-308.2.1.el5] - [fs] nfs: nfs_fhget should wait on I_NEW instead of I_LOCK (Sachin Prabhu) [795664 785062] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm [kvm-83-105.0.1.el5_4.22] - Add kvm-add-oracle-workaround-for-libvirt-bug.patch Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xen [3.0.3-135.el5_8.2] - Fix broken timestamp log (rhbz 797836) [3.0.3-135.el5_8.1] - qemu-dm/e1000: bounds packet size against buffer size (rhbz 786862) - Use correct expansion in xen-network-common.sh (rhbz 797191) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-100.37.1.el6uek] - [net] gre: fix netns vs proto registration ordering {CVE-2011-1767} - [net] tunnels: fix netns vs proto registration ordering {CVE-2011-1768} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 devhelp esc firefox gnome-python2-extras totem xulrunner yelp Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1121, CVE-2010-1200, CVE-2010-1202, CVE-2010-1203) A flaw was found in the way browser plug-ins interact. It was possible for a plug-in to reference the freed memory from a different plug-in, resulting in the execution of arbitrary code with the privileges of the user running Firefox. (CVE-2010-1198) Several integer overflow flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2010-1196, CVE-2010-1199) A focus stealing flaw was found in the way Firefox handled focus changes. A malicious website could use this flaw to steal sensitive data from a user, such as usernames and passwords. (CVE-2010-1125) A flaw was found in the way Firefox handled the "Content-Disposition: attachment" HTTP header when the "Content-Type: multipart" HTTP header was also present. A website that allows arbitrary uploads and relies on the "Content-Disposition: attachment" HTTP header to prevent content from being displayed inline, could be used by an attacker to serve malicious content to users. (CVE-2010-1197) A flaw was found in the Firefox Math.random() function. This function could be used to identify a browsing session and track a user across different websites. (CVE-2008-5913) A flaw was found in the Firefox XML document loading security checks. Certain security checks were not being called when an XML document was loaded. This could possibly be leveraged later by an attacker to load certain resources that violate the security policies of the browser or its add-ons. Note that this issue cannot be exploited by only loading an XML document. (CVE-2010-0182) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gnutls [1.4.1-7.2] - fix CVE-2011-4128 - buffer overflow in gnutls_session_get_data() (#752308) - fix CVE-2012-1569 - missing length check when decoding DER lengths (#804920) - fix CVE-2012-1573 - security issue in packet parsing (#805432) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bind97 [32:9.7.0-6.P2.4] - fix DOS against recursive servers (#754398) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 krb5 [1.6.1-70.el5] - add upstream patch for telnetd buffer overflow (CVE-2011-4862, #770351) [1.6.1-69.el5] - ftp: fix a static analysis should-never-happen NULL dereference (#750823) [1.6.1-68.el5] - backport fixes to teach libkrb5 to use descriptors higher than FD_SETSIZE to talk to a KDC by using poll() if it's detected at compile-time, revised (#701444, RT#6905) [1.6.1-67.el5] - add backported patch by way of jbarbuc to free subkeys created by the KDC while processing TGS requests (#708516) [1.6.1-66.el5] - add backported patch by way of several people to better avoid false detection of replay attacks when talking to systems with coarse time resolution (#713500) [1.6.1-65.el5] - ftpd: add backported patch to check for errors when calling setegid (MITKRB5-SA-2011-005, CVE-2011-1526, #719098) [1.6.1-64.el5] - klist: don't trip over referral entries when invoked with -s (#729067, RT#6915) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-194.11.3.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb (John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524] - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki, Chris Mason, Herbert van den Bergh) [orabug 9245919] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] [2.6.18-194.11.3.el5] - [mm] accept an abutting stack segment (Jiri Pirko) [607857 607858] {CVE-2010-2240} [2.6.18-194.11.2.el5] - [mm] pass correct mm when growing stack (Jiri Pirko) [607857 607858] {CVE-2010-2240} - [mm] fix up some user-visible effects of stack guard page (Jiri Pirko) [607857 607858] {CVE-2010-2240} - [mm] fix page table unmap for stack guard page properly (Jiri Pirko) [607857 607858] {CVE-2010-2240} - [mm] fix missing unmap for stack guard page failure case (Jiri Pirko) [607857 607858] {CVE-2010-2240} - [mm] keep a guard page below a grow-down stack segment (Jiri Pirko) [607857 607858] {CVE-2010-2240} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-274.17.1.0.1.el5] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [scsi] add additional scsi medium error handling (John Sobecki) [orabug 12904887] - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - bonding: reread information about speed and duplex when interface goes up (John Haxby) [orabug 11890822] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [aio] patch removes limit on number of retries (Srinivas Eeda) [orabug 10044782] - [loop] Do not call loop_unplug for not configured loop device (orabug 10314497) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 samba [3.0.33-3.37.el5] - Regenerate manpage for 'wide links' and 'unix extensions' sections - related: #722553 [3.0.33-3.36.el5] - Security Release, fixes CVE-2010-0926 - resolves: #722553 [3.0.33-3.35.el5] - Fix smbclient return code - resolves: #768908 [3.0.33-3.34.el5] - Fix support for Windows 2008 R2 domains - resolves: #736124 [3.0.33-3.33.el5] - Security Release, fixes CVE-2010-0547, CVE-2010-0787, CVE-2011-2694, CVE-2011-2522, CVE-2011-1678, CVE-2011-2724 - resolves: #722553 [3.0.33-3.32.el5] - Security Release, fixes CVE-2011-0719 - resolves: #678331 [3.0.33-3.30.el5] - Security Release, fixes CVE-2010-3069 - resolves: #632230 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gnutls [1.4.1-3.8] - fix safe renegotiation on SSL3 protocol [1.4.1-3.7] - implement safe renegotiation - CVE-2009-3555 (#533125) - do not allow MD2 in certificate signatures by default - CVE-2009-2409 (#510197) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm [kvm-83-239.0.1.el5_7.1] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch [kvm-83-239.el5_7.1] - kvm-e1000-prevent-buffer-overflow-when-processing-legacy.patch [bz#772079] - Resolves: bz#772079 (EMBARGOED CVE-2012-0029 qemu-kvm: e1000: process_tx_desc legacy mode packets heap overflow [rhel-5.7.z]) - kvm-Fix-external-module-compat.c-not-to-use-unsupported-.patch [bz#753860] (build fix) - kvm-kernel-KVM-x86-Prevent-starting-PIT-timers-in-the-absence-o.patch [bz#770100] - Resolves: bz#770100 (CVE-2011-4622 kernel: kvm: pit timer with no irqchip crashes the system [rhel-5.7.z]) [kvm-83-239.el5_7.1] - Updated kversion to 2.6.18-274.17.1.el5 to match build root Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel A flaw was found in the way the Linux kernel's Event Poll (epoll) subsystem handled large, nested epoll structures. A local, unprivileged user could use this flaw to cause a denial of service. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 perl-DBD-Pg [2.15.1-4] - Resolves: rhbz#841131 (CVE-2012-1151) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-194.17.1.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb (John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524] - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki, Chris Mason, Herbert van den Bergh) [orabug 9245919] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libxml2 [2.7.6-4.0.1.el6_2.4] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.7.6-4.el6_2.4] - remove chunk in patch related to configure.in as it breaks rebuild - Resolves: rhbz#788845 [2.7.6-4.el6_2.3] - fix previous build to force compilation of randomization code - Resolves: rhbz#788845 [2.7.6-4.el6_2.2] - adds randomization to hash and dict structures CVE-2012-0841 - Resolves: rhbz#788845 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bind97 [32:9.7.0-10.P2.1] - fix CVE-2012-1667 and CVE-2012-1033 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-238.19.1.0.1.el5] - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - bonding: reread information about speed and duplex when interface goes up (John Haxby) [orabug 11890822] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - fix missing aio_complete() in end_io (Joel Becker) [orabug 10365195] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [nfs] too many getattr and access calls after direct I/O [orabug 9348191] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [aio] patch removes limit on number of retries (Srinivas Eeda) [orabug 10044782] - [loop] Do not call loop_unplug for not configured loop device (orabug 10314497) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [10.0.6-1.0.1.el6_3] - Replace firefox-redhat-default-prefs.js with firefox-oracle-default-prefs.js [10.0.6-1] - Update to 10.0.6 ESR [10.0.5-3] - Enabled WebM [10.0.5-2] - Added fix for mozbz#703633, rhbz#818341 xulrunner [10.0.6-1.0.1.el6_3] - Replace xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.6-1] - Update to 10.0.6 ESR [10.0.5-3] - Added fix for rhbz#808136 (mozbz#762301) [10.0.5-2] - Enabled WebM (rhbz#798880) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kexec-tools [1.102pre-154.0.3] - mkdumprd.orig get packed, remove it. [1.102pre-154.0.2] - fix mounting root fs on labeled disk (Maxim Uvarov) [orabug: 13709374] [1.102pre-154.0.1] Merge following patches from mkinitrd: - mkinitrd-fix-san-boot.patch - mkinitrd-fix-shared-lib-library-path.patch - mkinitrd-5.1.19.6-libfirmware-subdir-include.patch - mkinitrd-fix-setquiet-for-non-verbose.patch - add-option-to-forceload-multipath.patch - Update kexec-kdump-howto.txt with Oracle references - Add mkdumprd load firmware support [orabug 10432768] - Updated makedumpfile to el6 version (Herbert van den Bergh) [orabug 10088607] - Merged UEK modification,Updated Source1 kdump.init Added --allow-missing for rebuilding kdump_initrd - Updated kexec-kdump-howto.txt with Oracle references Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libtiff [3.9.4-6] - Add fixes for CVE-2012-2088, CVE-2012-2113 Resolves: #835748 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 freetype [2.3.11-6.el6_2.9] - Fix CVE-2012-{1126, 1127, 1130, 1131, 1132, 1134, 1136, 1137, 1139, 1140, 1141, 1142, 1143, 1144} - Properly initialize array 'result' in FT_Outline_Get_Orientation() - Check bytes per row for overflow in _bdf_parse_glyphs() - Resolves: #806268 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php53 [5.3.3-1.1] - add security fixes for CVE-2010-3710, CVE-2010-4156, CVE-2010-4645 (#670463) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 postgresql [8.1.23-4] - Back-port upstream fixes for CVE-2012-0866 and CVE-2012-0868 Resolves: #812070 [8.1.23-3] - Back-port upstream fix for unregistering OpenSSL callbacks at close Resolves: #728828 [8.1.23-2] - Back-port upstream fix for CVE-2011-2483 Resolves: #740738 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sendmail [8.13.8-8] - rpm attributes S,5,T not recorded for statistics file [8.13.8-7] - fix specfile for passing rpm -V test (#555277) [8.13.8-6.el5] - fix verification of SSL certificate with NUL in name (#553618, CVE-2009-4565) - do not accept localhost.localdomain as valid address from smtp (#449391) - skip colon separator when parsing service name in ServiceSwitchFile (#512871) - exit with non-zero error code when free space is low (#299951) - fix -qG description in man page (#250552) - fix comments in sendmail.mc to use correct certs path (#244012) - add MTA to provides (#494408) - fix %dist macro use (#440616) - compile with -fno-strict-aliasing - skip t-sem test as it doesn't allow parallel testing Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc [2.5-81.el5_8.4] - Fix iconv() segfault if the invalid multibyte character 0xffff is input when converting from IBM930 (#837896) [2.5-81.el5_8.3] - Fix unbound alloca in vfprintf (#833720) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xen [3.0.3-135.el5_8.4] - pygrub: Improve handling of big files (rhbz 821704) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers mlnx_en [2.6.32-300.7.1.el6uek] - Revert "proc: enable writing to /proc/pid/mem" [orabug 13619701] {CVE-2012-0056} - [PATCH] x86, tsc: Skip TSC synchronization checks for tsc=reliable (Suresh Siddha) [2.6.32-300.6.1.el6uek] - tracing: Fix null pointer deref with SEND_SIG_FORCED (Oleg Nesterov) [orabug 13611655] [2.6.32-300.5.1.el6uek] - sched, x86: Avoid unnecessary overflow in sched_clock (Salman Qazi) [orabug 13604567] - [x86]: Don't resume/restore cpu if not of the expected cpu (Joe Jin) [orabug 13492670] - drm/i915: Rephrase pwrite bounds checking to avoid any potential overflow (Chris Wilson) [CVE-2010-296] - x2apic: Enable the bios request for x2apic optout (Suresh Siddha) [orabug 13565303] - fuse: split queues to scale I/O throughput (Srinivas Eeda) [orabug 10004611] - fuse: break fc spinlock (Srinivas Eeda) [orabug 10004611] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 bind97 bind [32:9.7.3-2.1.P1] - update to 9.7.3-P1 (CVE-2011-1910) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc [2.5-81.el5_8.1] - Add dist tag [when building file lists (#784646).] - Avoid nargs integer overflow which could be used to bypass FORTIFY_SOURCE (#794813) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sssd [1.5.1-37] - Reverts: rhbz#680443 - Dynamic DNS update fails if multiple servers are - given in ipa_server config option Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [10.0.11-1.0.1.el6_3] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat ones [10.0.11-1] - Update to 10.0.11 ESR xulrunner [10.0.11-1.0.1.el6_3] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.11-1] - Update to 10.0.11 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel [2.6.18-308.4.1.0.1.el5] - [net] bonding: fix carrier detect when bond is down [orabug 12377284] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 bind [32:9.7.3-8.P3.3] - fix CVE-2012-1667 and CVE-2012-1033 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel [2.6.18-308.8.1.0.1.el5] - [net] bonding: fix carrier detect when bond is down [orabug 12377284] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 tetex [3.0-33.15.el5_9.1] - more robust fix for CVE-2010-3702 (#773178) [3.0-33.15] - apply patch for CVE-2010-3702,3704 (#773180) [3.0-33.14] - fix CVE-2010-2642 CVE-2011-0433 CVE-2011-0764 CVE-2011-1552 CVE-2011-1553 CVE-2011-1554, texlive various flaws (#773180) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 xulrunner [1.9.2.26-2.0.1.el6_2] - Replace xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [1.9.2.26-2] - added fix for mozbz#727401 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 samba3x [3.5.10-0.108] - Security Release, fixes CVE-2012-1182 - resolves: #804650 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm [kvm-83-249.0.1.el5] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch - modify kversion to fix build failure [kvm-83-249.el5] - kvm-kernel-KVM-x86-Prevent-starting-PIT-timers-in-the-absence-o.patch [bz#770101] - CVE: CVE-2011-4622 - Resolves: bz#770101 (CVE-2011-4622 kernel: kvm: pit timer with no irqchip crashes the system [rhel-5.8]) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel [2.6.18-308.20.1.0.1.el5] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [net] bonding: fix carrier detect when bond is down [orabug 12377284] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printks when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 openssl openssl097a openssl098e openssl: [1.0.0-20.4] - fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio() (#814185) openssl098e: [0.9.8e-17.el6_2.2] - Updated the description [0.9.8e-17.2] - fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio() (#814185) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk [1:1.6.0.0-1.28.1.10.10.0.1.el5_8] - Add oracle-enterprise.patch [1:1.6.0.0-1.28.1.10.10] - Updated to IcedTea6 1.10.10 - Resolves rhbz#s 856124, 865346, 865348, 865350, 865352, 865354, 865357, 865359, 865363, 865365, 865370, 865428, 865471, 865434, 865511, 865514, 865519, 865531, 865541, 865568 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox: [10.0.4-1.0.1.el6_2] - Replace firefox-redhat-default-prefs.js with firefox-oracle-default-prefs.js [10.0.4-1] - Update to 10.0.4 ESR xulrunner: [10.0.4-1.0.1.el6_2] - Replace xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.4-1] - Update to 10.0.4 ESR [10.0.3-3] - Fixed mozbz#746112 - ppc(64) freeze [10.0.3-2] - Fixed mozbz#681937 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql [8.4.11-1] - Update to PostgreSQL 8.4.11, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-11.html http://www.postgresql.org/docs/8.4/static/release-8-4-10.html including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868 Resolves: #812081 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-238.12.1.0.1.el5] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - fix missing aio_complete() in end_io (Joel Becker) [orabug 10365195] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [nfs] too many getattr and access calls after direct I/O [orabug 9348191] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [aio] patch removes limit on number of retries (Srinivas Eeda) [orabug 10044782] - [loop] Do not call loop_unplug for not configured loop device (orabug 10314497) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 quagga [0.98.6-7.1] - fix CVE-2011-3323 - fix CVE-2011-3324 - fix CVE-2011-3325 - fix CVE-2011-3326 - fix CVE-2011-3327 - fix CVE-2012-0249 - fix CVE-2010-1674 [0.98.6-7] - Resolves: #638628 - CVE-2007-4826 CVE-2010-2948 quagga: various flaws [0.98.6-6] - Resolves: #528583 - Missing declarations cause zebra to segfault Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-308.el5] - [scsi] lpfc: Update lpfc version for 8.2.0.108.4p driver release (Rob Evers) [784073] - [scsi] lpfc: Fix FCP EQ memory check init w/single int vector (Rob Evers) [784073] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xen [3.0.3-135.el5_8.5] - console: Prevent escape sequence length overflow (rhbz 851253) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 dhcp [12:3.0.5-31.1] - An error in the handling of malformed client identifiers can cause a denial-of-service condition in affected servers. (CVE-2012-3571, #843124) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers A [2.6.32-100.28.17.el6] - [net] Extend prot->slab size when add sock extend fields. [2.6.32-100.28.16.el6] - kernel: Fix unlimited socket backlog DoS {CVE-2010-4251} - RDS: Fix congestion issues for loopback - rds: prevent BUG_ON triggering on congestion map updates {CVE-2011-1023} - epoll: prevent creating circular epoll structures {CVE-2011-1082} - fs: fix corrupted OSF partition table parsing {CVE-2011-1163} - fs: Increase OSF partition limit from 8 to 18 {CVE-2011-1163} - netfilter: arp_tables: fix infoleak to userspace {CVE-2011-1170} - netfilter: ip_tables: fix infoleak to userspace {CVE-2011-1171} - ipv6: netfilter: ip6_tables: fix infoleak to userspace {CVE-2011-1172} - [SCSI] mpt2sas: prevent heap overflows and unchecked reads {CVE-2011-1494, CVE-2011-1495} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 initscripts [8.45.42-1.0.1.el5] - Update oracle-enterprise.patch to do detection on /etc/oracle-release and /etc/enterprise-release - Patch x86_64 sysctl.conf as well as default sysctl.conf - Patch sysctl.conf to default rp_filter to loose reverse path filtering (has no effect for pre-2.6.32 kernels) [orabug 10286227] - Move hwclock into udev rules - Update oracle-enterprise.patch to fix RedHat references in arch specific sysctl.conf files in source tarball - Add oracle-enterprise.patch and update specfile - Don't attempt to re-enslave already-enslaved devices (#455537) (pknirsch@redhat.com) [8.45.42-1] - changed exchange_mode to 'main, aggressive' (#435274) [8.45.41-1] - fix check for dhcp6c pid (#568896) [8.45.40-1] - exit arping on first response (#744734) [8.45.39-1] - suppress remove error message during boot (#679998) - fix logic error with removing arp_ip_target (#745681) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm [kvm-83-105.0.1.el5_4.27] - Add kvm-add-oracle-workaround-for-libvirt-bug.patch [kvm-83-105.el5_4.27] - kvm-kernel-KVM-VMX-Check-cpl-before-emulating-debug-register-ac.patch [bz#563516] - Resolves: bz#563516 (KVM: Check cpl before emulating debug register access [rhel-5.4.z]) [kvm-83-105.el5_4.26] - kvm-kernel-KVM-Don-t-check-access-permission-when-loading-segme.patch [bz#563464] - kvm-kernel-KVM-Disable-move-to-segment-registers-and-jump-far-i.patch [bz#563464] - Resolves: bz#563464 (EMBARGOED CVE-2010-0419 kvm: emulator privilege escalation segment selector check [rhel-5.4.z]) [kvm-83-105.el5_4.25] - kvm-virtio-blk-Fix-reads-turned-into-writes-after-read-e.patch [bz#562776] - kvm-virtio-blk-Handle-bdrv_aio_read-write-NULL-return.patch [bz#562776] - Resolves: bz#562776 (Guest image corruption after RHEV-H update to 5.4-2.1.3.el5_4rhev2_1) [kvm-83-105.el5_4.24] - Apply bz#561022 patches again (undo the reverts from kvm-83-105.el5_4.23) - kvm-qemu-add-routines-for-atomic-16-bit-accesses-take-2.patch [bz#561022] - kvm-qemu-virtio-atomic-access-for-index-values-take-2.patch [bz#561022] - Resolves: bz#561022 (QEMU terminates without warning with virtio-net and SMP enabled) [kvm-83-105.el5_4.23] - Revert bz#561022 patches by now, until they get better testing - kvm-Revert-qemu-virtio-atomic-access-for-index-values.patch [bz#561022] - kvm-Revert-qemu-add-routines-for-atomic-16-bit-accesses.patch [bz#561022] - Related: bz#561022 (QEMU terminates without warning with virtio-net and SMP enabled) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk [1.6.0.0-1.28.1.10.9.0.1.el5_8] - Add oracle-enterprise.patch [1:1.6.0.0-1.28.1.10.9] - Updated to latest IcedTea6 1.10.9 - Resolves: rhbz#846709 - Resolves: rhbz#853114 [1:1.6.0.0-1.27.1.10.8] - Access gnome bridge jar is forced to have 644 permissions - Resolves: rhbz#828749 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 nfs-utils [1.0.9-60.0.1.el5] - Add support for resvport for unmonting [orabug 13567018] [1.0.9-60] - Updated idmapd.conf and idmapd.conf.man to reflect the static user name mapping (502707) - Fixed an umount regression introduced by bz 513094 (bz 781931) [1.0.9-59] - gss: turned of even more excessive syslogs (bz 593097) - mount.nfs: Ignored the SIGXFSZ when handling RLIMIT_FSIZE changes (bz 697979) [1.0.9-58] - gss: turned off more excessive syslogs (bz 593097) - initfiles: more initscripts improvements (bz 710020) - specfile: correct typo when nfsnobodys gid already exists (bz 729603) [1.0.9-57] - Mount fails to anticipate RLIMIT_FSIZE (bz 697979,CVE-2011-1749) [1.0.9-56] - Removed sim crash support (bz 600497) - initfiles: more initscripts improvements (bz 710020) - mount: Don't wait for TCP to timeout twice (bz 736677) [1.0.9-55] - mount: fixed the -o retry option to retry the given amount (bz 736677) - manpage: removed the -o fsc option (bz 715523) - nfsstat: show v4 mounts with -m flag (bz 712438) - mount: allow insecure ports with mounts (bz 513094) - gss: turned off excessive syslogs (bz 593097) - mountd: allow v2 and v3 to be disabled (bz 529588) - specfile: make sure nfsnobodys gid changes when it exists (bz 729603) - initfiles: initscripts improvements (bz 710020) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql [8.4.13-1] - Update to PostgreSQL 8.4.13, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-13.html including the fixes for CVE-2012-3488, CVE-2012-3489 Resolves: #852020 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 util-linux [2.13-0.59.0.1.el5] - Merge UEK modification fix #10104470 - Import hwclock from util-linux-ng [Kris Van Hees] [2.13-0.59] - fix #768382 - CVE-2011-1675 CVE-2011-1677 util-linux various flaws [2.13-0.58] - fix #677452 - util-linux fails to build with gettext-0.17 [2.13-0.57] - fix #646300 - login doesn't update /var/run/utmp properly - fix #726572 - import missing fsfreeze into util-linux - fix #678430 - fdisk should not report error on 1gB LUNs - fix #699639 - mount man page is missing support for ext4/xfs - fix #650937 - blockdev man page missing information - fix #678407 - ipcs and ipcrm in wrong man section Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 openssl [0.9.8e-12.7] - fix CVE-2010-4180 - completely disable code for SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-274.3.1.0.1.el5] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - fix missing aio_complete() in end_io (Joel Becker) [orabug 10365195] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [aio] patch removes limit on number of retries (Srinivas Eeda) [orabug 10044782] - [loop] Do not call loop_unplug for not configured loop device (orabug 10314497) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-200.33.1] - sfc: Replace some literal constants with EFX_PAGE_SIZE/EFX_BUF_SIZE (Ben Hutchings) [Orabug: 14769994] - CVE-2012-3412 sfc: Fix maximum number of TSO segments and minimum TX queue size (Ben Hutchings) [Orabug: 14769994] {CVE-2012-3412} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sudo [1.7.2p1-7] - added patch that fixes insufficient environment sanitization issue (#598154) Resolves: #598381 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-400.0.0.0.1] - [net] fix tcp_trim_head() (James Li) [orabug 14512145, 19219078] - ocfs2: dlm: fix recovery hung (Junxiao Bi) [orabug 13956772] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird [10.0.10-1.0.1.el6_3] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [10.0.10-1] - Update to 10.0.10 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk [1.6.0.0-1.25.1.10.6.0.1.el5_8] - Add oracle-enterprise.patch [1:1.6.0.0-1.25.1.10.6] - Updated to IcedTea6 1.10.6 - Resolves: rhbz#787142 - Security fixes - S7082299: Fix in AtomicReferenceArray - S7088367: Fix issues in java sound - S7110683: Issues with some KeyboardFocusManager method - S7110687: Issues with TimeZone class - S7110700: Enhance exception throwing mechanism in ObjectStreamClass - S7110704: Issues with some method in corba - S7112642: Incorrect checking for graphics rendering object - S7118283: Better input parameter checking in zip file processing - S7126960: Add property to limit number of request headers to the HTTP Server - Bug fixes - RH580478: Desktop files should not use hardcoded path - Removed and deleted upstreamed patch7 - name-rmi-fix.patch - Removed and deleted upstreamed Hugepages patches: - Source100: 7034464-hugepage.patch - Source101: 7037939-hugepage.patch - Source102: 7043564-hugepage.patch Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 systemtap [1.2-11.0.1.el6_0] - rebuild without docs - remove doc/SystemTap_Beginners_Guide/en-US in tarball [1.2-11] - CVE-2010-4170 - CVE-2010-4171 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php53 [5.3.3-7] - correct detection of = in CVE-2012-1823 fix (#818607) [5.3.3-6] - add security fix for CVE-2012-1823 (#818607) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libxml2 [2.7.6-8.0.1.el6_3.3 ] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.7.6-8.el6_3.3] - Change the XPath code to percolate allocation error (CVE-2011-1944) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 php53 php [5.3.3-3.5] - remove extra php.ini-prod/devel files caused by %patch -b [5.3.3-3.4] - add security fixes for CVE-2011-4885, CVE-2011-4566 (#769754) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gimp [2:2.2.13-2.0.7.el5_8.5] - fix overflow in GIF loader (CVE-2012-3481) [2:2.2.13-2.0.7.el5_8.4] - fix overflows in PSD plugin (CVE-2009-3909, CVE-2012-3402) - fix heap corruption and overflow in GIF plug-in (CVE-2011-2896) - fix overflow in CEL plug-in (CVE-2012-3403) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 scsi-target-utils [1.0.4-3.1] - fix the buffer overflow bug before iscsi login (CVE-2011-0001) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 openssl [0.9.8e-12.6] - fix CVE-2009-3245 - add missing bn_wexpand return checks (#570924) [0.9.8e-12.5] - fix CVE-2010-0433 - do not pass NULL princ to krb5_kt_get_entry which in the RHEL-5 and newer versions will crash in such case (#569774) [0.9.8e-12.4] - do not disable SSLv2 in the renegotiation patch - SSLv2 does not support renegotiation - allow unsafe renegotiation on clients with SSL_OP_LEGACY_SERVER_CONNECT [0.9.8e-12.3] - mention the RFC5746 in the CVE-2009-3555 doc [0.9.8e-12.2] - fix CVE-2009-3555 - support the safe renegotiation extension and do not allow legacy renegotiation on the server by default (#533125) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm A data structure field in kvm_vcpu_ioctl_x86_get_vcpu_events() in QEMU-KVM was not initialized properly before being copied to user-space. A privileged host user with access to "/dev/kvm" could use this flaw to leak kernel stack memory to user-space. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-300.17.2] - hugepages: fix use after free bug in 'quota' handling [Orabug: 15845276] {CVE-2012-2133} - udf: Fortify loading of sparing table [Orabug: 15845302] {CVE-2012-3400} - udf: Avoid run away loop when partition table length is corrupt [Orabug: 15845302] {CVE-2012-3400} - mm: Hold a file reference in madvise_remove [Orabug: 15846025] {CVE-2012-3511} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 openssl [1.0.0-20.3] - fix problem with the SGC restart patch that might terminate handshake incorrectly - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7 code (#802725) - fix for CVE-2012-1165 - NULL read dereference on bad MIME headers (#802489) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-308.20.1.el5] - Revert: [x86] mm: randomize SHLIB_BASE (Dave Anderson) [804953 804954] {CVE-2012-1568} [2.6.18-308.19.1.el5] - [net] be2net: Remove code that stops further access to BE NIC based on UE bits (Alexander Gordeev) [867896 862811] - [net] netpoll: fix an incorrect check for NULL pointer (Alexander Gordeev) [856079 848098] - [net] mlx4: Add support for EEH error recovery (Alexander Gordeev) [847404 798048] - [fs] ext4: fix undefined bit shift result in ext4_fill_flex_info (Eric Sandeen) [809688 809689] {CVE-2012-2100} - [fs] ext4: fix undefined behavior in ext4_fill_flex_info (Eric Sandeen) [809688 809689] {CVE-2012-2100} - [fs] fix crash if block {device|size} read & changed at sametime (Mikulas Patocka) [864823 756506] - [x86] mm: randomize SHLIB_BASE (Dave Anderson) [804953 804954] {CVE-2012-1568} - [net] ipv6: Fix fib6_dump_table walker leak (Jiri Benc) [861387 819830] - [fs] cifs: update cifs_dfs_d_automount caller path (Sachin Prabhu) [858774 857448] - [xen] x86: change the default behaviour of CVE-2012-2934 fix (Petr Matousek) [859946 858724] - [net] ipvs: allow transmit of GRO aggregated skbs (Jesper Brouer) [857966 854067] - [scsi] isci: fixup linkspeed definitions (David Milburn) [854986 833000] - [fs] nfs: nfs_d_automount update caller path after do_add_mount (Carlos Maiolino) [857552 834379] - [fs] vfs: Fix vfsmount overput on simultaneous automount (Carlos Maiolino) [857552 834379] [2.6.18-308.18.1.el5] - [fs] autofs4: Merge the remaining dentry ops tables (Ian Kent) [857558 850977] [2.6.18-308.17.1.el5] - [fs] cifs: Invalidate file cache in case of posix open (Sachin Prabhu) [857964 852526] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-274.12.1.0.1.el5] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [scsi] add additional scsi medium error handling (John Sobecki) [orabug 12904887] - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - bonding: reread information about speed and duplex when interface goes up (John Haxby) [orabug 11890822] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [aio] patch removes limit on number of retries (Srinivas Eeda) [orabug 10044782] - [loop] Do not call loop_unplug for not configured loop device (orabug 10314497) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libexif [0.6.21-5] - Update to version 0.6.21 fixing many bugs and CVEs - Remove upstreamed patches - Resolves: #839915 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 Oracle Linux 7 nss [3.16.2.3-2.0.1.el7_0] - Added nss-vendor.patch to change vendor [3.16.2.3-2] - Restore patch for certutil man page - supply missing options descriptions - Resolves: Bug 1165525 - Upgrade to NSS 3.16.2.3 for Firefox 31.3 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel [2.6.18-194.26.1.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb (John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524] - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki, Chris Mason, Herbert van den Bergh) [orabug 9245919] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-300.29.2] - epoll: epoll_wait() should not use timespec_add_ns() (Eric Dumazet) - epoll: clear the tfile_check_list on -ELOOP (Joe Jin) {CVE-2012-3375} - Don't limit non-nested epoll paths (Jason Baron) - epoll: kabi fixups for epoll limit wakeup paths (Joe Jin) {CVE-2011-1083} - epoll: limit paths (Jason Baron) {CVE-2011-1083} - eventpoll: fix comment typo 'evenpoll' (Paul Bolle) - epoll: fix compiler warning and optimize the non-blocking path (Shawn Bohrer) - epoll: move ready event check into proper inline (Davide Libenzi) - epoll: make epoll_wait() use the hrtimer range feature (Shawn Bohrer) - select: rename estimate_accuracy() to select_estimate_accuracy() (Andrew Morton) - cred: copy_process() should clear child->replacement_session_keyring (Oleg Nesterov) {CVE-2012-2745} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 postgresql84 [8.4.7-1.el5_6.1] - Update to PostgreSQL 8.4.7, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-7.html http://www.postgresql.org/docs/8.4/static/release-8-4-6.html including the fix for CVE-2010-4015 Resolves: #672636 - Ensure we don't package any .gitignore files from the source tarball Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel: [2.6.18-308.8.2.el5] - [xen] x86_64: check address on trap handlers or guest callbacks (Paolo Bonzini) [813430 813431] {CVE-2012-0217} - [xen] x86_64: Do not execute sysret with a non-canonical return address (Paolo Bonzini) [813430 813431] {CVE-2012-0217} - [xen] x86: prevent hv boot on AMD CPUs with Erratum 121 (Laszlo Ersek) [824969 824970] ocfs2: [1.4.10] - ocfs2/dlm: Cleanup mlogs in dlmthread.c dlmast.c and dlmdomain.c - ocfs2/dlm: make existing convertion precedent over new lock - ocfs2/dlm: Cleanup dlmdebug.c - ocfs2/dlm: Minor cleanup - ocfs2/dlm: Hard code the values for enums - ocfs2: Wakeup down convert thread just after clearing OCFS2 LOCK UPCONVERT FINISHING - ocfs2/dlm: Take inflight reference count for remotely mastered resources too - ocfs2/dlm: dlmlock remote needs to account for remastery - ocfs2: Add some trace log for orphan scan - ocfs2: Remove unused old id in ocfs2_commit_cache - ocfs2: Remove obsolete comments before ocfs2_start_trans - ocfs2: Initialize the bktcnt variable properly and call it bucket_count - ocfs2: Use cpu to le16 for e leaf clusters in ocfs2_bg_discontig_add_extent - ocfs2: validate bg free bits count after update - ocfs2: cluster Pin the remote node item in configfs - ocfs2: Release buffer head in case of error in ocfs2_double_lock - ocfs2: optimize ocfs2 check dir entry with unlikely() annotations - ocfs2: Little refactoring against ocfs2 iget - ocfs2: Initialize data ac might be used uninitializ - ocfs2 Skip mount recovery for hard ro mounts - ocfs2: make direntry invalid when deleting it - ocfs2: commit trans in error - ocfs2: Fix deadlock when allocating page - ocfs2: Avoid livelock in ocfs2 readpage Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 busybox [1:1.2.0-13] - Resolves: #768083 'busybox various flaws' including: 'buffer underflow in decompression' 'udhcpc insufficient checking of DHCP options' [1:1.2.0-12] - Resolves: #756723 'Kdump fails after findfs subcommand of busybox fails' [1:1.2.0-11] - Resolves: #689659 ''busybox cp' does not return a correct exit code when 'No space left on device'' Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 ghostscript [8.70-14:.1] - Added inputChan lower-bounds checking to icclib (bug #854227, CVE-2012-4405). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 openssl [0.9.8e-20.1] - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext recovery vulnerability and additional DTLS fixes (#771770) - fix for CVE-2011-4109 - double free in policy checks (#771771) - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding (#771775) - fix for CVE-2011-4619 - SGC restart DoS attack (#771780) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 mysql [5.0.77-4.4] - Add fixes for CVE-2010-3677, CVE-2010-3680, CVE-2010-3681, CVE-2010-3682, CVE-2010-3833, CVE-2010-3835, CVE-2010-3836, CVE-2010-3837, CVE-2010-3838, CVE-2010-3839, CVE-2010-3840 Resolves: #645642 - Backpatch strmov fix so that code can be tested on more recent platforms Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc [2.5-81.el5_8.7] - Fix out of bounds array access in strto* exposed by 847929 patch. [2.5-81.el5_8.6] - Fix integer overflow leading to buffer overflow in strto* (#847929) [2.5-81.el5_8.5] - Do not use PT_IEEE_IP ptrace calls (#839411) - Update ULPs (#839411) - Fix various transcendentals in non-default rounding modes (#839411) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-274.el5] - [xen] svm: fix invlpg emulator regression (Paolo Bonzini) [719894] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql [8.4.12-1] - Update to PostgreSQL 8.4.12, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-12.html including the fixes for CVE-2012-2143, CVE-2012-2655 Resolves: #830723 [8.4.11-2] - Add patches for CVE-2012-2143, CVE-2012-2655 Resolves: #830723 [8.4.11-1] - Update to PostgreSQL 8.4.11, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-11.html http://www.postgresql.org/docs/8.4/static/release-8-4-10.html including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868 Resolves: #812077 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xen [3.0.3-120.el5_6.2] - Fix logic and integer overflow in xc_try_bzip2_decode() (rhbz 696938) - Fix logic and integer overflow in xc_try_lzma_decode() (rhbz 696938) - Fix integer and buffer overflows in xc_dom_probe_bzimage_kernel() (rhbz 696938) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 php [5.3.3-3.8] - correct detection of = in CVE-2012-1823 fix (#818607) [5.3.3-3.7] - add security fix for CVE-2012-1823 (#818607) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bind [30:9.3.6-20.P1.4] - bind-chroot-admin: set correct permissions on /etc/named.conf during update [30:9.3.6-20.P1.3] - fix CVE-2012-4244 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php [5.1.6-45] - core: fix integer overflow in unserialize() CVE-2014-3669 - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670 - xmlrpc: fix buffer overflow in date parser #1155607 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 ibutils [1.2-11.2.0.1.el5] - Fix double malloc and free problem in CrdLoopPrepare and CrdLoopCleanup [1.2-11.2.el5] - Added Requires lines for ibutils-libs to make rpmdiff happier. - Add patch for CVE-2008-3277 Resolves: bz768400 [1.2-11.1.el5] - Add ibutils-1.2-invalid-delete.patch to close Resolves: bz711779 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-firmware kernel-headers ofa Following Security fixes are included in this unbreakable enterprise kernel errata: CVE-2010-3432 The sctp_packet_config function in net/sctp/output.c in the Linux kernel before 2.6.35.6 performs extraneous initializations of packet data structures, which allows remote attackers to cause a denial of service (panic) via a certain sequence of SCTP traffic. CVE-2010-2962 drivers/gpu/drm/i915/i915_gem.c in the Graphics Execution Manager (GEM) in the Intel i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.36 does not properly validate pointers to blocks of memory, which allows local users to write to arbitrary kernel memory locations, and consequently gain privileges, via crafted use of the ioctl interface, related to (1) pwrite and (2) pread operations. CVE-2010-2955 The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size. CVE-2010-3705 The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array. CVE-2010-3084 Buffer overflow in the niu_get_ethtool_tcam_all function in drivers/net/niu.c in the Linux kernel before 2.6.36-rc4 allows local users to cause a denial of service or possibly have unspecified other impact via the ETHTOOL_GRXCLSRLALL ethtool command. CVE-2010-3437 Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call. CVE-2010-3079 kernel/trace/ftrace.c in the Linux kernel before 2.6.35.5, when debugfs is enabled, does not properly handle interaction between mutex possession and llseek operations, which allows local users to cause a denial of service (NULL pointer dereference and outage of all function tracing files) via an lseek call on a file descriptor associated with the set_ftrace_filter file. CVE-2010-3698 The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers, which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl call in conjunction with a modified Local Descriptor Table (LDT). CVE-2010-3442 Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel [2.6.18-308.11.1.el5] - [net] ixgbe: remove flow director stats (Andy Gospodarek) [832169 830226] - [net] ixgbe: fix default return value for ixgbe_cache_ring_fdir (Andy Gospodarek) [832169 830226] - [net] ixgbe: reverting setup redirection table for multiple packet buffers (Andy Gospodarek) [832169 830226] [2.6.18-308.10.1.el5] - [xen] x86_64: check address on trap handlers or guest callbacks (Paolo Bonzini) [813430 813431] {CVE-2012-0217} - [xen] x86_64: Do not execute sysret with a non-canonical return address (Paolo Bonzini) [813430 813431] {CVE-2012-0217} - [xen] x86: prevent hv boot on AMD CPUs with Erratum 121 (Laszlo Ersek) [824969 824970] {CVE-2012-2934} - [scsi] qla2xxx: Use ha->pdev->revision in 4Gbps MSI-X check. (Chad Dupuis) [816373 800653] - [fs] sunrpc: do array overrun check in svc_recv before page alloc (J. Bruce Fields) [820358 814626] - [fs] knfsd: fix an NFSD bug with full size non-page-aligned reads (J. Bruce Fields) [820358 814626] - [fs] sunrpc: fix oops due to overrunning server's page array (J. Bruce Fields) [820358 814626] - [fs] epoll: clear the tfile_check_list on -ELOOP (Jason Baron) [829670 817131] - [x86_64] sched: Avoid unnecessary overflow in sched_clock (Prarit Bhargava) [824654 818787] - [net] sunrpc: Don't use list_for_each_entry_safe in rpc_wake_up (Steve Dickson) [817571 809937] - [s390] qeth: add missing wake_up call (Hendrik Brueckner) [829059 790900] [2.6.18-308.9.1.el5] - [fs] jbd: clear b_modified before moving the jh to a different transaction (Josef Bacik) [827205 563247] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 logwatch [7.3.6-49] - Added fix for CVE-2011-1018: Privilege escalation due improper sanitization of special characters in log file names Resolves: #680304 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-200.24.1.el5uek] - Revert 'Add Oracle VM guest messaging driver' (Guru Anbalagane) [Orabug: 14233627} [2.6.39-200.23.1.el5uek] - SPEC: add block/net modules to list used by installer (Guru Anbalagane) [Orabug: 14224837] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek: [2.6.32-300.25.1.el6uek] - jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer (Eric Sandeen) [Bugdb: 13871] {CVE-2011-4086} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [10.0.8-1.0.2.el6_3] - Updated firefox-oracle-default-prefs.js based on latest firefox-redhat-default-prefs.js [10.0.8-1.0.1.el6_3] - Replace firefox-redhat-default-prefs.js with firefox-oracle-default-prefs.js [10.0.8-1] - Update to 10.0.8 ESR xulrunner [10.0.8-1.0.1.el6_3] - Replace xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.8-1] - Update to 10.0.8 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 conga [0.12.2-64.0.2.el5] - Remove conga-enterprise.patch Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 postgresql84 [8.4.9-1.el5_7.1] - Update to PostgreSQL 8.4.9, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-9.html http://www.postgresql.org/docs/8.4/static/release-8-4-8.html including the fix for CVE-2011-2483 Resolves: #740739 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 freeradius2 [2.1.12-4] - resolves: bug#855315 CVE-2012-3547 freeradius: Stack-based buffer overflow by processing certain expiration date fields of a certificate during x509 certificate validation Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bash [3.2-32] - Dont include backup files Resolves: #700157 [3.2-31] - Use 'mktemp' for temporary files Resolves: #700157 [3.2-30] - Added man page references to systemwide .bash_logout Resolves: #592979 [3.2-29] - Readline glitch, when editing line with more spaces and resizing window Resolves: #525474 [3.2-28] - Fix the memory leak in read builtin Resolves: #618393 - Dont append slash to non-directories Resolves: #583919 [3.2-27] - Test .dynamic section if has PROGBITS or NOBITS Resolves: #484809 - Better random number generator Resolves: #492908 - Allow to source scripts with embeded NULL chars Resolves: #503701 [3.2-26] - vi mode redo insert fixed Resolves: #575076 - Dont show broken pipe messages for builtins Resolves: #546529 - Dont include loadables in doc dir Resolves: #663656 - Enable system-wide .bash_logout for login shells Resolves: #592979 [3.2-25] - Dont abort source builtin Resolves: #448508 - Correctly place cursor Resolves: #463880 - Minor man page clarification for trap builtin Resolves: #504904 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-308.16.1.0.1.el5] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [net] bonding: fix carrier detect when bond is down [orabug 12377284] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printks when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 lvm2-cluster [2.02.56-el5_5.4] - CVE-2010-2526: Fix insecurity when communicating between lvm2 and clvmd. Resolves: #616044 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libpng [2:1.2.48-1] - Update to libpng 1.2.48, for minor security issues (CVE-2011-3045) Resolves: #801663 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 cups [1:1.3.7-30] - Backported patch to fix transcoding for ASCII (bug #759081, STR #3832). [1:1.3.7-29] - The imageto* filters could crash with bad GIF files (CVE-2011-2896, STR #3867, STR #3914, bug #752118). [1:1.3.7-28] - Web interface didn't show completed jobs for printer (STR #3436, bug #625900) - Serial backend didn't allow a raw job to be canceled (STR #3649, bug #625955) - Fixed condition in textonly filter to create temporary file regardless of the number of copies specified. (bug #660518) [1:1.3.7-27] - Call avc_init() only once to not leak file descriptors (bug #668009). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-100.6.1] - regset: Return -EFAULT, not -EIO, on host-side memory fault (H. Peter Anvin) {CVE-2012-1097} - regset: Prevent null pointer reference on readonly regsets (H. Peter Anvin) {CVE-2012-1097} - cifs: fix dentry refcount leak when opening a FIFO on lookup (Jeff Layton) {CVE-2012-1090} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 conga [0.12.2-51.0.1.el5] - Added conga-enterprise.patch - Added conga-enterprise-Carthage.patch to support OEL5 - Replaced redhat logo image in conga-0.12.2.tar.gz [0.12.2-51] - Fix bz711494 (CVE-2011-1948 plone: reflected XSS vulnerability) - Fix bz771920 (CVE-2011-4924 Zope: Incomplete upstream patch for CVE-2010-1104/bz577019) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mysql [5.0.95-5] - Rebuild to fix wrong package tag Related: #892679 [5.0.95-4] - Add patches for CVE-2012-2122, CVE-2012-2749, CVE-2012-5611 Resolves: #892679 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 w3m [0.5.1-17] - Resolves:rh#604861:Clear execstack requirement also for ia64 architecture [0.5.1-16] - Resolves:rh#604861:CVE-2010-2074 w3m: doesn't handle NULL in Common Name properly Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek [2.6.32-400.36.12] - HID: fix a couple of off-by-ones (Jiri Kosina) [Orabug: 19849320] {CVE-2014-3184} - ALSA: control: Protect user controls against concurrent access (Lars-Peter Clausen) [Orabug: 20192545] {CVE-2014-4652} - udf: Avoid infinite loop when processing indirect ICBs (Jan Kara) [Orabug: 20192451] {CVE-2014-6410} - ALSA: control: Make sure that id->index does not overflow (Lars-Peter Clausen) [Orabug: 20192420] {CVE-2014-4656} - ALSA: control: Handle numid overflow (Lars-Peter Clausen) [Orabug: 20192379] {CVE-2014-4656} - net: sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann) [Orabug: 20192060] {CVE-2014-3688} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 glibc [2.5-49.el5_5.6] - Never expand in privileged programs (#643818, CVE-2010-3847) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 systemtap [1.6-5.0.1.el6_2] - remove doc/SystemTap_Beginners_Guide/en-US in tarball - comment bz683569.patch in specfile - remove buildtime dependency on package publican-redhat [1.6-5] - CVE-2012-0875 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-348.6.1] - [char] ipmi: use a tasklet for handling received messages (Tony Camuso) [953435 947732] - [char] ipmi: do run_to_completion properly in deliver_recv_msg (Tony Camuso) [953435 947732] - [fs] nfs4: fix locking around cl_state_owners list (Dave Wysochanski) [954296 948317] - [fs] nfs: Fix bugs on short read (Sachin Prabhu) [952098 924011] - [xen] AMD IOMMU: spot missing IO-APIC entries in IVRS table (Igor Mammedov) [910912 910913] {CVE-2013-0153} - [xen] AMD, IOMMU: Make per-device interrupt remap table default (Igor Mammedov) [910912 910913] {CVE-2013-0153} - [xen] AMD, IOMMU: Disable IOMMU if SATA Combined mode is on (Igor Mammedov) [910912 910913] {CVE-2013-0153} - [xen] AMD, IOMMU: On creating entry clean up in remapping tables (Igor Mammedov) [910912 910913] {CVE-2013-0153} - [xen] ACPI: acpi_table_parse() should return handler's err code (Igor Mammedov) [910912 910913] {CVE-2013-0153} - [xen] introduce xzalloc() & Co (Igor Mammedov) [910912 910913] {CVE-2013-0153} - [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531] - [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531] - [x86-64] non lazy 'sleazy' fpu implementation (Prarit Bhargava) [948187 731531] [2.6.18-348.5.1] - [fs] nfs: handle getattr failure during nfsv4 open (David Jeffery) [947736 906909] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 ghostscript [8.70-11:.6] - Applied upstream fix to last patch (CVE-2010-4054, bug #646086). [8.70-11:.5] - Applied patch to prevent null pointer dereference (CVE-2010-4054, bug #646086). [8.70-11:.4] - Don't ship patch backup files for CVE-2010-2055. [8.70-11:.3] - Applied patch to prevent integer underflow in TrueType bytecode interpreter (CVE-2009-3743, bug #627902). - Applied patch to avoid reading initialization files from CWD (CVE-2010-2055, bug #599564). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-300.39.4] - exec: do not leave bprm->interp on stack (Kees Cook) [Orabug: 16286741] {CVE-2012-4530} - exec: use -ELOOP for max recursion depth (Kees Cook) [Orabug: 16286741] {CVE-2012-4530} [2.6.32-300.39.3] - Xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests. (Frediano Ziglio) [Orabug: 16274192] {CVE-2013-0190} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 php [5.1.6-27.4] - add security fixes for CVE-2011-4885, CVE-2011-4566, CVE-2011-0708, CVE-2011-1148, CVE-2011-1466, CVE-2011-1469, CVE-2011-2202 (#769756) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 net-snmp [5.3.2.2-20.0.1.el5] - suppress spurious asserts on 32bit [Greg Marsden] [5.3.2.2-20] - fixed error message when the address specified by clientaddr option is wrong or cannot be bound (#840861) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.17.1] - This is a fix on dlm_clean_master_list() (Xiaowei.Hu) - RDS: fix rds-ping spinlock recursion (jeff.liu) [Orabug: 16223050] - vhost: fix length for cross region descriptor (Michael S. Tsirkin) [Orabug: 16387183] {CVE-2013-0311} - kabifix: block/scsi: Allow request and error handling timeouts to be specified (Maxim Uvarov) - block/scsi: Allow request and error handling timeouts to be specified (Martin K. Petersen) [Orabug: 16372401] - [SCSI] Shorten the path length of scsi_cmd_to_driver() (Li Zhong) [Orabug: 16372401] - Fix NULL dereferences in scsi_cmd_to_driver (Mark Rustad) [Orabug: 16372401] - SCSI: Fix error handling when no ULD is attached (Martin K. Petersen) [Orabug: 16372401] - Handle disk devices which can not process medium access commands (Martin K. Petersen) [Orabug: 16372401] - the ac->ac_allow_chain_relink=0 won't disable group relink (Xiaowei.Hu) [Orabug: 14842737] - pci: hotplug: fix null dereference in pci_set_payload() (Jerry Snitselaar) [Orabug: 16345420] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 xorg-x11-server [1.1.1-48.90.0.1.el5] - Added oracle-enterprise-detect.patch - Replaced 'Red Hat' in spec file [1.1.1-48.90] - cve-2011-4028.patch: File existence disclosure vulnerability. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-300.32.3] - dl2k: Clean up rio_ioctl (Stephan Mueller) [Orabug: 14675306] {CVE-2012-2313} - hugetlb: fix resv_map leak in error path (Christoph Lameter) [Orabug: 14676403] {CVE-2012-2390} - rds: set correct msg_namelen (Jay Fenlason) [Orabug: 14676504] {CVE-2012-3430} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel [2.6.18-308.8.1.el5] - [net] sock: validate data_len before allocating skb in sock_alloc_send_pskb() (Jason Wang) [816290 816106] {CVE-2012-2136} - [net] tg3: Fix VLAN tagging assignments (John Feeney) [817691 797011] - [net] ixgbe: do not stop stripping VLAN tags in promiscuous mode (Andy Gospodarek) [809791 804800] - [s390] zcrypt: Fix parameter checking for ZSECSENDCPRB ioctl (Hendrik Brueckner) [810123 808489] - [x86] unwind information fix for the vsyscall DSO (Prarit Bhargava) [807930 805799] [2.6.18-308.7.1.el5] - [fs] epoll: Don't limit non-nested epoll paths (Jason Baron) [809380 804778] [2.6.18-308.6.1.el5] - [scsi] fc class: fix scanning when devs are offline (Mike Christie) [816684 799530] - [md] dm-multipath: delay retry of bypassed pg (Mike Christie) [816684 799530] - [net] bonding: properly unset current_arp_slave on slave link up (Veaceslav Falico) [811927 800575] - [net] bonding: remove {master,vlan}_ip and query devices instead (Andy Gospodarek) [810321 772216] [2.6.18-308.5.1.el5] - [scsi] skip sense logging for some ATA PASS-THROUGH cdbs (David Milburn) [807265 788777] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-348.2.1] - [misc] tainted flags, fix buffer size (Prarit Bhargava) [905829 901547] - [net] be2net: fix unconditionally returning IRQ_HANDLED in INTx (Ivan Vecera) [884704 878316] - [net] be2net: fix INTx ISR for interrupt behaviour on BE2 (Ivan Vecera) [884704 878316] - [net] be2net: fix a possible events_get() race on BE2 (Ivan Vecera) [884704 878316] - [firmware] Expand kernel boot-time storage for DMI table structs (Lenny Szubowicz) [902683 862865] - [fs] udf: Fortify loading of sparing table (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400} - [fs] udf: Improve table length check to avoid possible overflow (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400} - [fs] udf: Avoid run away loop when partition table is corrupted (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm [kvm-83-262.0.1.el5_9.1] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch [kvm-83-262.el5_1] - kvm-e1000-Discard-packets-that-are-too-long-if-SBP-and-L.patch [bz#910839] - kvm-e1000-Discard-oversized-packets-based-on-SBP-LPE.patch [bz#910839] - Resolves: bz#910839 (CVE-2012-6075 qemu (e1000 device driver): Buffer overflow when processing large packets when SBP and LPE flags are disabled [rhel-5.9.z]) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 rdesktop [1.6.0-8.1] - Prevent remote file access (#676252) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [17.0.3-2.0.1.el6_4] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [17.0.3-2] - Added fix for #848644 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel: [2.6.18-308.8.2.0.1.el5] - [net] bonding: fix carrier detect when bond is down [orabug 12377284] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] +- [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] [2.6.18-308.8.2.el5] - [xen] x86_64: check address on trap handlers or guest callbacks (Paolo Bonzini) [813430 813431] {CVE-2012-0217} - [xen] x86_64: Do not execute sysret with a non-canonical return address (Paolo Bonzini) [813430 813431] {CVE-2012-0217} - [xen] x86: prevent hv boot on AMD CPUs with Erratum 121 (Laszlo Ersek) [824969 824970] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 perl [4:5.10.1-130] - Resolves: #915692 - CVE-2012-5526 (newline injection due to improper CRLF escaping in Set-Cookie and P3P headers) - Resolves: #915692 - CVE-2012-6329 (possible arbitrary code execution via Locale::Maketext) - Resolves: #915692 - CVE-2013-1667 (DoS in rehashing code) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ImageMagick [6.2.8.0-15.el5] - Fix for PostScript conversion was incomplete, as larger documents would end up being cropped without the -g option (797364) [6.2.8.0-14.el5] - Add fix for CVE-2012-0247 CVE-2012-0248 CVE-2012-1185 CVE-2012-1186 - Add fix for CVE-2012-0259 CVE-2012-0260 CVE-2012-1798 [6.2.8.0-13.el5] - Fix PostScript conversion failing with /undefinedfilename (797364) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-308.13.1.el5] - [net] e1000e: Cleanup logic in e1000_check_for_serdes_link_82571 (Dean Nelson) [841370 771366] - [net] e1000e: Correct link check logic for 82571 serdes (Dean Nelson) [841370 771366] - [mm] NULL pointer dereference in __vm_enough_memory (Jerome Marchand) [840077 836244] - [fs] dlm: fix slow rsb search in dir recovery (David Teigland) [838140 753244] - [fs] autofs: propogate LOOKUP_DIRECTORY flag only for last comp (Ian Kent) [830264 814418] - [fs] ext4: properly dirty split extent nodes (Eric Sandeen) [840946 839770] - [scsi] don't offline devices with a reservation conflict (David Jeffery) [839196 835660] - [fs] ext4: Fix overflow caused by missing cast in ext4_fallocate (Lukas Czerner) [837226 830351] - [net] dl2k: Clean up rio_ioctl (Weiping Pan) [818822 818823] {CVE-2012-2313} - [x86] sched: Avoid unnecessary overflow in sched_clock (Prarit Bhargava) [835450 834562] - [net] tg3: Fix TSO handling (John Feeney) [833182 795672] - [input] evdev: use after free from open/disconnect race (David Jeffery) [832448 822166] [2.6.18-308.12.1.el5] - [fs] nfs: Don't allow multiple mounts on same mntpnt with -o noac (Sachin Prabhu) [839806 839753] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-300.39.2] - ext4: fix undefined behavior in ext4_fill_flex_info() (Xi Wang) [orabug 16020245] {CVE-2012-2100} - Divide by zero in TCP congestion control Algorithm (Jesper Dangaard Brouer) [orabug 16020447] {CVE-2012-4565} - ipv6: discard overlapping fragment (Luis Henriques) [orabug 16021354] {CVE-2012-4444} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm [kvm-83-164.0.1.el5_5.30] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch to replace RHEL with OEL - Added kvm-Introduce-oel-machine-type.patch so that OEL is a recognized VM [kvm-83-164.el5_5.30] - Revert the bz#661397 patches as they are not enough - kvm-kernel-Revert-KVM-VMX-Return-0-from-a-failed-VMREAD.patch [bz#661397] - kvm-kernel-Revert-KVM-Don-t-spin-on-virt-instruction-faults-dur.patch [bz#661397] - Related: bz#661397 (reboot(RB_AUTOBOOT) fails if kvm instance is running) - kvm-kernel-KVM-fix-AMD-initial-TSC-offset-problems-additional-f.patch [bz#656984] - Resolves: bz#656984 (TSC offset of virtual machines is not initialized correctly by 'kvm_amd' kernel module.) [kvm-83-164.el5_5.29] - kvm-kernel-KVM-Don-t-spin-on-virt-instruction-faults-during-reb.patch [bz#661397] - kvm-kernel-KVM-VMX-Return-0-from-a-failed-VMREAD.patch [bz#661397] - Resolves: bz#661397 (reboot(RB_AUTOBOOT) fails if kvm instance is running) [kvm-83-164.el5_5.28] - kvm-implement-dummy-PnP-support.patch [bz#659850] - kvm-load-registers-after-restoring-pvclock-msrs.patch [bz#660239] - Resolves: bz#659850 (If VM boot seq. is set up as nc (PXE then disk) the VM is always stuck on trying to PXE boot) - Resolves: bz#660239 (clock drift when migrating a guest between mis-matched CPU clock speed) [kvm-83-164.el5_5.27] - kvm-kernel-KVM-fix-AMD-initial-TSC-offset-problems.patch [bz#656984] - Resolves: bz#656984 (TSC offset of virtual machines is not initialized correctly by 'kvm_amd' kernel module.) [kvm-83-164.el5_5.26] - Updated kversion to 2.6.18-194.26.1.el5 to match build root - kvm-kernel-KVM-x86-fix-information-leak-to-userland.patch [bz#649832] - Resolves: bz#649832 (CVE-2010-3881 kvm: arch/x86/kvm/x86.c: reading uninitialized stack memory [5.5.z]) - CVE: CVE-2010-3881 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-348.2.1.0.1] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-400.26.2] - mm/hotplug: correctly add new zone to all other nodes' zone lists (Jiang Liu) [Orabug: 16603569] {CVE-2012-5517} - ptrace: ptrace_resume() shouldn't wake up !TASK_TRACED thread (Oleg Nesterov) [Orabug: 16405868] {CVE-2013-0871} - ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL (Oleg Nesterov) [Orabug: 16405868] {CVE-2013-0871} - ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up() (Oleg Nesterov) [Orabug: 16405868] {CVE-2013-0871} - Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() (Anderson Lizardo) [Orabug: 16711062] {CVE-2013-0349} - dccp: check ccid before dereferencing (Mathias Krause) [Orabug: 16711040] {CVE-2013-1827} - USB: io_ti: Fix NULL dereference in chase_port() (Wolfgang Frisch) [Orabug: 16425435] {CVE-2013-1774} - keys: fix race with concurrent install_user_keyrings() (David Howells) [Orabug: 16493369] {CVE-2013-1792} - KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) (Andy Honig) [Orabug: 16710937] {CVE-2013-1798} - KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) (Jerry Snitselaar) [Orabug: 16710794] {CVE-2013-1796} - net/tun: fix ioctl() based info leaks (Mathias Krause) [Orabug: 16675501] {CVE-2012-6547} - atm: fix info leak via getsockname() (Mathias Krause) [Orabug: 16675501] {CVE-2012-6546} - atm: fix info leak in getsockopt(SO_ATMPVC) (Mathias Krause) [Orabug: 16675501] {CVE-2012-6546} - xfrm_user: fix info leak in copy_to_user_tmpl() (Mathias Krause) [Orabug: 16675501] {CVE-2012-6537} - xfrm_user: fix info leak in copy_to_user_policy() (Mathias Krause) [Orabug: 16675501] {CVE-2012-6537} - xfrm_user: fix info leak in copy_to_user_state() (Mathias Krause) [Orabug: 16675501] {CVE-2013-6537} - xfrm_user: return error pointer instead of NULL #2 (Mathias Krause) [Orabug: 16675501] {CVE-2013-1826} - xfrm_user: return error pointer instead of NULL (Mathias Krause) [Orabug: 16675501] {CVE-2013-1826} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 OpenIPMI [2.0.16-16.el5] - ipmitool: fix ipmi command retry shifts replies (#863310) [2.0.16-15.el5] - ipmitool: added -b, -B, -l and -T options to ipmitool man page (#846596) - ipmitool: fixed man page documentation for delloem setled command (#797050) [2.0.16-14.el5] - ipmitool: fixed wrong permissions on ipmievd.pid (#834190) [2.0.16-13.el5] - ipmitool: updated delloem commands (#797050) - ipmitool: fixed exit code of 'ipmitool -o list' command (#740780) - ipmitool: disabled automatic bridging of SDR readings to IPMB in verbose mode (#749796) - ipmitool: fixed reporting of usage of various delloem subcommands (#658762) - added path to /sbin to lsmod and modprobe (#829705) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 pidgin [2.7.9-10.el6_4.1] - Fix spec file for disttag [2.7.9-10.el6] - Add patch for CVE-2013-0274 (RH bug #910653). [2.7.9-9.el6] - Add patch for CVE-2013-0273 (RH bug #910653). [2.7.9-8.el6] - Add patch for CVE-2013-0272 (RH bug #910653). [2.7.9-7.el6] - Add patch for CVE-2011-2485 (RH bug #837562). [2.7.9-6.el6] - Add patch for CVE-2012-1178 (RH bug #837560). - Add patch for CVE-2012-2318 (RH bug #837560). - Add patch for CVE-2012-3374 (RH bug #837560). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-348.4.1] - [virt] xen-netback: backports (Andrew Jones) [910884 910885] {CVE-2013-0216} - [virt] xen-netback: netif_schedulable should take a netif (Andrew Jones) [910884 910885] {CVE-2013-0216} - [virt] pciback: rate limit error mess from pciback_enable_msi() (Igor Mammedov) [910876 910877] {CVE-2013-0231} - [net] be2net: remove BUG_ON() in be_mcc_compl_is_new() (Ivan Vecera) [923910 907524] - [net] ipv4: Update MTU to all related cache entries (Amerigo Wang) [923353 905190] - [net] annotate rt_hash_code() users (Amerigo Wang) [923353 905190] - [net] xfrm_user: fix info leak in copy_to_user_state() (Thomas Graf) [922426 922427] {CVE-2012-6537} - [net] xfrm_user: fix info leak in copy_to_user_policy() (Thomas Graf) [922426 922427] {CVE-2012-6537} - [net] xfrm_user: fix info leak in copy_to_user_tmpl() (Thomas Graf) [922426 922427] {CVE-2012-6537} - [net] atm: fix info leak in getsockopt(SO_ATMPVC) (Thomas Graf) [922384 922385] {CVE-2012-6546} - [net] atm: fix info leak via getsockname() (Thomas Graf) [922384 922385] {CVE-2012-6546} - [net] tun: fix ioctl() based info leaks (Thomas Graf) [922348 922349] {CVE-2012-6547} - [net] llc, zero sockaddr_llc struct (Thomas Graf) [922327 922329] {CVE-2012-6542} - [net] llc: fix info leak via getsockname() (Thomas Graf) [922327 922329] {CVE-2012-6542} - [net] xfrm_user: return error pointer instead of NULL (Thomas Graf) [919386 919387] {CVE-2013-1826} - [net] ixgbevf: allocate room for mailbox MSI-X interrupt's name (Laszlo Ersek) [924134 862862] - [fs] knfsd: allow nfsd READDIR to return 64bit cookies (Niels de Vos) [924087 918952] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-164.11.1.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb ( John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina yang) [orabug 6993043] [bz 7258] - [MM] shrink zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - FP register state is corrupted during the handling a SIGSEGV (Chuck Anderson) [orabug 7708133] [2.6.18-164.11.1.el5] - [firewire] ohci: handle receive packets with zero data (Jay Fenlason) [547241 547242] {CVE-2009-4138} - [x86] sanity check for AMD northbridges (Andrew Jones) [549905 547518] - [x86_64] disable vsyscall in kvm guests (Glauber Costa) [550968 542612] - [fs] ext3: replace lock_super with explicit resize lock (Eric Sandeen) [549908 525100] - [fs] respect flag in do_coredump (Danny Feng) [544188 544189] {CVE-2009-4036} - [gfs2] make O_APPEND behave as expected (Steven Whitehouse) [547521 544342] - [fs] hfs: fix a potential buffer overflow (Amerigo Wang) [540740 540741] {CVE-2009-4020} - [fuse] prevent fuse_put_request on invalid pointer (Danny Feng) [538736 538737] {CVE-2009-4021} - [mm] call vfs_check_frozen after unlocking the spinlock (Amerigo Wang) [548370 541956] - [infiniband] init neigh->dgid.raw on bonding events (Doug Ledford) [543448 538067] - [scsi] gdth: prevent negative offsets in ioctl (Amerigo Wang) [539420 539421] {CVE-2009-3080} - [fs] gfs2: fix glock ref count issues (Steven Whitehouse) [544978 539240] - [net] call cond_resched in rt_run_flush (Amerigo Wang) [547530 517588] - [scsi] megaraid: fix sas permissions in sysfs (Casey Dahlin) [537312 537313] {CVE-2009-3889 CVE-2009-3939} - [ia64] kdump: restore registers in the stack on init (Takao Indoh ) [542582 515753] - [x86] kvm: don't ask HV for tsc khz if not using kvmclock (Glauber Costa ) [537027 531268] - [net] sched: fix panic in bnx2_poll_work (John Feeney ) [539686 526481] - [x86_64] fix 32-bit process register leak (Amerigo Wang ) [526797 526798] - [cpufreq] add option to avoid smi while calibrating (Matthew Garrett ) [537343 513649] - [kvm] use upstream kvm_get_tsc_khz (Glauber Costa ) [540896 531025] - [net] fix unbalance rtnl locking in rt_secret_reschedule (Neil Horman ) [549907 510067] - [net] r8169: imporved rx length check errors (Neil Horman ) [552913 552438] - [scsi] lpfc: fix FC ports offlined during target controller faults (Rob Evers ) [549906 516541] - [net] emergency route cache flushing fixes (Thomas Graf ) [545662 545663] {CVE-2009-4272} - [fs] fasync: split 'fasync_helper()' into separate add/remove functions (Danny Feng ) [548656 548657] {CVE-2009-4141} - [scsi] qla2xxx: NPIV vport management pseudofiles are world writable (Tom Coughlan ) [537317 537318] {CVE-2009-3556} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [17.0.7-1.0.1.el6_4] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat ones [17.0.7-1] - Update to 17.0.7 ESR xulrunner [17.0.7-1.0.1.el6_4] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js - Removed XULRUNNER_VERSION from SOURCE21 [17.0.7-1] - Update to 17.0.7 ESR [17.0.6-5] - Added workaround for rhbz#973721 - fixing problem with installation of some addons [17.0.6-4] - Added a workaround for rhbz#961687 - Prelink throws message 'Cannot safely convert .rel.dyn' section from REL to RELA' [17.0.6-3] - Added patch for aliasing issues (mozbz#821502) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 gnutls [2.8.5-10.2] - fix CVE-2013-2116 - fix DoS regression in CVE-2013-1619 upstream patch (#966754) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 openssl [1.0.0-20.5] - fix for CVE-2012-2333 - improper checking for record length in DTLS (#820686) - properly initialize tkeylen in the CVE-2012-0884 fix Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [10.0.12-3.0.1.el6_3] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [10.0.12-3] - Update to 10.0.12 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 systemtap [1.3-4.1] - bz702687 (patch) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 openssl [1.0.0-27.2] - fix for CVE-2013-0169 - SSL/TLS CBC timing attack (#907589) - fix for CVE-2013-0166 - DoS in OCSP signatures checking (#908052) - enable compression only if explicitly asked for or OPENSSL_DEFAULT_ZLIB environment variable is set (fixes CVE-2012-4929 #857051) - use __secure_getenv() everywhere instead of getenv() (#839735) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 krb5 [1.10.3-10.3] - pull up fix for UDP ping-pong flaw in kpasswd service (CVE-2002-2443, Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.17.2] - x86/msr: Add capabilities check (Alan Cox) [Orabug: 16405007] {CVE-2013-0268} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-300.37.1.] - sfc: Replace some literal constants with EFX_PAGE_SIZE/EFX_BUF_SIZE (Ben Hutchings) [Orabug: 14769994] - CVE-2012-3412 sfc: Fix maximum number of TSO segments and minimum TX queue size (Ben Hutchings) [Orabug: 14769994] {CVE-2012-3412} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 python [2.4.3-46.el5_8.2] - if hash randomization is enabled, also enable it within pyexpat Resolves: CVE-2012-0876 [2.4.3-46.el5_8.1] - distutils.commands.register: create ~/.pypirc securely Resolves: CVE-2011-4944 - send encoding in SimpleHTTPServer.list_directory to protect IE7 against potential XSS attacks Resolves: CVE-2011-4940 - oCERT-2011-003: add -R command-line option and PYTHONHASHSEED environment variable, to provide an opt-in way to protect against denial of service attacks due to hash collisions within the dict and set types Resolves: CVE-2012-1150 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php53 [5.3.3-1.6] - add security fix for CVE-2012-0830 (#786757) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk [1.6.0.0-1.27.1.10.8.0.1.el5_8] - Add oracle-enterprise.patch [1:1.6.0.0-1.27.1.10.8] - Modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch: - com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils. - packages added also to package.definition - Resolves: rhbz#828749 [1:1.6.0.0-1.26.1.10.8] - Updated to IcedTea6 1.10.8 - Modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch: - com.sun.org.apache.xerces.internal.utils.,com.sun.org.apache.xalan.internal.utils. - packages added to patch - Resolves: rhbz#828749 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 openldap [2.3.43-12.1] - fixed segfault issues in modrdn (#606375) - added patch handling null char in TLS to compat package (#606375, patch backported by Jan Vcelak <jvcelak@redhat.com>) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-firmware kernel-headers ofa [2.6.32-100.20.1.el5] - [fs] xfs: return inode fork offset in bulkstat for fsr (Dave Chinner) - [fs] xfs: always use iget in bulkstat (Dave Chinner) {CVE-2010-2943} - [fs] xfs: validate untrusted inode numbers during lookup (Dave Chinner) {CVE-2 010-2943} - [fs] xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED (Dave Chinner) {CVE-2 010-2943} - [net] net sched: fix some kernel memory leaks (Eric Dumazet) {CVE-2010-2942} - [fs] ocfs2: Don't walk off the end of fast symlinks (Joel Becker) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 conga [0.12.2-24.0.1.el5_6.1] - Added conga-enterprise.patch - Added conga-enterprise-Carthage.patch to support OEL5 - Recreated Data.fs in luci_db.tar.gz - Replaced redhat logo image in conga-0.12.2.tar.gz [0.12.2-24.1] - Fix bz680515 (CVE-2011-0720 plone: unauthorized remote administrative access) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 jakarta-commons-httpclient [1:3.1-0.7] - Add missing connection hostname check against X.509 certificate name - Resolves: CVE-2012-5783 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.7.0-openjdk [1.7.0.25-2.3.10.4.0.1.el5_9] - Add oracle-enterprise.patch - Fix DISTRO_NAME to 'Enterprise Linux' [1.7.0.25-2.3.10.4.el5] - updated to newer IcedTea7-forest 2.3.10 with 8010118 fix - removed upstreamed patch1000 MBeanFix.patch - Resolves: rhbz#973117 [1.7.0.25-2.3.10.3.el5] - reverted fix for license files owning - Resolves: rhbz#973117 [1.7.0.25-2.3.10.2.el5] - added patch1000 MBeanFix.patch to fix regressions caused by security patches - Resolves: rhbz#973117 [1.7.0.25-2.3.10.1.el6] - build bumped to 25 - Resolves: rhbz#973117 [1.7.0.19-2.3.10.0.el5] - Updated to latest IcedTea7-forest 2.3.10 - patch 107 renamed to 500 for cosmetic purposes - Added fix for RH857717, owned /etc/.java/ and /etc/.java/.systemPrefs - Resolves: rhbz#973117 [1.7.0.19-2.3.10.0.el5] - Updated to latest IcedTea7-forest 2.3.10 - Resolves: rhbz#973117 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 gnutls [2.8.5-10.1] - fix CVE-2013-1619 - fix TLS-CBC timing attack (#908238) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sos [1.7-9.62.0.1.el5] - add patch to remove all sysrq echo commands from sysreport.legacy (John Sobecki) [orabug 11061754] - comment out rh-upload-core and README.rh-upload-core in specfile Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 cups [1:1.4.2-50:.4] - Added BrowseLDAPCACertFile and PrintcapGUI to restricted options list. [1:1.4.2-50:.3] - Fix for CVE-2012-5519 patch: handle blacklisted lines that have no value part gracefully. [1:1.4.2-50:.2] - Added documentation for new CVE-2012-5519 option. [1:1.4.2-50:.1] - Applied patch to fix CVE-2012-5519 (privilege escalation for users in SystemGroup or with equivalent polkit permission). This prevents HTTP PUT requests with paths under /admin/conf/ other than that for cupsd.conf, and also prevents such requests altering certain configuration directives such as PageLog and FileDevice (bug #875898). [1:1.4.2-50] - Fixed LDAP browsing issues (bug #870386). [1:1.4.2-49] - Avoid 'forbidden' error when moving job between queues via web UI (bug #834445). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 elinks [0.12-0.21.pre5] - do not delegate GSSAPI credentials (CVE-2012-4545) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.7.0-openjdk [1.7.0.9-2.3.8.0.0.1.el5_9] - Add oracle-enterprise.patch - Fix DISTRO_NAME to 'Enterprise Linux' [1.7.0.9-2.3.8.0.el5_9] - Updated to icedtea7-forest-2.3 - Resolves: rhbz#917181 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-348.1.1] - [pci] intel-iommu: reduce max num of domains supported (Don Dutile) [886876 885125] - [fs] gfs2: Fix leak of cached directory hash table (Steven Whitehouse) [886124 831330] - [x86] mm: randomize SHLIB_BASE (Petr Matousek) [804953 804954] {CVE-2012-1568} - [net] be2net: create RSS rings even in multi-channel configs (Ivan Vecera) [884702 878209] - [net] tg3: Avoid dma read error (John Feeney) [885692 877474] - [misc] Fix unsupported hardware message (Prarit Bhargava) [885063 876587] - [net] ipv6: discard overlapping fragment (Jiri Pirko) [874837 874838] {CVE-2012-4444} - [usb] Fix serial port reference counting on hotplug remove (Don Zickus) [885700 845447] - [net] bridge: export its presence and fix bonding igmp reporting (Veaceslav Falico) [884742 843473] - [fs] nfs: move wait for server->active from put_super to kill_sb (Jeff Layton) [884708 839839] - [scsi] libfc: fix indefinite rport restart (Neil Horman) [884740 595184] - [scsi] libfc: Retry a rejected PRLI request (Neil Horman) [884740 595184] - [scsi] libfc: Fix remote port restart problem (Neil Horman) [884740 595184] - [xen] memop: limit guest specified extent order (Laszlo Ersek) [878449 878450] {CVE-2012-5515} - [xen] get bottom of EBDA from the multiboot data structure (Paolo Bonzini) [885062 881885] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gtk2 [2.10.4-29] - Improve patch to parse CUPS user lpoptions file to avoid crashes on s390 and ia64 Resolves: #603809 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 httpd [2.2.15-28.0.1.el6_4] - replace index.html with Oracle's index page oracle_index.html update vstring in specfile [2.2.15-28] - mod_rewrite: add security fix for CVE-2013-1862 (#953729) [2.2.15-27] - add security fixes for CVE-2012-3499, CVE-2012-4558 (#915883, #915884) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm [83-249.0.1.el5_8.5] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch [83-249.el5_8.5] - kvm-console-bounds-check-whenever-changing-the-cursor-du-58.patch [bz#851255] - CVE: CVE-2012-3515 - Resolves: bz#851255 (EMBARGOED CVE-2012-3515 qemu/kvm: VT100 emulation vulnerability [rhel-5.8.z]) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel This update fixes the following security issues: * Using the SG_IO ioctl to issue SCSI requests to partitions or LVM volumes resulted in the requests being passed to the underlying block device. If a privileged user only had access to a single partition or LVM volume, they could use this flaw to bypass those restrictions and gain read and write access (and be able to issue other SCSI commands) to the entire block device. Refer to Red Hat Knowledgebase article DOC-67874, linked to in the References, for further details about this issue. (CVE-2011-4127, Important) * A flaw was found in the way the Linux kernel handled robust list pointers of user-space held futexes across exec() calls. A local, unprivileged user could use this flaw to cause a denial of service or, eventually, escalate their privileges. (CVE-2012-0028, Important) * A flaw was found in the Linux kernel in the way splitting two extents in ext4_ext_convert_to_initialized() worked. A local, unprivileged user with the ability to mount and unmount ext4 file systems could use this flaw to cause a denial of service. (CVE-2011-3638, Moderate) * A flaw was found in the way the Linux kernel's journal_unmap_buffer() function handled buffer head states. On systems that have an ext4 file system with a journal mounted, a local, unprivileged user could use this flaw to cause a denial of service. (CVE-2011-4086, Moderate) * A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query() function. An attacker able to send certain IGMP (Internet Group Management Protocol) packets to a target system could use this flaw to cause a denial of service. (CVE-2012-0207, Moderate) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [17.0.3-1.0.1.el6_3] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [17.0.3-1] - Update to 17.0.3 ESR [17.0.2-2] - Update to 17.0.2 ESR [17.0-2] - Update to 17.0 ESR [17.0b2-0.1] - Update to 17.0b2 [17.0b1-0.1] - Rebase to 17 beta 1 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 quota [1:3.13-8.0.1] - Add ocfs2 support (Orabug: 14208111) [1:3.13-8] - Fix CVE-2012-3417 (incorrect use of tcp_wrappers) (Resolves: #841448) [1:3.13-7] - Fix parsing numeric arguments of setquota (Resolves: #831520) [1:3.13-6] - Do not use real domains in warnquota example (Resolves: #680429) - Use /proc/mounts for mountpoint scanning (Resolves: #689822) - Use rq_bsize to convert quotas transferred by RPC (bug #667360) - Make RPC block factor dynamic (bug #667360) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 pam_krb5 [2.2.14-15] - update backport for selecting which key to use for validation so that it prefers services with the local host name as the instance, from HEAD (more of #450776) [2.2.14-14] - backport the 'multiple_ccaches' option from HEAD, requiring that it be enabled to not immediately remove an old ccache when asked to create a new one (#463417) [2.2.14-13] - add patch to add the 'chpw_prompt' option, to allow the older behavior of attempting a password-change during authentication if libkrb5 detects an expired password, based on patch from Olivier Fourdan (#509092) [2.2.14-12] - dont vary the password prompt depending on whether or not the user exists or is known to the KDC (CVE-2009-1384, #505265) - prefer using the 'host' service when verifying that a TGT isnt forged, from HEAD (#450776) [2.2.14-11] - dont enforce minimum_uid when no_user_check is also used, from HEAD (#490404) - dont try to get password-changing creds with all of the flags set that we would request for a TGT (#489015) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php [5.1.6-39] - fix issue in CVE-2012-0057 patch [5.1.6-38] - fix memory handling in CVE-2012-0789 patch [5.1.6-37] - add security fixes for CVE-2012-0057, CVE-2011-4153, CVE-2012-0789, CVE-2012-1172 [5.1.6-36] - add security fix for CVE-2012-2336 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.23.1] - Parallel mtrr init between cpus (Zhenzhong Duan) [Orabug: 16777774] - Merge tag 'v2.6.39-400.21.1.16748891' of git://ca-git.us.oracle.com/linux-uek-2.6.39-ofed into uek-2.6.39-400 (Maxim Uvarov) [Orabug: 16748891] - xen-blkfront: use a different scatterlist for each request (Roger Pau Monne) - Fix EN driver to work with newer FWs based on latest mlx4_core (Yuval Shaia) [Orabug: 16748891] [2.6.39-400.22.1] - block: default SCSI command filter does not accomodate commands overlap across device classes (Jamie Iles) [Orabug: 16387137] {CVE-2012-4542} - Merge tag 'v2.6.39-400.21.1#bug16684527' of git://ca-git.us.oracle.com/linux-joejin-public into uek-2.6.39-400_errata (Maxim Uvarov) [Orabug: 16684527] - KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797) (Andy Honig) [Orabug: 16711660] {CVE-2013-1797} - Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() (Anderson Lizardo) [Orabug: 16711065] {CVE-2013-0349} - USB: io_ti: Fix NULL dereference in chase_port() (Wolfgang Frisch) [Orabug: 16425358] {CVE-2013-1774} - keys: fix race with concurrent install_user_keyrings() (David Howells) [Orabug: 16493354] {CVE-2013-1792} - KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) (Andy Honig) [Orabug: 16710951] {CVE-2013-1798} - KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) (Andy Honig) [Orabug: 16710806] {CVE-2013-1796} - tmpfs: fix use-after-free of mempolicy object (Greg Thelen) [Orabug: 16515833] {CVE-2013-1767} - procfs: do not confuse jiffies with cputime64_t (Andreas Schwab) [Orabug: 16673925] - procfs: do not overflow get_{idle,iowait}_time for nohz (Michal Hocko) [Orabug: 16673925] - xen/evtchn: Handle VIRQ_TIMER before any other hardirq in event loop. (Keir Fraser) [Orabug: 16093126] - Fix device removal NULL pointer dereference (Joe Jin) [Orabug: 16684527] - put stricter guards on queue dead checks (James Bottomley) [Orabug: 16684527] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 openswan [2.6.32-20] Resolves: #960234 - CVE-2013-2053 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.7.0-openjdk [1.7.0.9-2.3.7.1.0.2.el6_3] - Increase release number and rebuild. [1.7.0.9-2.3.7.1.0.1.el6_3] - Update DISTRO_NAME in specfile [1.7.0.9-2.3.7.1.el6_3] - Updated main source tarball - Resolves: rhbz#911529 [1.7.0.9-2.3.7.0.el6_3] - Removed patch1000 sec-2013-02-01-8005615.patch - Removed patch1001 sec-2013-02-01-8005615-sync_with_jdk7u.patch - Removed patch1010 sec-2013-02-01-7201064.patch - Removed testing - mauve was outdated and - jtreg was icedtea relict - Updated to icedtea 2.3.7 - Added java -Xshare:dump to post (see 513605) fo jitarchs - Resolves: rhbz#911529 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek: [2.6.32-300.27.1.el6uek] - net: sock: validate data_len before allocating skb (Jason Wang) [Bugdb: 13966]{CVE-2012-2136} - fcaps: clear the same personality flags as suid when fcaps are used (Eric Paris) [Bugdb: 13966] {CVE-2012-2123} - Revert 'nfs: when attempting to open a directory, fall back on normal lookup (Todd Vierling) [Orabug 14141154] [2.6.32-300.26.1.el6uek] - mptsas: do not call __mptsas_probe in kthread (Maxim Uvarov) [Orabug: 14175509] - mm: check if any page in a pageblock is reserved before marking it MIGRATE_RESERVE (Maxim Uvarov) [Orabug: 14073214] - mm: reduce the amount of work done when updating min_free_kbytes (Mel Gorman) [Orabug: 14073214] - vmxnet3: Updated to el6-u2 (Guangyu Sun) [Orabug: 14027961] - xen: expose host uuid via sysfs. (Zhigang Wang) - sched: Fix cgroup movement of waking process (Daisuke Nishimura) [Orabug: 13946210] - sched: Fix cgroup movement of newly created process (Daisuke Nishimura) [Orabug: 13946210] - sched: Fix cgroup movement of forking process (Daisuke Nishimura) [Orabug: 13946210] - x86, boot: Wait for boot cpu to show up if nr_cpus limit is about to hit (Zhenzhong Duan) [Orabug: 13629087] - smp: Use nr_cpus= to set nr_cpu_ids early (Zhenzhong Duan) [Orabug: 13629087] - net: ipv4: relax AF_INET check in bind() (Maxim Uvarov) [Orabug: 14054411] ofa-2.6.32-300.27.1.el6uek: [1.5.1-4.0.58] - Add Patch 158-169 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 bind [32:9.8.2-0.10.rc1.5] - fix CVE-2012-5166 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.109.1] - while removing a non-empty directory, the kernel dumps a message: (rmdir,21743,1):ocfs2_unlink:953 ERROR: status = -39 (Xiaowei.Hu) [Orabug: 16790405] - stop mig handler when lockres in progress ,and return -EAGAIN (Xiaowei.Hu) [Orabug: 16876446] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 rgmanager [2.0.52-21] - rgmanager: Fix bad passing of SFL_FAILURE up (fix_bad_passing_of_sfl_failure_up.patch) Resolves: rhbz#711521 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ipa-client [2.1.3-5.2] - Add missing man page option --ca-cert-file. (#878217) [2.1.3-5.1] - Fix python syntax backport issue in CVE patch. (#878217) [2.1.3-5] - Use secure method to retrieve IPA CA during client enrollment. CVE-2012-5484 (#878217) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bind97 [32:9.7.0-17.P2.1] - fix CVE-2013-2266 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk [1:1.6.0.0-1.17.b17.0.1.el5] - Add oracle-enterprise.patch [1:1.6.0.0-1.17.b17.el5] - Updated to 1.7.7 tarball - Resolves: bz668487 - Also resolves bz668488 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [17.0.7-1.0.1.el6_4] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [17.0.7-1] - Update to 17.0.7 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-308.13.1.0.1.el5] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [net] bonding: fix carrier detect when bond is down [orabug 12377284] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] [2.6.18-308.13.1.el5] - [net] e1000e: Cleanup logic in e1000_check_for_serdes_link_82571 (Dean Nelson) [841370 771366] - [net] e1000e: Correct link check logic for 82571 serdes (Dean Nelson) [841370 771366] - [mm] NULL pointer dereference in __vm_enough_memory (Jerome Marchand) [840077 836244] - [fs] dlm: fix slow rsb search in dir recovery (David Teigland) [838140 753244] - [fs] autofs: propogate LOOKUP_DIRECTORY flag only for last comp (Ian Kent) [830264 814418] - [fs] ext4: properly dirty split extent nodes (Eric Sandeen) [840946 839770] - [scsi] don't offline devices with a reservation conflict (David Jeffery) [839196 835660] - [fs] ext4: Fix overflow caused by missing cast in ext4_fallocate (Lukas Czerner) [837226 830351] - [net] dl2k: Clean up rio_ioctl (Weiping Pan) [818822 818823] {CVE-2012-2313} - [x86] sched: Avoid unnecessary overflow in sched_clock (Prarit Bhargava) [835450 834562] - [net] tg3: Fix TSO handling (John Feeney) [833182 795672] - [input] evdev: use after free from open/disconnect race (David Jeffery) [832448 822166] [2.6.18-308.12.1.el5] - [fs] nfs: Don't allow multiple mounts on same mntpnt with -o noac (Sachin Prabhu) [839806 839753] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sudo [1.7.2p1-14.2] - added a workaround for a race condition in handling child processes Resolves: rhbz#844978 [1.7.2p1-14.1] - dont remove the sudoers: line from nsswitch.conf on update - use safe temporary file for nsswitch.conf - call restorecon after modifying nsswitch.conf - fixed command escaping - patch: Use SIG_SETMASK when resetting signal mask instead of SIG_UNBLOCK Resolves: rhbz#842759 Resolves: rhbz#844420 Resolves: rhbz#844419 Resolves: rhbz#844418 Resolves: rhbz#844443 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php53 [5.3.3-13.1] - add security fix for CVE-2013-4113 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 devhelp firefox xulrunner yelp libproxy firefox [17.0.3-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat ones [17.0.3-1] - Update to 17.0.3 ESR [17.0.2-4] - Added NM preferences [17.0.2-3] - Update to 17.0.2 ESR libproxy [0.3.0-4] - Rebuild against newer gecko xulrunner [17.0.3-1.0.2] - Increase release number and rebuild. [17.0.3-1.0.1] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js - Removed XULRUNNER_VERSION from SOURCE21 [17.0.3-1] - Update to 17.0.3 ESR [17.0.2-5] - Fixed NetworkManager preferences - Added fix for NM regression (mozbz#791626) [17.0.2-2] - Added fix for rhbz#816234 - NFS fix [17.0.2-1] - Update to 17.0.2 ESR [17.0.1-3] - Update to 17.0.1 ESR [17.0-1] - Update to 17.0 ESR [17.0-0.6.b5] - Update to 17 Beta 5 - Updated fix for rhbz#872752 - embeded crash [17.0-0.5.b4] - Added fix for rhbz#872752 - embeded crash [17.0-0.4.b4] - Update to 17 Beta 4 [17.0-0.3.b3] - Update to 17 Beta 3 - Updated ppc(64) patch (mozbz#746112) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 samba [3.5.10-115] - Security Release, fixes CVE-2012-1182 - resolves: #804644 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-100.35.1.el6uek] - [net] dccp: handle invalid feature options length {CVE-2011-1770} - [net] can: add missing socket check in can/raw release {CVE-2011-1748} - [net] can: Add missing socket check in can/bcm release {CVE-2011-1598} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-300.28.1] - kmod: make __request_module() killable (Oleg Nesterov) [Orabug: 16286305] {CVE-2012-4398} - kmod: introduce call_modprobe() helper (Oleg Nesterov) [Orabug: 16286305] {CVE-2012-4398} - usermodehelper: implement UMH_KILLABLE (Oleg Nesterov) [Orabug: 16286305] {CVE-2012-4398} - usermodehelper: introduce umh_complete(sub_info) (Oleg Nesterov) [Orabug: 16286305] {CVE-2012-4398} - KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE bit set (CVE-2012-4461) (Jerry Snitselaar) [Orabug: 16286290] {CVE-2012-4461} - exec: do not leave bprm->interp on stack (Kees Cook) [Orabug: 16286267] {CVE-2012-4530} - exec: use -ELOOP for max recursion depth (Kees Cook) [Orabug: 16286267] {CVE-2012-4530} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 samba3x [3.5.4-0.70.1] - Security Release, fixes CVE-2011-0719 - resolves: #678332 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 nspr nss nspr [4.9.2-4] - Resolves: rhbz#924741 - Rebase to nspr-4.9.5 nss [3.14.3-6] - Resolves: rhbz#986969 - nssutil_ReadSecmodDB() leaks memory [3.14.3-5] - Define -DNO_FORK_CHECK when compiling softoken for ABI compatibility - Remove the unused and obsolete nss-nochktest.patch - Resolves: rhbz#949845 - [RFE][RHEL5] Rebase to nss-3.14.3 to fix the lucky-13 issue [3.14.3-4] - Fix rpmdiff test reported failures and remove other unwanted changes - Resolves: rhbz#949845 - [RFE][RHEL5] Rebase to nss-3.14.3 to fix the lucky-13 issue [3.14.3-3] - Update to NSS_3_14_3_RTM - Rework the rebase to preserve needed idiosynchracies - Ensure we install frebl/softoken from the extra build tree - Don't include freebl static library or its private headers - Add patch to deal with system sqlite not being recent enough - Don't install nss-sysinit nor sharedb - Resolves: rhbz#949845 - [RFE][RHEL5] Rebase to nss-3.14.3 to fix the lucky-13 issue [3.14.3-2] - Restore the freebl-softoken source tar ball updated to 3.14.3 - Renumbering of some sources for clarity - Resolves: rhbz#918870 - [RFE][RHEL5] Rebase to nss-3.14.3 to fix the lucky-13 issue [3.14.3-1] - Update to NSS_3_14_3_RTM - Resolves: rhbz#918870 - [RFE][RHEL5] Rebase to nss-3.14.3 to fix the lucky-13 issue Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 vixie-cron [4:4.1-81] - 455664 adoptions of crontab orphans, forgot add buffer for list of orphans - Related: rhbz#455664 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 xorg-x11-server [1.7.7-29.2] - cve-2011-4818.patch: Multiple input sanitization flaws in GLX and Render Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk [ 1:1.6.0.0-1.33.1.11.6.0.1.el5_9] - Add oracle-enterprise.patch [1:1.6.0.0-1.33.1.11.6] - removed patch9 revertTwoWrongSecurityPatches2013-02-06.patch - added patch9: 7201064.patch to be reverted - added patch10: 8005615.patch to fix the 6664509.patch - Resolves: rhbz#906705 [1:1.6.0.0-1.32.1.11.6] - added patch9 revertTwoWrongSecurityPatches2013-02-06.patch to remove 6664509 and 7201064 from 1.11.6 tarball - Resolves: rhbz#906705 [1:1.6.0.0-1.31.1.11.6] - Updated to icedtea6 1.11.6 - Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch - Resolves: rhbz#906705 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 boost [1.41.0-15] - Add in explicit dependences between some boost subpackages [1.41.0-14] - Build with -fno-strict-aliasing [1.41.0-13] - In Boost.Pool, be careful not to overflow allocated chunk size (boost-1.41.0-pool.patch) [1.41.0-12] - Add an upstream patch that fixes computation of CRC in zlib streams. - Resolves: #707624 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ccid [1.3.8-2] - fix voltage issue Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 pcsc-lite [1.4.4-4] - Fix second typo in overflow patch from upstream [1.4.4-3] - Fix typo in patch [1.4.4-2] - Fix buffer overflow issues Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 autofs [5.0.1-0.rc2.177.0.1.el5] - apply fix from NetApp to use tcp before udp http://www.mail-archive.com/autofs@linux.kernel.org/msg07910.html (Bert Barbe) [orabug 6827898] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-348.12.1] - Revert: [fs] afs: export a couple of core functions for AFS write support (Lukas Czerner) [960014 692071] - Revert: [fs] ext4: drop ec_type from the ext4_ext_cache structure (Lukas Czerner) [960014 692071] - Revert: [fs] ext4: handle NULL p_ext in ext4_ext_next_allocated_block() (Lukas Czerner) [960014 692071] - Revert: [fs] ext4: make FIEMAP and delayed allocation play well together (Lukas Czerner) [960014 692071] - Revert: [fs] ext4: Fix possibly very long loop in fiemap (Lukas Czerner) [960014 692071] - Revert: [fs] ext4: prevent race while walking extent tree for fiemap (Lukas Czerner) [960014 692071] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.24.1] - perf: Treat attr.config as u64 in perf_swevent_init() (Tommi Rantala) [Orabug: 16808734] {CVE-2013-2094} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel [2.6.18-194.11.1.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb (John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524] - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki, Chris Mason, Herbert van den Bergh) [orabug 9245919] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel This update fixes the following security issues: * A use-after-free flaw was found in the madvise() system call implementation in the Linux kernel. A local, unprivileged user could use this flaw to cause a denial of service or, potentially, escalate their privileges. (CVE-2012-3511, Moderate) * A flaw was found in the way the Linux kernel's TCP/IP protocol suite implementation handled IPv6 sockets that used the UDP_CORK option. A local, unprivileged user could use this flaw to cause a denial of service. (CVE-2013-4162, Moderate) * An information leak flaw in the Linux kernel could allow a local, unprivileged user to leak kernel memory to user-space. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 nspr nss nspr-devel nss-devel nss-pkcs11-devel nss-tools nspr [4.9.2-2] - NVR bump [4.9.2-1] - Resolves: rhbz#893372- [RFE] Rebase nspr to 4.9.2 due to Firefox 17 ESR nss [3.13.6-3] - Fix changelog inconsistencies with commit and bug resolved - Resolves: rhbz#891149 [CVE-2013-0743] [3.13.6-2] - [CVE-2013-0743] - Resolves: rhbz#891149 - Dis-trust TURKTRUST mis-issued *.google.com certificate [3.13.6-1] - Update to NSS_3_13_6_RTM - Resolves: rhbz#893371 - [RFE] [RHEL5] Rebase to NSS >= 3.13.6 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ruby [1.8.5-29] - Fix regression introduced by fix for entity expansion DOS vulnerability in REXML (https://bugs.ruby-lang.org/issues/7961) * ruby-2.0.0-add-missing-rexml-require.patch - Related: rhbz#915377 [1.8.5-28] - Addresses entity expansion DoS vulnerability in REXML. * ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch - Resolves: rhbz#915377 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [17.0.10-1.0.1.el6_4] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [17.0.10-1] - Update to 17.0.10 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [17.0.6-2.0.1.el6_4] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [17.0.6-2] - Update to 17.0.6 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php53 [5.3.3-13] - add security fix for CVE-2010-2950 [5.3.3-11] - fix tests for CVE-2012-2143, CVE-2012-0789 [5.3.3-10] - add security fix for CVE-2012-2336 [5.3.3-9] - add security fixes for CVE-2011-4153, CVE-2012-0057, CVE-2012-0789, CVE-2012-1172, CVE-2012-2143, CVE-2012-2386 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.7.0-openjdk [1.7.0.19-2.3.9.1.0.1.el5_9] - Add oracle-enterprise.patch - Fix DISTRO_NAME to "Enterprise Linux" Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sudo [1.7.2p1-28] - backported fixes for CVE-2013-1775 CVE-2013-1776 CVE-2013-2776 CVE-2013-2777 Resolves: rhbz#968221 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm [kvm-83-249.0.1.el5_8.4] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch [kvm-83-249.el5_8.4] - kvm-kernel-KVM-unmap-pages-from-the-iommu-when-slots-are-remove.patch [bz#814151] - CVE: CVE-2012-2121 - Resolves: bz#814151 (CVE-2012-2121 kvm: device assignment page leak [rhel-5.8]) [kvm-83-249.el5_8.3] - kvm-fix-l1_map-buffer-overflow.patch [bz#816207] - Resolves: bz#816207 (qemu-kvm segfault in tb_invalidate_phys_page_range()) [kvm-83-249.el5_8.2] - kvm-kernel-KVM-Ensure-all-vcpus-are-consistent-with-in-kernel-i.patch [bz#808205] - Resolves: bz#808205 (CVE-2012-1601 kernel: kvm: irqchip_in_kernel() and vcpu->arch.apic inconsistency [rhel-5.8.z]) [kvm-83-249.el5_8.1] - kvm-posix-aio-compat-fix-thread-accounting-leak.patch [bz#802429] - Resolves: bz#802429 ([RHEL5.8 Snapshot2]RHEL5.8 KVMGuest hung during Guest OS booting up) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sudo [1.7.2p1-13] - patch: parse ldap.conf more closely to nss_ldap Resolves: rhbz#750318 [1.7.2p1-12] - added patch for CVE-2011-0010 Resolves: rhbz#757157 [1.7.2p1-11] - backported selinux support from 1.7.4p5 (#477185, #673157) - fixed bug in Runas_Spec group matching (#627543) - disable 'sudo -l' output word wrapping if the output is piped (#697111) - fixed overwriting of errno after execve failure (#673157) - fixed segmentation fault (#673072) - add a sudoers entry to the nsswitch.conf file on install (and delete it on uninstall) (#617061) Resolves: rhbz#697111 Resolves: rhbz#673157 Resolves: rhbz#673072 Resolves: rhbz#627543 Resolves: rhbz#617061 Resolves: rhbz#477185 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 tomcat5 [0:5.5.23-0jpp.40] - Related: CVE-2013-1976 It was found during additional testing - that the tomcat5 init may fail to start because the user - shell is set to sbin/nologin. Fixed in init scrip. SU now - uses -s /bin/sh during startup [0:5.5.23-0jpp.39] - Resolves: CVE-2013-1976 Improper TOMCAT_LOG management in - initscript. Change location of TOMCAT_LOG to /var/log so - only root can write to it. Touching TOMCAT_LOG is no longer - required during initscript startup. Permissions and ownership - changed to 0755 tomcat:root for logdir Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 xorg-x11-server [1.13.0-11.1.2] - CVE-2013-4396: Fix use-after free in ImageText requests (#1014561) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 freetype [2.3.11-14.el6_3.1] - Fix CVE-2012-5669 (Use correct array size for checking 'glyph_enc') - Resolves: #903542 [2.3.11-14] - A little change in configure part - Related: #723468 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-348.16.1] - [x86_64] Fix kdump failure due to 'x86_64: Early segment setup' (Paolo Bonzini) [988251 987244] - [xen] skip tracing if it was disabled instead of dying (Igor Mammedov) [987976 967053] - [ia64] fix KABI breakage on ia64 (Prarit Bhargava) [966878 960783] - [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531] - [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531] - [x86-64] non lazy 'sleazy' fpu implementation (Prarit Bhargava) [948187 731531] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-400.29.1] - KVM: add missing void __user COPYING CREDITS Documentation Kbuild MAINTAINERS Makefile README REPORTING-BUGS arch block crypto drivers firmware fs include init ipc kernel lib mm net samples scripts security sound tools uek-rpm usr virt cast to access_ok() call (Heiko Carstens) [Orabug: 16941620] {CVE-2013-1943} - KVM: Validate userspace_addr of memslot when registered (Takuya Yoshikawa) [Orabug: 16941620] {CVE-2013-1943} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 hplip3 [3.9.8-15] - Another D-Bus fix, part of bug #501834. [3.9.8-14] - Create debugging files securely (CVE-2011-2722, bug #725830). [3.9.8-13] - Several parallel-install fixes (bug #501834). [3.9.8-12] - Applied patch to fix CVE-2010-4267, remote stack overflow vulnerability (bug #662740). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libpng [2:1.2.49-1] - Update to libpng 1.2.49, for minor security issues (CVE-2011-3048) Resolves: #812714 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [10.0.8-1.0.1.el6_3] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Replace clean.gif in tarball [10.0.8-1] - Update to 10.0.8 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 axis [0:1.2.1-2jpp.7] - Add missing connection hostname check against X.509 certificate name - Resolves: CVE-2012-5784 - Add patches to build with java 1.6 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.21.2] - KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797) (Andy Honig) [Orabug: 16711660] {CVE-2013-1797} - Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() (Anderson Lizardo) [Orabug: 16711065] {CVE-2013-0349} - USB: io_ti: Fix NULL dereference in chase_port() (Wolfgang Frisch) [Orabug: 16425358] {CVE-2013-1774} - keys: fix race with concurrent install_user_keyrings() (David Howells) [Orabug: 16493354] {CVE-2013-1792} - KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) (Andy Honig) [Orabug: 16710951] {CVE-2013-1798} - KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) (Andy Honig) [Orabug: 16710806] {CVE-2013-1796} - tmpfs: fix use-after-free of mempolicy object (Greg Thelen) [Orabug: 16515833] {CVE-2013-1767} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.7.0-openjdk [1.7.0.9-2.3.5.3.0.1.el6_3] - Update DISTRO_NAME in specfile [1.7.0.9-2.3.5.3.el6_3] - Sync logging fixes with upstream (icedtea7-forest and jdk7u) [1.7.0.9-2.3.5.1.el6_3] - Removed 6664509 backout and added 8005615 to fix the issue [1.7.0.9-2.3.5.el6_3.1] - Backed out 6664509 and 7201064.patch which cause regressions [1.7.0.9-2.3.5.el6_3] - Bumped to 2.3.5 - Changed BR to java7-devel >= 1:1.7.0 as required by CORBA changes in 2.3.5 - Resolves: rhbz#906707 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [10.0.12-1.0.1.el6_3] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat ones [10.0.12-1] - Update to 10.0.12 ESR xulrunner [10.0.12-1.0.1.el6_3] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.12-1] - Update to 10.0.12 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.7.0-openjdk [1.7.0.9-2.3.4.1.0.1.el6_3] - Update DISTRO_NAME in specfile [1.7.0.9-2.3.4.1.el6] - Rewerted to IcedTea 2.3.4 - rewerted patch105: java-1.7.0-openjdk-disable-system-lcms.patch - removed jxmd and idlj to alternatives - make NOT executed with DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true - re-applied patch302 and restored systemtap.patch - buildver set to 9 - icedtea_version set to 2.3.4 - unapplied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch - restored tmp-patches source tarball - removed /lib/security/US_export_policy.jar and lib/security/local_policy.jar - java-1.7.0-openjdk-java-access-bridge-security.patch's path moved from java.security-linux back to java.security - Resolves: rhbz#895033 [1.7.0.11-2.4.0.1.el6] - Rewritten patch105: java-1.7.0-openjdk-disable-system-lcms.patch - Added jxmd and idlj to alternatives - make executed with DISABLE_INTREE_EC=true and UNLIMITED_CRYPTO=true - Unapplied patch302 and deleted systemtap.patch - buildver increased to 11 - icedtea_version set to 2.4.0 - Added and applied patch112 java-1.7.openjdk-doNotUseDisabledEcc.patch - removed tmp-patches source tarball - Added /lib/security/US_export_policy.jar and lib/security/local_policy.jar - Resolves: rhbz#895033 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox: [10.0.5-1.0.1.el6_2] - Replace firefox-redhat-default-prefs.js with firefox-oracle-default-prefs.js [10.0.5-1] - Update to 10.0.5 ESR xulrunner: [10.0.5-1.0.1.el6_2] - Replace xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.5-1] - Update to 10.0.5 ESR [10.0.4-2] - Added patch for mozbz#703633 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 samba3x [3.6.6-0.136] - resolves: #984807 - CVE-2013-4124: DoS via integer overflow when reading an EA list Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 php [5.3.3-23] - add security fix for CVE-2013-4113 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-100.10.1.el6uek] - thp: avoid atomic64_read in pmd_read_atomic for 32bit PAE (Andrea Arcangeli) [Orabug: 14217003] [2.6.39-100.9.1.el6uek] - mm: pmd_read_atomic: fix 32bit PAE pmd walk vs pmd_populate SMP race condition (Andrea Arcangeli) [Bugdb: 13966] {CVE-2012-2373} - mm: thp: fix pmd_bad() triggering in code paths holding mmap_sem read mode (Andrea Arcangeli) {CVE-2012-1179} - KVM: Fix buffer overflow in kvm_set_irq() (Avi Kivity) [Bugdb: 13966] {CVE-2012-2137} - net: sock: validate data_len before allocating skb in sock_alloc_send_pskb() (Jason Wang) [Bugdb: 13966] {CVE-2012-2136} - KVM: lock slots_lock around device assignment (Alex Williamson) [Bugdb: 13966] {CVE-2012-2121} - KVM: unmap pages from the iommu when slots are removed (Alex Williamson) [Bugdb: 13966] {CVE-2012-2121} - KVM: introduce kvm_for_each_memslot macro (Xiao Guangrong) [Bugdb: 13966] - fcaps: clear the same personality flags as suid when fcaps are used (Eric Paris) [Bugdb: 13966] {CVE-2012-2123} [2.6.39-100.8.1.el6uek] - net: ipv4: relax AF_INET check in bind() (Eric Dumazet) [Orabug: 14054411] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 httpd [2.2.3-31.0.1.el5_4.4] - Replace index.html with Oracle's index page oracle_index.html - Update vstring and distro in specfile [2.2.3-31.4] - require and BR a version of OpenSSL with the secure reneg API (#567980) [2.2.3-31.3] - mod_ssl: add SSLInsecureRenegotiation (#567980) - add security fixes for CVE-2010-0408, CVE-2010-0434 (#570440) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 boost [1.33.1-15] - Fix bugs in parsing invalid regexps - Resolves: #766755 [1.33.1-14] - Delete leftover .orig files after patches are successfully applied [1.33.1-13] - GCC 4.4 fixes - Resolves: #567722 [1.33.1-11] - Add a fix for thread safety bug in boost::regex - Build with -fno-strict-aliasing due to the sheer amount of warnings that we get. - Resolves: #472384 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel kernel [2.6.18-308.24.1.el5] - Revert: [scsi] sg: fix races during device removal (Ewan Milne) [868950 861004] [2.6.18-308.23.1.el5] - [net] bnx2x: Add remote-fault link detection (Alexander Gordeev) [870120 796905] - [net] bnx2x: Cosmetic changes (Alexander Gordeev) [870120 796905] - [net] rds-ping cause kernel panic (Alexander Gordeev) [822755 822756] {CVE-2012-2372} - [xen] add guest address range checks to XENMEM_exchange handlers (Igor Mammedov) [878033 878034] {CVE-2012-5513} - [xen] x86/physmap: Prevent incorrect updates of m2p mappings (Igor Mammedov) [870148 870149] {CVE-2012-4537} - [xen] VCPU/timer: Dos vulnerability prev overflow in calculations (Igor Mammedov) [870150 870151] {CVE-2012-4535} - [scsi] sg: fix races during device removal (Ewan Milne) [868950 861004] [2.6.18-308.22.1.el5] - [net] bonding: fix link down handling in 802.3ad mode (Andy Gospodarek) [877943 782866] [2.6.18-308.21.1.el5] - [fs] ext4: race-cond protect for convert_unwritten_extents_endio (Lukas Czerner) [869910 869911] {CVE-2012-4508} - [fs] ext4: serialize fallocate w/ ext4_convert_unwritten_extents (Lukas Czerner) [869910 869911] {CVE-2012-4508} - [fs] ext4: flush the i_completed_io_list during ext4_truncate (Lukas Czerner) [869910 869911] {CVE-2012-4508} - [net] WARN if struct ip_options was allocated directly by kmalloc (Jiri Pirko) [874973 872612] - [net] ipv4: add RCU protection to inet->opt (Jiri Pirko) [872113 855302] {CVE-2012-3552} - [scsi] qla2xx: Dont toggle inter bits after IRQ lines attached (Chad Dupuis) [870118 800708] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 samba3x samba [3.5.10-116] - Security Release, fixes CVE-2012-2111 - resolves: #815688 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.29.2uek] - Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg() (Mathias Krause) [Orabug: 17173824] {CVE-2013-3225} - Bluetooth: fix possible info leak in bt_sock_recvmsg() (Mathias Krause) [Orabug: 17173824] {CVE-2013-3224} - atm: update msg_namelen in vcc_recvmsg() (Mathias Krause) [Orabug: 17173824] {CVE-2013-3222} - dcbnl: fix various netlink info leaks (Mathias Krause) [Orabug: 17173824] {CVE-2013-2634} - udf: avoid info leak on export (Mathias Krause) [Orabug: 17173824] {CVE-2012-6548} - b43: stop format string leaking into error msgs (Kees Cook) [Orabug: 17173824] {CVE-2013-2852} - signal: always clear sa_restorer on execve (Kees Cook) [Orabug: 17173824] {CVE-2013-0914} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.211.2] - fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check (Kees Cook) [Orabug: 17842208] {CVE-2013-1928} - Bluetooth: RFCOMM - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17842129] {CVE-2012-6545} - Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST) (Mathias Krause) [Orabug: 17842105] {CVE-2012-6545} - llc: Fix missing msg_namelen update in llc_ui_recvmsg() (Mathias Krause) [Orabug: 17842095] {CVE-2013-3231} - HID: pantherlord: validate output report details (Kees Cook) [Orabug: 17842084] {CVE-2013-2892} - HID: zeroplus: validate output report details (Kees Cook) [Orabug: 17842081] {CVE-2013-2889} - HID: provide a helper for validating hid reports (Kees Cook) [Orabug: 17842081] {CVE-2013-2889} - KVM: Fix iommu map/unmap to handle memory slot moves (Jerry Snitselaar) [Orabug: 17842075] {CVE-2013-4592} - ansi_cprng: Fix off by one error in non-block size request (Jerry Snitselaar) [Orabug: 17842072] {CVE-2013-4345} - HID: validate HID report id size (Kees Cook) [Orabug: 17842063] {CVE-2013-2888} - ipv6: remove max_addresses check from ipv6_create_tempaddr (Hannes Frederic Sowa) [Orabug: 17842056] {CVE-2013-0343} - ipv6: udp packets following an UFO enqueued packet need also be handled by UFO (Hannes Frederic Sowa) [Orabug: 17842050] {CVE-2013-4387} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libtiff [3.9.4-9] - Still more fixes to make test case for CVE-2012-5581 work on all platforms Resolves: #885310 [3.9.4-8] - Fix incomplete patch for CVE-2012-3401 - Add libtiff-tiffinfo-exif.patch so that our test case for CVE-2012-5581 works with pre-4.0.2 libtiff Resolves: #885310 [3.9.4-7] - Add fixes for CVE-2012-3401, CVE-2012-4447, CVE-2012-4564, CVE-2012-5581 Resolves: #885310 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 gnupg2 [2.0.14-6] - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted [2.0.14-5] - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 xinetd [2:2.3.14-39] - Honor user and group directives - Resolves: CVE-2013-4342 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-348.16.1.0.1] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 squirrelmail [1.4.8-21.0.2.el5] - remove Redhat splash screen images from source Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel [2.6.18-164.15.1.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb ( John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina yang) [orabug 6993043] [bz 7258] - [MM] shrink zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - FP register state is corrupted during the handling a SIGSEGV (Chuck Anderson) [orabug 7708133] - [x86_64] PCI space below 4GB forces mem remap above 1TB (Larry Woodman) [523522] - [cpufreq] P-state limit: limit can never be increased (Stanislaw Gruszka) [489566] - [rds] patch rds to 4.0-ora-1.4.2-10 (Andy Grover, Tina Yang) [orabug 9168046] [RHBZ 546374] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libtiff [3.9.4-5] - Add fix for CVE-2012-1173 Resolves: #CVE-2012-1173 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php53 [5.3.3-21] - add security fix for CVE-2013-4248 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gdm initscripts gdm [2.16.0-59.0.1.el5_9.1] - Fix gdmconfig memory leaks [orabug 12734629] [2.16.0-59.1] - Don't try to pre-create directories that are internal implementation details of X. Resolves: #997619 CVE-2013-4169 initscripts [8.45.42-2.0.1.el5_9.1] - Do not rename eth devices. Orabug 14266688. Apply upstream patches: 0001-Remove-reference-to-rename_device.patch 0002-rename_device-dequote-DEVICE-eth0.patch 0003-dont_try_to_rename_devices.patch - change the ifup-eth and ifdown-eth script to use default leases file of dhclient. [Orabug 12434590] - Update oracle-enterprise.patch to do detection on /etc/oracle-release and /etc/enterprise-release - Patch x86_64 sysctl.conf as well as default sysctl.conf - Patch sysctl.conf to default rp_filter to loose reverse path filtering (has no effect for pre-2.6.32 kernels) [orabug 10286227] - Move hwclock into udev rules - Update oracle-enterprise.patch to fix RedHat references in arch specific sysctl.conf files in source tarball - Add oracle-enterprise.patch and update specfile - Don't attempt to re-enslave already-enslaved devices (#455537) (pknirsch@redhat.com) [8.45.42-2.1] - create /tmp/.X11-unix in rc.sysinit (#997622, CVE-2013-4169) [8.45.42-2] - added missing '-p p' for kpartx in netfs (#844671) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 samba3x [3.3.8-0.52.2] - Security Release, fixes CVE-2010-3069 - resolves: #632231 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.211.3] - ip6_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951806] {CVE-2013-4470} - ip_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951818] {CVE-2013-4470} - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) (Andy Honig) [Orabug: 17951705] {CVE-2013-6367} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 httpd [2.2.15-29.0.1.el6_4] - replace index.html with Oracle's index page oracle_index.html update vstring in specfile [2.2.15-29] - mod_dav: add security fix for CVE-2013-1896 (#991368) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc [2.5-118.2] - Fix integer overflows in *valloc and memalign. (#1011804). [2.5-118.1] - Add support for newer L3 caches on x86-64 and correctly count the number of hardware threads sharing a cacheline (#1011424). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 libvirt [0.8.2-29.0.1.el5] - Replaced docs/et.png in tarball - remove virshtest from test cases to fix failure in mock build root Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk [1:1.6.0.1-3.1.13.0] - updated to icedtea 1.13.1 - http://blog.fuseyism.com/index.php/2014/01/23/security-icedtea-1-12-8-1-13-1-for-openjdk-6-released/ - updated to jdk6, b30, 21_jan_2014 - https://openjdk6.java.net/OpenJDK6-B30-Changes.html - adapted patch7 1.13_fixes.patch - pre 2011 changelog moved to (till now wrong) pre-2009-spec-changelog (rh1043611) - added --disable-system-lcms to configure options to pass build - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch - Resolves: rhbz#1050190 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 samba3x [3.5.4-0.83.2] - Security Release, add fix for CVE-2011-2724 - related: #722555 [3.5.4-0.83.1] - Security Release, fixes CVE-2011-2694, CVE-2011-2522, CVE-2011-1678 - resolves: #722555 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 httpd [2.2.3-74.0.1.el5] - fix mod_ssl always performing full renegotiation (Joe Jin) [orabug 12423387] - replace index.html with Oracle's index page oracle_index.html - update vstring and distro in specfile [2.2.3-74] - further %post scriptlet fix (#752618, #867736) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [17.0.9-1.0.1.el6_4] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat ones [17.0.9-1] - Update to 17.0.9 ESR [17.0.8-4] - Added fix for mozbz#601442 - Support the extensions.getAddons.showPane pref again in the Add-ons Manager UI, a part of rhbz#818636 fix. [17.0.8-3] - Fixed rhbz#818636 - Firefox allows install of addons, disregarding xpinstall.enabled flag set as false. [17.0.8-2] - Updated manual page xulrunner [17.0.9-1.0.1.el6_4] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js - Removed XULRUNNER_VERSION from SOURCE21 [17.0.9-1] - Update to 17.0.9 ESR [17.0.8-5] - Fixed mozbz#633001 - Cannot open ipv6 address with self-signed certificate [17.0.8-4] - Fixed rhbz#818636 - Firefox allows install of addons, disregarding xpinstall.enabled flag set as false. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-371.4.1] - [char] ipmi: fix message handling during panics (Tony Camuso) [1049731 995293] - [net] igb: Use 32bit mask calculating the flow control watermarks (Stefan Assmann) [1041694 1036115] - [fs] NTLM auth and sign - Use appropriate server challenge (Sachin Prabhu) [1029865 1018286] - [xen] gnttab: correct locking order reversal (Radim Krcmar) [1026245 1026246] {CVE-2013-4494} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [17.0.9-1.0.1.el6_4] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [17.0.9-1] - Update to 17.0.9 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 sudo [1.7.4p5-12] - added patch for CVE-2012-2337 Resolves: rhbz#829756 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 pango [1.14.9.8.0.1.el5_7.3] - Bump release [1.14.9.8.el5_1.3] - Prevent buffer overflow errors in harfbuzz module (CVE-2011-3193) - Resolves: #737819 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox [24.5.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Build with nspr-devel >= 4.10.0 to fix build failure [24.5.0-1] - Update to 24.5.0 ESR [24.4.0-3] - Added a workaround for Bug 1054242 - RHEVM: Extremely high memory usage in Firefox 24 ESR on RHEL 6.5 [24.4.0-2] - fixed rhbz#1067343 - Broken languagepack configuration after firefox update Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 mesa [6.5.1-7.11] - CVE-2013-1993 - buffer overflows in DRI protocol (#963066) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-348.18.1] - [net] be2net: enable polling prior enabling interrupts globally (Ivan Vecera) [1005239 987539] - [kernel] signals: stop info leak via tkill and tgkill syscalls (Oleg Nesterov) [970874 970875] {CVE-2013-2141} - [net] ipv6: do udp_push_pending_frames AF_INET sock pending data (Jiri Benc) [987647 987648] {CVE-2013-4162} - [mm] use-after-free in madvise_remove() (Jacob Tanenbaum) [849735 849736] {CVE-2012-3511} - [fs] autofs: remove autofs dentry mount check (Ian Kent) [1001488 928098] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.109.3] - Revert 'be2net: enable interrupts in probe' (Jerry Snitselaar) [Orabug: 17179597] [2.6.39-400.109.2] - be2net: enable interrupts in probe (Jerry Snitselaar) [Orabug: 17080364] - Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg() (Mathias Krause) [Orabug: 17173830] {CVE-2013-3225} - Bluetooth: fix possible info leak in bt_sock_recvmsg() (Mathias Krause) [Orabug: 17173830] {CVE-2013-3224} - atm: update msg_namelen in vcc_recvmsg() (Mathias Krause) [Orabug: 17173830] {CVE-2013-3222} - rtnl: fix info leak on RTM_GETLINK request for VF devices (Mathias Krause) [Orabug: 17173830] {CVE-2013-2635} - dcbnl: fix various netlink info leaks (Mathias Krause) [Orabug: 17173830] {CVE-2013-2634} - udf: avoid info leak on export (Mathias Krause) [Orabug: 17173830] {CVE-2012-6548} - tracing: Fix possible NULL pointer dereferences (Namhyung Kim) [Orabug: 17173830] {CVE-2013-3301} - b43: stop format string leaking into error msgs (Kees Cook) [Orabug: 17173830] {CVE-2013-2852} - signal: always clear sa_restorer on execve (Kees Cook) [Orabug: 17173830] {CVE-2013-0914} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-371.1.2.0.1] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.33.2] - dm snapshot: fix data corruption (Mikulas Patocka) [Orabug: 17618900] {CVE-2013-4299} - ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data (Hannes Frederic Sowa) [Orabug: 17618897] {CVE-2013-4162} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm [kvm-83-266.0.1.el5_10.1] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch [kvm-83-266_10.1.el5] - KVM: x86: prevent cross page vapic_addr access (CVE-2013-6368) [bz#1032219] - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) [bz#1032216] - Resolves: bz#1032219 (CVE-2013-6368 kvm: cross page vapic_addr access [rhel-5.10]) - Resolves: bz#1032216 CVE-2013-6367 kvm: division by zero in apic_get_tmcct() [rhel-5.10.z] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-308.24.1.0.1.el5] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printks when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openldap [2.3.43-12.7] - fix: CVE-2011-1024 ppolicy forwarded bind failure messages cause success (#680484) [2.3.43-12.6] - fix: slapd concurrent access to connections causes slapd to silently die (#677611) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [24.3.0-2.0.1.el6_5] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Make sure build with nspr-devel >= 4.10.0 [24.3.0-2] - Update to 24.3.0 ESR Build 2 [24.3.0-1] - Update to 24.3.0 [24.2.0-2] - Fixed requested nspr/nss versions Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-371.6.1] - [net] be2net: don't use skb_get_queue_mapping() (Ivan Vecera) [1066302 1063955] - [ipc] change refcount to atomic_t (Phillip Lougher) [1024866 1024868] {CVE-2013-4483} - [s390] qeth: buffer overflow in snmp ioctl (Jacob Tanenbaum) [1034402 1034404] {CVE-2013-6381} - [scsi] AACRAID Driver compat IOCTL missing capability check (Jacob Tanenbaum) [1033531 1033532] {CVE-2013-6383} - [xen] x86/AMD: work around erratum 793 (Radim Krcmar) [1035834 1035836] {CVE-2013-6885} - [xen] do not expose hypercalls to rings 1 and 2 of HVM guests (Andrew Jones) [1029112 1029113] {CVE-2013-4554} - [redhat] kabi: Adding symbol print_hex_dump (Jiri Olsa) [1054055 662558] - [scsi] Add 'eh_deadline' to limit SCSI EH runtime (Ewan Milne) [1050097 956132] - [scsi] remove check for 'resetting' (Ewan Milne) [1050097 956132] - [scsi] dc395: Move 'last_reset' into internal host structure (Ewan Milne) [1050097 956132] - [scsi] tmscsim: Move 'last_reset' into host structure (Ewan Milne) [1050097 956132] - [scsi] advansys: Remove 'last_reset' references (Ewan Milne) [1050097 956132] - [scsi] dpt_i2o: return SCSI_MLQUEUE_HOST_BUSY when in reset (Ewan Milne) [1050097 956132] - [scsi] dpt_i2o: Remove DPTI_STATE_IOCTL (Ewan Milne) [1050097 956132] - [net] ipv6: fix leaking uninit port number of offender sockaddr (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263} - [net] fix addr_len/msg->msg_namelen assign in recv_error funcs (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263} - [net] prevent leakage of uninitialized memory to user in recv (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263} - [net] be2net: prevent Tx stall on SH-R when packet size < 32 (Ivan Vecera) [1051535 1007995] - [net] be2net: Trim padded packets for Lancer (Ivan Vecera) [1051535 1007995] - [net] be2net: Pad skb to meet min Tx pkt size in lancer (Ivan Vecera) [1051535 1007995] - [net] be2net: refactor HW workarounds in be_xmit() (Ivan Vecera) [1051535 1007995] - [fs] exec/ptrace: fix get_dumpable() incorrect tests (Petr Oros) [1039483 1039484] {CVE-2013-2929} [2.6.18-371.5.1] - [fs] cifs: stop trying to use virtual circuits (Sachin Prabhu) [1044328 1013469] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc [2.5-107.4] - Add missing patch to avoid use after free (#816647). [2.5-107.3] - Fix multibyte character processing crash in regexp (CVE-2013-0242, #951130) - Fix getaddrinfo stack overflow resulting in application crash (CVE-2013-1914, #951130) [2.5-107.2] - Call feraiseexcept only if exceptions are not masked (#861871). Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox [24.2.0-1.0.1.el6_4] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Build with nspr-devel >= 4.10.0 to fix build failure [24.2.0-1] - Update to 24.2.0 ESR [24.1.0-4] - Fixed mozbz#938730 - avoid mix of memory allocators (crashes) when using system sqlite [24.1.0-3] - Fixed locale pickup (rhbz#1034541) [24.1.0-2] - Fixed package reinstall issue [24.1.0-1] - Update to 24.1.0 ESR [24.0-0.1] - Update to 24.0 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [17.0.5-1.0.1.el6_4] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [17.0.5-1] - Update to 17.0.5 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.109.6] - block: do not pass disk names as format strings (Kees Cook) [Orabug: 17230083] {CVE-2013-2851} - libceph: Fix NULL pointer dereference in auth client code (Tyler Hicks) [Orabug: 17230108] {CVE-2013-1059} - ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Eric Dumazet) [Orabug: 17371078] {CVE-2013-2232} - af_key: initialize satype in key_notify_policy_flush() (Nicolas Dichtel) [Orabug: 17370788] {CVE-2013-2237} - Bluetooth: HCI - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17370892] {CVE-2012-6544} - Bluetooth: L2CAP - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17371050] {CVE-2012-6544} - Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) (Mathias Krause) [Orabug: 17371065] {CVE-2012-6544} - sctp: Use correct sideffect command in duplicate cookie handling (Vlad Yasevich) [Orabug: 17371118] {CVE-2013-2206} - sctp: deal with multiple COOKIE_ECHO chunks (Max Matveev) [Orabug: 17372121] {CVE-2013-2206} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 subversion [1.6.11-10] - add security fixes for CVE-2013-1968, CVE-2013-2112, CVE-2014-0032 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 cvs [1.11.23-11.el6_2.1] - Fix CVE-2012-0804 (Resolves: #784338) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 vino [2.28.1-9] - Reject clients in deferred auth state - Bug 1009228 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.33.3uek] - af_key: fix info leaks in notify messages (Mathias Krause) [Orabug: 17837974] {CVE-2013-2234} - drivers/cdrom/cdrom.c: use kzalloc() for failing hardware (Jonathan Salwan) [Orabug: 17837971] {CVE-2013-2164} - fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check (Kees Cook) [Orabug: 17837966] {CVE-2013-1928} - Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST) (Mathias Krause) [Orabug: 17837959] {CVE-2012-6545} - Bluetooth: RFCOMM - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17838023] {CVE-2012-6545} - llc: Fix missing msg_namelen update in llc_ui_recvmsg() (Mathias Krause) [Orabug: 17837945] {CVE-2013-3231} - HID: pantherlord: validate output report details (Kees Cook) [Orabug: 17837942] {CVE-2013-2892} - HID: zeroplus: validate output report details (Kees Cook) [Orabug: 17837936] {CVE-2013-2889} - HID: provide a helper for validating hid reports (Kees Cook) [Orabug: 17837936] - NFSv4: Check for buffer length in __nfs4_get_acl_uncached (Sven Wegener) [Orabug: 17837931] {CVE-2013-4591} - ansi_cprng: Fix off by one error in non-block size request (Neil Horman) [Orabug: 17837999] {CVE-2013-4345} - HID: validate HID report id size (Kees Cook) [Orabug: 17837925] {CVE-2013-2888} - ipv6: remove max_addresses check from ipv6_create_tempaddr (Hannes Frederic Sowa) [Orabug: 17837923] {CVE-2013-0343} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 curl [7.19.7-36] - fix cookie tailmatching to prevent cross-domain leakage (CVE-2013-1944) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk [1:1.6.0.0-1.61.1.11.11] - added and applied (temporally) patch10 fixToFontSecurityFix.patch. - fixing regression in fonts introduced by one security patch. - Resolves: rhbz#950386 [1:1.6.0.0-1.60.1.11.11] - added and applied (temporally) one more patch to xalan/xerces privileges - patch9 jaxp-backport-factoryfinder.patch - will be upstreamed - Resolves: rhbz#950386 [1:1.6.0.0-1.59.1.11.11] - Updated to icedtea6 1.11.11 - fixed xalan/xerxes privledges - removed patch 8 - removingOfAarch64.patch.patch - fixed upstream - Resolves: rhbz#950386 [1:1.6.0.0-1.58.1.11.10] - Updated to icedtea6 1.11.10 - rewritten java-1.6.0-openjdk-java-access-bridge-security.patch - excluded aarch64.patch - by patch 8 - removingOfAarch64.patch.patch - Resolves: rhbz#950386 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql [8.4.18-1] - Update to PostgreSQL 8.4.18, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-14.html http://www.postgresql.org/docs/8.4/static/release-8-4-15.html http://www.postgresql.org/docs/8.4/static/release-8-4-16.html http://www.postgresql.org/docs/8.4/static/release-8-4-17.html http://www.postgresql.org/docs/8.4/static/release-8-4-18.html including fixes for CVE-2013-0255, CVE-2013-1900 (#1017837) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [24.5.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [24.5.0-1] - Update to 24.5.0 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.34.4uek] - netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (Daniel Borkmann) [Orabug: 18462076] {CVE-2014-2523} - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable (Daniel Borkmann) [Orabug: 18461091] {CVE-2014-0101} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openldap [2.3.43-27] - fix: CVE-2013-4449 segfault on certain queries with rwm overlay (#1064145) [2.3.43-26] - fix: do not send IPv6 DNS queries when IPv6 is disabled on the host (#812772) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 mysql55-mysql [5.5.37-1] - Update to MySQL 5.5.37, for various fixes described at http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-37.html Includes fixes for: CVE-2014-2440 CVE-2014-0384 CVE-2014-2432 CVE-2014-2431 CVE-2014-2430 CVE-2014-2436 CVE-2014-2438 CVE-2014-2419 Resolves: #1089202 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.33.4uek] - kernel/signal.c: stop info leak via the tkill and the tgkill syscalls (Emese Revfy) [Orabug: 17951083] {CVE-2013-2141} - ip_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951078] {CVE-2013-4470} - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) (Andy Honig) [Orabug: 17951073] {CVE-2013-6367} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 Oracle Linux 7 java-1.6.0-openjdk [1:1.6.0.1-6.1.13.4] - moved to icedteaver 1.13.4 - moved to openjdkver b32 and openjdkdate 15_jul_2014 - added upstreamed patch patch9 rh1115580-unsyncHashMap.patch - Resolves: rhbz#1115580 - Resolves: rhbz#1115867 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.36.4uek] - l2tp: fix an unprivileged user to kernel privilege escalation (Sasha Levin) [Orabug: 19229529] {CVE-2014-4943} {CVE-2014-4943} - ptrace,x86: force IRET path after a ptrace_stop() (Tejun Heo) [Orabug: 19230692] {CVE-2014-4699} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 ruby [1.8.5-27] - unintentional file creation caused by inserting an illegal NUL character * ruby-1.8.6-CVE-2012-4522-io.c-pipe_open-command-name-should-not-contain-null-.patch - Related: rhbz#867750 [1.8.5-26] - escaping vulnerability about Exception#to_s / NameError#to_s * ruby-1.8.7-p371-CVE-2012-4481.patch - Resolves: rhbz#867750 - unintentional file creation caused by inserting an illegal NUL character * ruby-1.8.6-CVE-2012-4522-io.c-rb_open_file-should-check-NUL-in-path.patch - Resolves: rhbz#867750 [1.8.5-25] - Resolve buffer overflow causing gem installation issues. * ruby-1.8.7-syck-avoid-buffer-overflow.patch - Resolves: rhbz#834381 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 postgresql [8.1.23-10] - related #1065840: CVE-2014-0062 [8.1.23-9] - fix #1065840: CVE-2014-0060, CVE-2014-0061, CVE-2014-0063, CVE-2014-0064, CVE-2014-0065 - better incorporate strlcpy function (upstream git diff c92f7e..062421) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libXfont [1.4.5-3] - cve-2013-6462.patch: sscanf overflow (bug 1049684) - sscanf-hardening.patch: Some other sscanf hardening fixes (1049684) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-348.6.1.0.1] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird [24.7.0-1.0.1.el6_5] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [24.7.0-1] - Update to 24.7.0 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.6.0-openjdk [ 1:1.6.0.0-1.35.1.11.8.0.1.el5_9] - Add oracle-enterprise.patch [1:1.6.0.0-1.35.1.11.8] - Rebuild with updated source tarball - Resolves: rhbz#911522 [1:1.6.0.0-1.34.1.11.8] - Updated to icedtea6 1.11.8 - Removed patch9 7201064.patch - Removed patch10 8005615.patch - Removed not-applied patch 6664509.patch - Removed mauve as deadly outdated and run on QA - jtreg kept, useless, but valid - Rewritten java-1.6.0-openjdk-java-access-bridge-security.patch - Resolves: rhbz#911522 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 wireshark [1.0.15-6.0.1.el5] - Added oracle-ocfs2-network.patch - increase max packet size to 65536 (Herbert van den Bergh) [orabug 13542633] [1.0.15-6] - security patches - Resolves: CVE-2012-6056 CVE-2012-6060 CVE-2012-6061 CVE-2012-6062 CVE-2013-3557 CVE-2013-3559 CVE-2013-4081 CVE-2013-4083 CVE-2013-4927 CVE-2013-4931 CVE-2013-4932 CVE-2013-4933 CVE-2013-4934 CVE-2013-4935 CVE-2013-5721 CVE-2013-7112 CVE-2014-2281 CVE-2014-2299 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner [24.6.0-1.0.1.el6_5] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one [24.6.0-1] - Update to 24.6.0 ESR [24.5.0-2] - Disabled unused patches Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 nspr nss nspr [4.10.2-2] - Fix changelog comments - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 ruby [1.8.7.352-12] - Fix regression introduced by CVE-2013-4073 https://bugs.ruby-lang.org/issues/8575 * ruby-2.0.0-p255-Fix-SSL-client-connection-crash-for-SAN-marked-critical.patch - Related: rhbz#979300 [1.8.7.352-11] - hostname check bypassing vulnerability in SSL client. * ruby-1.8.7-p374-CVE-2013-4073-fix-hostname-verification.patch - Resolves: rhbz#979300 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-371.9.1.0.1] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql [8.4.20-1] - Update to PostgreSQL 8.4.20 (#1065843) for fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-19.html http://www.postgresql.org/docs/8.4/static/release-8-4-20.html Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 httpd [2.2.3-63.0.1.el5_8.1] - Fix mod_ssl always performing full renegotiation (orabug 12423387) - replace index.html with Oracle's index page oracle_index.html - update vstring and distro in specfile [2.2.3-63.1] - add security fixes for CVE-2012-0053, CVE-2012-0031, CVE-2011-3607 (#787596) - remove patch for CVE-2011-3638, obviated by fix for CVE-2011-3639 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.214.3] - inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions (Hannes Frederic Sowa) [18247289] {CVE-2013-7263} {CVE-2013-7265} [2.6.39-400.214.2] - inet: prevent leakage of uninitialized memory to user in recv syscalls (Hannes Frederic Sowa) [18238382] {CVE-2013-7263} {CVE-2013-7265} - exec/ptrace: fix get_dumpable() incorrect tests (Kees Cook) [18238353] {CVE-2013-2929} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libvirt [0.8.1-27.0.1.el6_0.5] - Replace docs/et.png in tarball with blank image [0.8.1-27.el6_0.5] - Properly report error in virConnectDomainXMLToNative (CVE-2011-1146) [0.8.1-27.el6_0.4] - Add missing checks for read-only connections (CVE-2011-1146) [0.8.1-27.el6_0.3] - Remove patches not suitable for proper Z-stream: - Export host information through SMBIOS to guests (rhbz#652678) - Support forcing a CDROM eject (rhbz#658147) - Plug several memory leaks (rhbz#672549) - Avoid memory overhead of matchpathcon (rhbz#672554) - Do not start libvirt-guests if that service is off (rhbz#668694) [0.8.1-27.el6_0.2] - spec file cleanups (rhbz#662045) - Fix deadlock on concurrent multiple bidirectional migration (rhbz#662043) - Fix off-by-one error in clock-variable (rhbz#662046) - Export host information through SMBIOS to guests (rhbz#652678) - Ensure device is deleted from guest after unplug (rhbz#662041) - Distinguish between QEMU domain shutdown and crash (rhbz#662042) [0.8.1-27.el6_0.1] - Fix JSON migrate_set_downtime command (rhbz#658143) - Make SASL work over UNIX domain sockets (rhbz#658144) - Let qemu group look below /var/lib/libvirt/qemu/ (rhbz#656972) - Fix save/restore on root_squashed NFS (rhbz#656355) - Fix race on multiple migration (rhbz#658141) - Export host information through SMBIOS to guests (rhbz#652678) - Support forcing a CDROM eject (rhbz#658147) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 tomcat5 [0:5.5.23-0jpp.38] - Resolves: CVE-2012-3439 rhbz#882008 three DIGEST authentication - implementation - Resolves: CVE-2012-3546, rhbz#913034 Bypass of security constraints. - Remove unneeded handling of FORM authentication in RealmBase Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 tomcat5 [0:5.5.23-0jpp.31] - Resolves: CVE-2012 regression. Changed patch file. [0:5.5.23-0jpp.30] - Resolves: CVE-2012-0022, CVE-2011-4858 [0:5.5.23-0jpp.27] - Resolves CVE-2011-0013 rhbz 675933 - Resolves CVE-2011-3718 rhbz 675933 [0:5.5.23-0jpp.23] - Resolves CVE-2011-1184 rhbz 744984 - Resolves CVE-2011-2204 rhbz 719188 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 wireshark [1.0.15-5.0.1.el5] - Added oracle-ocfs2-network.patch - increase max packet size to 65536 (Herbert van den Bergh) [orabug 13542633] [1.0.15-5] - fixed CVE-2012-4285, CVE-2012-4289, CVE-2012-4291 and CVE-2012-4290 (#849521) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sudo [1.7.2p1-29] - added patch for CVE-2014-0106: certain environment variables not sanitized when env_reset is disabled Resolves: rhbz#1072210 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.209.1] - Revert 'stop mig handler when lockres in progress ,and return -EAGAIN' (Srinivas Eeda) [Orabug: 16924802] - ocfs2/dlm: Fix list traversal in dlm_process_recovery_data (Srinivas Eeda) [Orabug: 17432400] - ocfs2/dlm: ocfs2 dlm umount skip migrating lockres (Srinivas Eeda) [Orabug: 16859627] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel kernel [2.6.18-348.3.1] - [utrace] ensure arch_ptrace() can never race with SIGKILL (Oleg Nesterov) [912071 912072] {CVE-2013-0871} - [x86] msr: Add capabilities check (Nikola Pajkovsky) [908696 908697] {CVE-2013-0268} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 subversion [1.6.11-9] - add security fixes for CVE-2013-1846, CVE-2013-1847, CVE-2013-1849 (#947372) [1.6.11-8] - add security fix for CVE-2013-1845 (#947372) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.215.7] - sctp: Fix sk_ack_backlog wrap-around problem (Xufeng Zhang) [Orabug: 19404245] {CVE-2014-4667} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-371.8.1.0.1] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openssl097a [0.9.7a-9.2] - CVE-2009-3555 - support the secure renegotiation RFC (#533125) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 curl [7.19.7-37] - fix heap-based buffer overflow in curl_easy_unescape() (CVE-2013-2174) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-200.29.2] - epoll: clear the tfile_check_list on -ELOOP (Joe Jin) {CVE-2012-3375} - Don't limit non-nested epoll paths (Jason Baron) - epoll: kabi fixups for epoll limit wakeup paths (Joe Jin) {CVE-2011-1083} - epoll: limit paths (Jason Baron) {CVE-2011-1083} - cred: copy_process() should clear child->replacement_session_keyring (Oleg Nesterov) {CVE-2012-2745} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox [24.3.0-2.0.1.el6_5] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Build with nspr-devel >= 4.10.0 to fix build failure [24.3.0-2] - Update to 24.3.0 ESR Build 2 [24.3.0-1] - Update to 24.3.0 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox [24.4.0-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one - Build with nspr-devel >= 4.10.0 to fix build failure [24.4.0-1] - Update to 24.4.0 ESR [24.3.0-4] - Fixed rhbz#1070467 - Enable Add Ons by default in Firefox [24.3.0-3] - Fixed rhbz#1054832 - Firefox does not support Camellia cipher Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 postgresql [8.1.23-6] - Back-port upstream fix for CVE-2012-3488 Resolves: #852015 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-371.0.0.0.1] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 php53 php [5.3.3-27.2] - spl: fix use-after-free in ArrayIterator due to object change during sorting. CVE-2014-4698 - spl: fix use-after-free in SPL Iterators. CVE-2014-4670 - gd: fix NULL pointer dereference in gdImageCreateFromXpm. CVE-2014-2497 - fileinfo: fix incomplete fix for CVE-2012-1571 in cdf_read_property_info. CVE-2014-3587 - core: fix incomplete fix for CVE-2014-4049 DNS TXT record parsing. CVE-2014-3597 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 samba3x samba [3.6.9-167] - resolves: #1018037 - Fix CVE-2013-4408. [3.6.9-165] - resolves: #1028086 - Fix CVE-2013-4475. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 tetex [3.0-33.8.el5.5] - unify patches for CVE-2010-0739 and CVE-2010-1440 [3.0-33.8.el5.4] - fix CVE-2010-1440 (#586819) [3.0-33.8.el5.3] - initialize data in arithmetic coder elsewhere (CVE-2009-0146) [3.0-33.8.el5.2] - initialize dataLen to properly fix CVE-2009-0146 [3.0-33.8.el5.1] - fix CVE-2010-0739 CVE-2010-0829 CVE-2007-5936 CVE-2007-5937 CVE-2009-0146 CVE-2009-0195 CVE-2009-0147 CVE-2009-0166 CVE-2009-0799 CVE-2009-0800 CVE-2009-1179 CVE-2009-1180 CVE-2009-1181 CVE-2009-1182 CVE-2009-1183 CVE-2009-0791 CVE-2009-3608 CVE-2009-3609 Resolves: #577328 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-371.6.1.0.1] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 nspr nss nspr [4.10.2-4] - Rebase to nspr-4.10.6 - Resolves: Bug 1116199 [4.10.2-3] - Retagging - Resolves: rhbz#1032466 nss [3.15.3-7] - Remove an unused patch - Related: Bug 1116199 [3.15.3-6] - Fix race-condition in certificate validation - Resolves: Bug 1116199 [3.15.3-5] - Remove two unused patches - Resolves: Bug 1042683 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner [24.7.0-1.0.1.el6_5] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one [24.7.0-1] - Update to 24.7.0 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 libtiff [3.8.2-19] - Resolves: #1063460 CVE-2013-1960 CVE-2013-1961 CVE-2013-4231 CVE-2013-4232 CVE-2013-4243 CVE-2013-4244 libtiff various flaws Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 rsyslog rsyslog5 [5.8.12-5.0.1] - use setsid() to get a controlling session and process group [Orabug: 17364545] [5.8.12-5] - fix CVE-2014-3634 resolves: #1149158 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 gnupg2 [2.0.10-3.1] - fix use after free when importing certain X509 certificates CVE-2010-2547 (#618156) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [17.0.8-1.0.1.el6_4] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat ones [17.0.8-1] - Update to 17.0.8 ESR xulrunner [17.0.8-3.0.1.el6_4] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js - Removed XULRUNNER_VERSION from SOURCE21 [17.0.8-3] - Update to 17.0.8 ESR Build 2 [17.0.8-2] - Added fix for rhbz#990921 - firefox does not build with required nss/nspr [17.0.8-1] - Update to 17.0.8 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-371] - [net] be2net: enable polling prior enabling interrupts globally (Ivan Vecera) [987539] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-200.32.1] - dl2k: Clean up rio_ioctl (Stephan Mueller) [Orabug: 14680245] {CVE-2012-2313} - hugetlb: fix resv_map leak in error path (Christoph Lameter) [Orabug: 14680284] {CVE-2012-2390} - rds: set correct msg_namelen (Jay Fenlason) [Orabug: 14680018] {CVE-2012-3430} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.36.3uek] - fix autofs/afs/etc. magic mountpoint breakage (Al Viro) [Orabug: 19028505] {CVE-2014-0203} - SELinux: Fix kernel BUG on empty security contexts. (Stephen Smalley) [Orabug: 19028381] {CVE-2014-1874} - floppy: don't write kernel-only members to FDRAWCMD ioctl output (Matthew Daley) [Orabug: 19028446] {CVE-2014-1738} - floppy: ignore kernel-only members in FDRAWCMD ioctl input (Matthew Daley) [Orabug: 19028439] {CVE-2014-1737} - libertas: potential oops in debugfs (Dan Carpenter) [Orabug: 19028417] {CVE-2013-6378} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-300.21.1.el6uek] - regset: Return -EFAULT, not -EIO, on host-side memory fault (H. Peter Anvin) CVE-2012-1097 - regset: Prevent null pointer reference on readonly regsets (H. Peter Anvin) CVE-2012-1097 - cifs: fix dentry refcount leak when opening a FIFO on lookup (Jeff Layton) CVE-2012-1090 - block: Fix io_context leak after failure of clone with CLONE_IO (Louis Rilling) CVE-2012-0879 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel kernel [2.6.18-371.1.2] - [xen] x86: check segment descriptor read result in 64-bit OUTS emulation (Radim Krcmar) [1012958 1012959] {CVE-2013-4368} - [md] dm snapshot: fix data corruption (Mikulas Patocka) [1004734 975353] {CVE-2013-4299} [2.6.18-371.1.1] - [crypto] ansi_cprng fix off by one err in non-block size request (Neil Horman) [1007692 1007693] {CVE-2013-4345} - [fs] gfs2: yield() in shrinker to allow glock_workqueues to run (Abhijith Das) [1014714 928518] - [net] ipv6: ipv6_create_tempaddr cleanup (Petr Holasek) [999361 999362] {CVE-2013-0343} - [net] ipv6: remove max_addresses check from ipv6_create_tempaddr (Petr Holasek) [999361 999362] {CVE-2013-0343} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.215.12] - USB: whiteheat: Added bounds checking for bulk command response (James Forshaw) [Orabug: 19849335] {CVE-2014-3185} - HID: fix a couple of off-by-ones (Jiri Kosina) [Orabug: 19849318] {CVE-2014-3181} - KVM: x86: Improve thread safety in pit (Andy Honig) [Orabug: 19905687] {CVE-2014-3611} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-400.34.3] - inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions (Hannes Frederic Sowa) [18247290] {CVE-2013-7263} {CVE-2013-7265} [2.6.32-400.34.2] - exec/ptrace: fix get_dumpable() incorrect tests (Kees Cook) [18239033] {CVE-2013-2929} {CVE-2013-2929} - inet: prevent leakage of uninitialized memory to user in recv syscalls (Hannes Frederic Sowa) [18239036] {CVE-2013-7263} {CVE-2013-7265} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 mod_nss [1.0.8-19] - Resolves: CVE-2013-4566 - Bugzilla Bug #1030265 - mod_nss: incorrect handling of NSSVerifyClient in directory context [rhel-6.5.z] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-firmware kernel-headers ofa Following security bugs are fixed in this errata CVE-2010-3904 When copying data to userspace, the RDS protocol failed to verify that the user-provided address was a valid userspace address. A local unprivileged user could issue specially crafted socket calls to write arbitrary values into kernel memory and potentially escalate privileges to root. CVE-2010-3067 Integer overflow in the do_io_submit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the io_submit system call. CVE-2010-3477 The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel memory via vectors involving a dump operation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2942. kernel: [2.6.32-100.21.1.el5] - [rds] fix access issue with rds (Chris Mason) {CVE-2010-3904} - [fuse] linux-2.6.32-fuse-return-EGAIN-if-not-connected-bug-10154489.patch - [net] linux-2.6.32-net-sched-fix-kernel-leak-in-act_police.patch - [aio] linux-2.6.32-aio-check-for-multiplication-overflow-in-do_io_subm.patch ofa: [1.5.1-4.0.23] - Fix rds permissions checks during copies [1.5.1-4.0.21] - Update to BXOFED 1.5.1-1.3.6-5 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 tcl [8.4.13-6] - Fixed infinite loop in regex NFA optimization code Resolves: CVE-2007-4772 - Fixed O(N^2) compile time (and huge memory requirements) for some regexps Resolves: CVE-2007-6067 [8.4.13-5] - Threaded / nonthreaded versions of tcl are now switchable through alternatives Resolves: rhbz#478961 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [24.6.0-1.0.1.el6_5] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [24.6.0-1] - Update to 24.6.0 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-371.4.1.0.1] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.36.9uek] - ALSA: control: Don't access controls outside of protected regions (Lars-Peter Clausen) [Orabug: 19817787] {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} - ALSA: control: Fix replacing user controls (Lars-Peter Clausen) [Orabug: 19817749] {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} - mm: try_to_unmap_cluster() should lock_page() before mlocking (Vlastimil Babka) [Orabug: 19817324] {CVE-2014-3122} - vm: convert fb_mmap to vm_iomap_memory() helper (Linus Torvalds) [Orabug: 19816564] {CVE-2013-2596} - vm: add vm_iomap_memory() helper function (Linus Torvalds) [Orabug: 19816564] {CVE-2013-2596} - net: sctp: inherit auth_capable on INIT collisions (Daniel Borkmann) [Orabug: 19816069] {CVE-2014-5077} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.215.6] - filter: prevent nla extensions to peek beyond the end of the message (Mathias Krause) [Orabug: 19315782] {CVE-2014-3144} {CVE-2014-3145} [2.6.39-400.215.5] - n_tty: Fix n_tty_write crash when echoing in raw mode (Peter Hurley) [Orabug: 18756449] {CVE-2014-0196} {CVE-2014-0196} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird [24.2.0-1.0.1.el6_5] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Make sure build with nspr-devel >= 4.10.0 [24.2.0-1] - Update to 24.2.0 ESR [24.1.0-1] - Update to 24.1.0 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-371.9.1] - [nfs] sunrpc: don't use a credential with extra groups (Mateusz Guzik) [1095062 976201] - [scsi] lpfc: Remove NDLP reference put in lpfc_cmpl_els_logo_acc (Rob Evers) [1096061 1075228] - [infiniband] rds: dereference of a NULL device (Jacob Tanenbaum) [1079216 1079217] {CVE-2013-7339} - [kernel] futex: check relative timeouts for overflow (Denys Vlasenko) [1091832 1084168] - [virt] kvm: correctly detect KVM when hv emulation is enalbed (Jason Wang) [1094152 985767] - [security] Fix spurious warnings in security_ops_task_setrlimit (Mateusz Guzik) [1092869 916235] - [block] floppy: don't write kernel-only members to FDRAWCMD output (Denys Vlasenko) [1094302 1094303] {CVE-2014-1738 CVE-2014-1737} - [block] floppy: ignore kernel-only members in FDRAWCMD input (Denys Vlasenko) [1094302 1094303] {CVE-2014-1738 CVE-2014-1737} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.36.7uek] - sctp: Fix sk_ack_backlog wrap-around problem (Xufeng Zhang) [Orabug: 19404246] {CVE-2014-4667} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 subversion [1.6.11-7.1] - add security fixes for CVE-2010-4644, CVE-2010-4539 (#672676) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [17.0.10-1.0.1.el6_4] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one [17.0.10-1] - Update to 17.0.10 ESR xulrunner [17.0.10-1.0.1.el6_4] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js - Removed XULRUNNER_VERSION from SOURCE21 [17.0.10-1] - Update to 17.0.10 ESR [17.0.9-2] - Added patch for rhbz#983488 - Resizing window changes window size to 0 with third party window manager. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 openswan [2.6.32-27.2] - Resolves: rhbz#1050337 (CVE-2013-6466 refix for delete/notify code) [2.6.32-27.1] - Resolves: rhbz#1050337 (CVE-2013-6466) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-308.16.1.el5] - Revert: [fs] nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir() (Eric Sandeen) [847943 784191] - Revert: [fs] add new FMODE flags: FMODE_32bithash and FMODE_64bithash (Eric Sandeen) [847943 784191] - Revert: [fs] nfsd: rename int access to int may_flags in nfsd_open() (Eric Sandeen) [847943 784191] - Revert: [fs] nfsd: vfs_llseek() with 32 or 64 bit offsets (hashes) (Eric Sandeen) [847943 784191] - Revert: [fs] vfs: add generic_file_llseek_size (Eric Sandeen) [847943 784191] - Revert: [s390/ppc64] add is_compat_task() for s390 and ppc64 (Eric Sandeen) [847943 784191] - Revert: [fs] ext3: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [847943 784191] - Revert: [fs] ext4: improve llseek error handling for large seek offsets (Eric Sandeen) [847943 784191] - Revert: [fs] ext4: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [847943 784191] - Revert: [fs] vfs: allow custom EOF in generic_file_llseek code (Eric Sandeen) [847943 784191] - Revert: [fs] ext4: use core vfs llseek code for dir seeks (Eric Sandeen) [847943 784191] - Revert: [fs] ext3: pass custom EOF to generic_file_llseek_size() (Eric Sandeen) [847943 784191] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xinetd [2:2.3.14-19] - Correctly backport patches that fix the descriptor leakage - Related: #852274 [-2:2.3.14-18] - Fix leaking file descriptors (#852274) - Fix: Service disabled due to bind failure (#811000) - CVE-2012-0862 xinetd: enables unintentional services over tcpmux port (#788795) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 php53 php [5.3.3-27.1] - core: type confusion issue in phpinfo(). CVE-2014-4721 - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712 - core: fix heap-based buffer overflow in DNS TXT record parsing. CVE-2014-4049 - core: unserialize() SPL ArrayObject / SPLObjectStorage type confusion flaw. CVE-2014-3515 - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270 - fileinfo: unrestricted recursion in handling of indirect type rules. CVE-2014-1943 - fileinfo: out of bounds read in CDF parser. CVE-2012-1571 - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479 - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480 - fileinfo: cdf_unpack_summary_info() excessive looping DoS. CVE-2014-0237 - fileinfo: CDF property info parsing nelements infinite loop. CVE-2014-0238 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 expat [2.0.1-11] - use symbol version for XML_SetHashSalt (CVE-2012-0876, #816306) [2.0.1-10] - add security fix for CVE-2012-1148 (#811825) - add security fix for CVE-2012-0876 (#811833) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel [2.6.18-308.11.1.0.1.el5] - [net] bonding: fix carrier detect when bond is down [orabug 12377284] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - [scsi] fix scsi hotplug and rescan race [orabug 10260172] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [rds] Patch rds to 1.4.2-20 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] +- [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.7.0-openjdk [1.7.0.45-2.4.3.1.0.1.el5_10] - Add oracle-enterprise.patch - Fix DISTRO_NAME to 'Enterprise Linux' [1.7.0.45-2.4.3.1.el5] - Updated to icedtea 2.4.3 - Resolves: rhbz#1017623 [1.7.0.45-2.4.3.0.el5] - fixed and updated tapset - removed bootstrap - source 11 redeclared to 1111 - added source12: TestCryptoLevel.java - removed upstreamed patch103 java-1.7.0-openjdk-arm-fixes.patch - removed unnecessary patch112 java-1.7.0-openjdk-doNotUseDisabledEcc.patch - added patch120: java-1.7.0-openjdk-freetype-check-fix.patch - fixed nss - cleaned sources - Resolves: rhbz#1017623 [1.7.0.25-2.4.1.4.el5] - updated to icedtea 2.4.1 - improoved handling of patch111 - nss-config-2.patch - backported uniquesuffix from 6.5 - Resolves: rhbz#978421 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 glibc An off-by-one heap-based buffer overflow flaw was found in glibc's internal __gconv_translit_find() function. An attacker able to make an application call the iconv_open() function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-5119) A directory traveral flaw was found in the way glibc loaded locale files. An attacker able to make an application use a specially crafted locale name value (for example, specified in an LC_* environment variable) could possibly use this flaw to execute arbitrary code with the privileges of that application. (CVE-2014-0475) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 bind [32:9.8.2-0.10.rc1.2] - fix CVE-2012-3817 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xen [3.0.3-142.el5_9.2] - e1000: discard packets that are too long if !SBP and !LPE (rhbz 910843) - e1000: discard oversized packets based on SBP|LPE (rhbz 910843) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libgcrypt [1.4.5-11] - fix CVE-2013-4242 GnuPG/libgcrypt susceptible to cache side-channel attack [1.4.5-10] - Add GCRYCTL_SET_ENFORCED_FIPS_FLAG command Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gnome-vfs2 [2.16.2-10.el5] - Prevent trash applet crashing (#848822) [2.16.2-9.el5] - Prevent deleting items linking out of the trash (#586015) - Do not stat every file on an ClearCase mvfs filesystem (#822817) - Do not silently skip directory having no read permission during copy (#772307) - Allow trashing symlink to filesystem root that does not support trashing (#621394) - CVE-2009-2473 gnome-vfs2 embedded neon: billion laughs DoS attack (#540548) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 dbus-glib [0.73-11] - Add patch to fix CVE-2013-0292 - Resolves: #913072 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox: [10.0.3-1.0.1.el6_2] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat ones [10.0.3-1] - Update to 10.0.3 ESR xulrunner: [10.0.3-1.0.1.el6_2] - Replace xulrunner-redhat-default-prefs.js with - xulrunner-oracle-default-prefs.js [10.0.3-1] - Update to 10.0.3 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.36.6uek] - filter: prevent nla extensions to peek beyond the end of the message (Mathias Krause) [Orabug: 19315783] {CVE-2014-3144} {CVE-2014-3145} - futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi() (Darren Hart) [Orabug: 19315318] {CVE-2012-6647} [2.6.32-400.36.5uek] - n_tty: Fix n_tty_write crash when echoing in raw mode (Peter Hurley) [Orabug: 18756450] {CVE-2014-0196} {CVE-2014-0196} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 freeradius2 [2.1.12-5] - resolves: bug#855308 CVE-2012-3547 freeradius: Stack-based buffer overflow by processing certain expiration date fields of a certificate during x509 certificate validation Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.215.11] - ALSA: control: Don't access controls outside of protected regions (Lars-Peter Clausen) [Orabug: 19817786] {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} - ALSA: control: Fix replacing user controls (Lars-Peter Clausen) [Orabug: 19817748] {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} - kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601) (Michael S. Tsirkin) [Orabug: 19817647] {CVE-2014-3601} - mm: try_to_unmap_cluster() should lock_page() before mlocking (Vlastimil Babka) [Orabug: 19817323] {CVE-2014-3122} - vm: convert fb_mmap to vm_iomap_memory() helper (Linus Torvalds) [Orabug: 19816563] {CVE-2013-2596} - vm: add vm_iomap_memory() helper function (Linus Torvalds) [Orabug: 19816563] {CVE-2013-2596} - net: sctp: inherit auth_capable on INIT collisions (Daniel Borkmann) [Orabug: 19816068] {CVE-2014-5077} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 bind97 [32:9.7.0-10.P2.4] - fix CVE-2012-5166 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 Oracle Linux 7 firefox xulrunner xulrunner-devel firefox [31.2.0-3.0.1.el7_0] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one [31.2.0-3] - Update to 31.2.0 ESR - Fix for mozbz#1042889 [31.1.0-7] - Enable WebM on all arches xulrunner [31.2.0-1.0.1] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js - Removed XULRUNNER_VERSION from SOURCE21 [31.2.0-1] - Update to 31.2.0 [31.1.0-3] - move /sdk/bin to xulrunner libdir [31.1.0-2] - Sync preferences with Firefox package [31.1.0-1] - Update to 31.1.0 ESR [31.0-2] - Fix header wrapper for aarch64 [31.0-1] - Update to 31.0 ESR Sergey Artykhov DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libxml2 [2.7.6-8.0.1.el6_3.4 ] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball [2.7.6-8.el6_3.4] - fix out of range heap access (CVE-2012-5134) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 openssl097a openssl098e [0.9.8e-18.0.1.el6_5.2] - Updated the description [0.9.8e-18.2] - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability [0.9.8e-18] - fix for CVE-2012-2110 - memory corruption in asn1_d2i_read_bio() (#814185) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [10.0.10-1.0.1.el6_3] - Replaced firefox-redhat-default-prefs.js with firefox-oracle-default-prefs.js [10.0.10-1] - Update to 10.0.10 ESR [10.0.8-2] - Fixed rhbz#865284 - add the storage.nfs_filesystem config key to property list - disable OOP for wrapped plugins (nspluginwrapper) xulrunner [10.0.10-1.0.1.el6_3] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.10-1] - Added patches from 10.0.10 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ImageMagick [6.2.8.0-12.el5] - Add fix for CVE-2010-4167 (767142) [6.2.8.0-11.el5] Fix assertion failed when using 'identify -verbose' when theres no image information available (502626) [6.2.8.0-10.el5] Fix memory allocation failure when using color option (616538) Fix hang when converting broken GIF (693989) Fix conversion of rotated landscape PDF (694922) [6.2.8.0-9.el5] Fix a deadlock with semaphore (530592) [6.2.8.0-8.el5] - Fix page size argument parsing (580535) [6.2.8.0-7.el5] - Fix SGI image decoding (498063) [6.2.8.0-6.el5] - Add fix for CVE-2009-1882 (504305) [6.2.8.0-5.el5] - update quantum memory patch (necessary for CVE fixes) - backport functionality for SetImageExtent (necessary for CVE fixes) - Add patch for CVE-2008-1096 (#286411) - Add patch for CVE-2008-1097 (#285861) - update patch for CVE-2007-4986 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 postgresql [8.1.23-5] - Back-port upstream fix for CVE-2012-2143 Resolves: #830721 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 7 Oracle Linux 6 Oracle Linux 5 bash The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-7169) Applications which directly create bash functions as environment variables need to be made aware of changes to the way names are handled by this update. Note that certain services, screen sessions, and tmux sessions may need to be restarted, and affected interactive users may need to re-login. Installing these updated packages without restarting services will address the vulnerability, but functionality may be impacted until affected services are restarted. For more information see the Knowledgebase article at <A HREF="https://access.redhat.com/articles/1200223">https://access.redhat.com/articles/1200223</A> Note: Docker users are advised to use &quot;yum update&quot; within their containers, and to commit the resulting changes. For additional information on CVE-2014-6271 and CVE-2014-7169, refer to the aforementioned Knowledgebase article. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.215.2] - futex: Make lookup_pi_state more robust (Thomas Gleixner) [Orabug: 18918614] {CVE-2014-3153} - futex: Always cleanup owner tid in unlock_pi (Thomas Gleixner) [Orabug: 18918614] {CVE-2014-3153} - futex: Validate atomic acquisition in futex_lock_pi_atomic() (Thomas Gleixner) [Orabug: 18918614] {CVE-2014-3153} - futex: Forbid uaddr1 == uaddr2 in futex_requeue(..., requeue_pi=1) (Thomas Gleixner) [Orabug: 18918614] {CVE-2014-3153} {CVE-2014-3153} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openssl [0.9.8e-27.3] - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability [0.9.8e-27.1] - replace expired GlobalSign Root CA certificate in ca-bundle.crt Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.21.1] - SPEC: v2.6.39-400.21.1 (Maxim Uvarov) - xen/mmu: On early bootup, flush the TLB when changing RO->RW bits Xen provided pagetables. (Konrad Rzeszutek Wilk) Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.36.2uek] - futex: Make lookup_pi_state more robust (Thomas Gleixner) [Orabug: 18918736] {CVE-2014-3153} - futex: Always cleanup owner tid in unlock_pi (Thomas Gleixner) [Orabug: 18918736] {CVE-2014-3153} - futex: Validate atomic acquisition in futex_lock_pi_atomic() (Thomas Gleixner) [Orabug: 18918736] {CVE-2014-3153} - futex: Forbid uaddr1 == uaddr2 in futex_requeue(..., requeue_pi=1) (Thomas Gleixner) [Orabug: 18918736] {CVE-2014-3153} {CVE-2014-3153} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.34.5uek] - aacraid: missing capable() check in compat ioctl (Dan Carpenter) [Orabug: 18723276] {CVE-2013-6383} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm [kvm-83-262.0.1.el5_9.3] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch [kvm-83-262.el5_3] - kvm-kernel-kvm-accept-unaligned-MSR_KVM_SYSTEM_TIME-writes.patch [bz#947363] - Resolves: bz#947363 (RHEL.5.8.32 guest hang when installing) [kvm-83-262.el5_2] - kvm-kernel-KVM-Fix-for-buffer-overflow-in-handling-of-MSR_KVM_S.patch [bz#917018] - kvm-kernel-KVM-Convert-MSR_KVM_SYSTEM_TIME-to-use-kvm_write_gue.patch [bz#917022] - kvm-kernel-KVM-Fix-bounds-checking-in-ioapic-indirect-register-.patch [bz#917028] - kvm-kernel-do-not-GP-on-unaligned-MSR_KVM_SYSTEM_TIME-write.patch [bz#bz917019] - Resolves: bz#917018 (CVE-2013-1796 kernel: kvm: buffer overflow in handling of MSR_KVM_SYSTEM_TIME [rhel-5.9.z]) - Resolves: bz#917022 (CVE-2013-1797 kernel: kvm: after free issue with the handling of MSR_KVM_SYSTEM_TIME [rhel-5.9.z]) - Resolves: bz#917028 (CVE-2013-1798 kernel: kvm: out-of-bounds access in ioapic indirect register reads [rhel-5.9.z]) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 piranha [0.8.4-26.1.0.1] - Replace web/web/RedHat.gif with updated image in tarball [0.8.4-26.1] - Resolves: #1061903 - require authentication for all HTTP methods [0.8.4-26] - Resolves: #886361 - add SIGCHLD handler to pulse for lvs mode Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.7.0-openjdk [1.7.0.51-2.4.4.1.0.1.el5_10] - Add oracle-enterprise.patch - Fix DISTRO_NAME to 'Enterprise Linux' [1.7.0.51-2.4.4.1.el5] - updated to security icedtea 2.4.4 - icedtea_version set to 2.4.4 - updatever bumped to 51 - release reset to 1 - build requires: java-devel >= 1:1.6.0 changed java7-devel - Resolves: rhbz#1050192 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 net-snmp [5.3.2.2-22.0.2.el5_10.1] - hrProcessorLoad returns incorrect values for CPUs greater than 100 (Jason Luan) [Orabug 17792842] - snmptrapd: Fix crash due to access of freed memory (John Haxby) [orabug 14391194] - suppress spurious asserts on 32bit [Greg Marsden] [5.3.2.2-20.1] - Fixed CVE-2012-6151: snmpd crashing when AgentX subagent disconnects in the middle of request processing (#1073224) - Fixed CVE-2014-2285: snmptrapd crash when using a trap with empty community string (#1073224) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 xulrunner [10.0.8-2.0.1.el6_3] - Replace xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.8-2] - Added patches from 10.0.9 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk [1:1.6.0.0-1.62.1.11.11.90] - updated to icedtea6-1.11.11.90.tar.gz - removed upstreamed patch9 jaxp-backport-factoryfinder.patch - removed upstreamed patch10 fixToFontSecurityFix.patch. - modified patch3, java-1.6.0-openjdk-java-access-bridge-security.patch - Resolves: rhbz#973129 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-300.38.1] - [net/sfc] limit number of segments per skb on tx (Maxim Uvarov) [Orabug: 14769994] {CVE-2012-3412} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-200.34.1] - [net/sfc] limit number of segments per skb on tx (Maxim Uvarov) [Orabug: 14769994] {CVE-2012-3412} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel kernel [2.6.18-371.12.1.0.1.el5] - ocfs2: dlm: fix recovery hung (Junxiao Bi) [orabug 13956772] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 httpd [2.2.15-31.0.1.el6_5] - replace index.html with Oracle's index page oracle_index.html - update vstring in specfile [2.2.15-31] - mod_cgid: add security fix for CVE-2014-0231 - mod_deflate: add security fix for CVE-2014-0118 - mod_status: add security fix for CVE-2014-0226 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 hypervkvpd [0-0.7.0.1.el5_9.3] - Add support for oracle os [0-0.7.3] - Fix for one more file descriptor leak (rhbz#953502) [0-0.7.2] - Validate Netlink source address (CVE-2012-5532) (rhbz#953560) [0-0.7.1] - Fix for file descriptor leak (rhbz#953502) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 7 Oracle Linux 5 Oracle Linux 6 nss Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A flaw was found in the way NSS parsed ASN.1 (Abstract Syntax Notation One) input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS. (CVE-2014-1568) Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Antoine Delignat-Lavaud and Intel Product Security Incident Response Team as the original reporters. All NSS users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, applications using NSS must be restarted for this update to take effect. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openssl openssl-devel openssl-perl [0.9.8e-31] - add support for fallback SCSV to partially mitigate CVE-2014-3566 (padding attack on SSL3) [0.9.8e-30] - fix CVE-2014-0221 - recursion in DTLS code leading to DoS - fix CVE-2014-3505 - doublefree in DTLS packet processing - fix CVE-2014-3506 - avoid memory exhaustion in DTLS - fix CVE-2014-3508 - fix OID handling to avoid information leak - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS [0.9.8e-29] - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability [0.9.8e-28] - replace expired GlobalSign Root CA certificate in ca-bundle.crt Sergey Artykhov DRAFT Maria Mikhno INTERIM Prashant Kumar ACCEPTED ACCEPTED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-348.1.1.0.1] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 7 Oracle Linux 6 Oracle Linux 5 jakarta-commons-httpclient Jakarta Commons HTTPClient implements the client side of HTTP standards. It was discovered that the HTTPClient incorrectly extracted host name from an X.509 certificate subject&#39;s Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3577) For additional information on this flaw, refer to the Knowledgebase article in the References section. All jakarta-commons-httpclient users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers - version 1.5.7-0.1 * Tue Nov 01 2011 Joe Jin - 1.5.7 for UEK kernel. * Mon Sep 08 2008 Vladimir Sokolovsky - Added nfsrdma support * Wed Aug 13 2008 Vladimir Sokolovsky - Added mlx4_en support * Tue Aug 21 2007 Vladimir Sokolovsky - Added %build LANG=C export LANG unset DISPLAY macro * Sun Jan 28 2007 Vladimir Sokolovsky - Created spec file for kernel-ib]]> Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 samba3x samba [3.6.9-169] - resolves: #1105499 - CVE-2014-0244: DoS in nmbd. - resolves: #1108840 - CVE-2014-3493: DoS in smbd with unicode path names. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.214.6] - aacraid: missing capable() check in compat ioctl (Dan Carpenter) [Orabug: 18721962] {CVE-2013-6383} - vhost: fix total length when packets are too short (Michael S. Tsirkin) [Orabug: 18721977] {CVE-2014-0077} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.215.3] - SELinux: Fix kernel BUG on empty security contexts. (Stephen Smalley) [Orabug: 19028380] {CVE-2014-1874} - floppy: don't write kernel-only members to FDRAWCMD ioctl output (Matthew Daley) [Orabug: 19028444] {CVE-2014-1738} - floppy: ignore kernel-only members in FDRAWCMD ioctl input (Matthew Daley) [Orabug: 19028438] {CVE-2014-1737} - libertas: potential oops in debugfs (Dan Carpenter) [Orabug: 19028416] {CVE-2013-6378} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk [1:1.6.0.0-1.68.1.11.14] - updated to icedtea6-1.11.14.tar.gz - added and applied 1.11.14-fixes.patch, patch10 to fix build issues - adapted patch8 java-1.6.0-openjdk-timezone-id.patch - Resolves: rhbz#1017618 [1:1.6.0.1-1.67.1.13.0] - reverted previous update - Resolves: rhbz#1017618 [1:1.6.0.1-1.66.1.13.0] - updated to icedtea 1.13 - updated to openjdk-6-src-b28-04_oct_2013 - added --disable-lcms2 configure switch to fix tck - removed upstreamed patch7,java-1.6.0-openjdk-jstack.patch - added patch7 1.13_fixes.patch to fix 1.13 build issues - adapted patch0 java-1.6.0-openjdk-optflags.patch - adapted patch3 java-1.6.0-openjdk-java-access-bridge-security.patch - adapted patch8 java-1.6.0-openjdk-timezone-id.patch - removed useless runtests parts - included also java.security.old files - Resolves: rhbz#1017618 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bind97 [32:9.7.0-17.P2.2] - fix for CVE-2013-4854 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [17.0.5-1.0.1] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat ones [17.0.5-1] - Update to 17.0.5 ESR xulrunner [17.0.5-1.0.1.el6_4] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js - Removed XULRUNNER_VERSION from SOURCE21 [17.0.5-1] - Update to 17.0.5 ESR [17.0.3-3] - Added fix for rhbz#916180 - Wrong library directory reference in /usr/bin/xulrunner Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 qspice [0.3.0-56.1] - Fix spice-server crash when client sends a password which is too long Resolves: CVE-2013-4282 [0.3.0-56.el5] - Fix unsafe accesses + spice: drop libpng from windows components (537849) + libspice: fix unsafe guest data accessing Resolves: #568720 + fix unsafe free() call. Resolves: #568724 + spice server: fix unsafe cursor items handling. Resolves: #568720 [0.3.0-55.el5] - spice: clear client palette caches on migration Resolves: #599496 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php [5.1.6-44] - add security fixes for CVE-2006-7243, CVE-2009-0689 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gnutls [1.4.1-16] - added missing check for null pointer (#1102355) [1.4.1-15] - fix session ID length check and null pointer dereference (#1102355) - fix minitasn1 issues (#1102355) - Renamed gnutls-1.4.1-cve-2014-5138.patch to cve-2009-5138.patch Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 gimp [2:2.6.9-6] - fix overflow in XWD loader (CVE-2013-1913, CVE-2013-1978) [2:2.6.9-5] - fix overflow in XWD loader (#879302) [2:2.6.9-5] - fix overflow in GIF loader (#847303) [2:2.6.9-5] - fix overflows in GIF, CEL loaders (#727800, #839020) [2:2.6.9-4.1] - fix various overflows (#666793, #703403, #703405, #703407, #704512) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 7 Oracle Linux 5 firefox xulrunner Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1562, CVE-2014-1567) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Jan de Mooij as the original reporter of CVE-2014-1562, and regenrecht as the original reporter of CVE-2014-1567. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.8.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 24.8.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libxml2 [2.7.6-12.0.1.el6_4.1] - Update doc/redhat.gif in tarball - Add libxml2-oracle-enterprise.patch and update logos in tarball Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 conga The Conga project is a management system for remote workstations. It consists of luci, which is a secure web-based front end, and ricci, which is a secure daemon that dispatches incoming messages to underlying management modules. It was discovered that Plone, included as a part of luci, did not properly protect the administrator interface (control panel). A remote attacker could use this flaw to inject a specially crafted Python statement or script into Plone&#39;s restricted Python sandbox that, when the administrator interface was accessed, would be executed with the privileges of that administrator user. (CVE-2012-5485) It was discovered that Plone, included as a part of luci, did not properly sanitize HTTP headers provided within certain URL requests. A remote attacker could use a specially crafted URL that, when processed, would cause the injected HTTP headers to be returned as a part of the Plone HTTP response, potentially allowing the attacker to perform other more advanced attacks. (CVE-2012-5486) Multiple information leak flaws were found in the way conga processed luci site extension-related URL requests. A remote, unauthenticated attacker could issue a specially crafted HTTP request that, when processed, would result in unauthorized information disclosure. (CVE-2013-6496) It was discovered that various components in the luci site extension-related URLs were not properly restricted to administrative users. A remote, authenticated attacker could escalate their privileges to perform certain actions that should be restricted to administrative users, such as adding users and systems, and viewing log data. (CVE-2014-3521) It was discovered that Plone, included as a part of luci, did not properly protect the privilege of running RestrictedPython scripts. A remote attacker could use a specially crafted URL that, when processed, would allow the attacker to submit and perform expensive computations or, in conjunction with other attacks, be able to access or alter privileged information. (CVE-2012-5488) It was discovered that Plone, included as a part of luci, did not properly enforce permissions checks on the membership database. A remote attacker could use a specially crafted URL that, when processed, could allow the attacker to enumerate user account names. (CVE-2012-5497) It was discovered that Plone, included as a part of luci, did not properly handle the processing of requests for certain collections. A remote attacker could use a specially crafted URL that, when processed, would lead to excessive I/O and/or cache resource consumption. (CVE-2012-5498) It was discovered that Plone, included as a part of luci, did not properly handle the processing of very large values passed to an internal utility function. A remote attacker could use a specially crafted URL that, when processed, would lead to excessive memory consumption. (CVE-2012-5499) It was discovered that Plone, included as a part of luci, allowed a remote anonymous user to change titles of content items due to improper permissions checks. (CVE-2012-5500) The CVE-2014-3521 issue was discovered by Radek Steiger of Red Hat, and the CVE-2013-6496 issue was discovered by Jan Pokorny of Red Hat. In addition, these updated conga packages include several bug fixes. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 5.11 Technical Notes, linked to in the References section, for information on the most significant of these changes All conga users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the luci and ricci services will be restarted automatically. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.7.0-openjdk [1.7.0.65-2.5.1.2.0.1.el5_10] - Add oracle-enterprise.patch - Fix DISTRO_NAME to 'Enterprise Linux' [1.7.0.65-2.5.1.2] - added and applied fix for samrtcard io patch405, pr1864_smartcardIO.patch - Resolves: rhbz#1115872 [1.7.0.65-2.5.1.1.el5] - updated to security patched icedtea7-forest 2.5.1 - Resolves: rhbz#1115872 [1.7.0.60-2.5.0.1.el5] - update to icedtea7-forest 2.5.0 (rh1114937) - Resolves: rhbz#1115872 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 kernel-uek [2.6.39-400.214.5.el6uek] - net: ipv4: current group_info should be put after using. (Wang, Xiaoming) [Orabug: 18603524] {CVE-2014-2851} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 nspr nss nspr [4.9.1-4] - Resolves: rhbz#834219 - Fix postinstall scriptlet failures - Fix %post and %postun lines per packaging guidelines - Updated License: to MPLv2.0 per upstream [4.9.1-3] - Resolves: rhbz#834219 - Ensure nspr-config.in changes get applied [4.9.1-2] - Resolves: rhbz#834219 - restore top section of nspr-config-pc.patch - Needed to prevent multilib regressions nss [3.13.5-4.0.1.el5_8 ] - Update clean.gif in the tarball [3.13.5-4] - Related: rhbz#834219 - Fix ia64 / i386 multilib nss install failure - Remove no longer needed %pre and %preun scriplets meant for nss updates from RHEL-5.0 [3.13.5-3] - Resolves: rhbz#834219 - Fix the changes to the %post line - Having multiple commands requires that /sbin/lconfig be the beginning of the scriptlet [3.13.5-2] - Resolves: rhbz#834219 - Fix multilib and scriptlet problems - Fix %post and %postun lines per packaging guildelines - Add %{?_isa} to tools Requires: per packaging guidelines - Fix explicit-lib-dependency zlib error reported by rpmlint [3.13.5-1] - Resolves: rhbz#834219 - Update RHEL 5.x to NSS 3.13.5 and NSPR 4.9.1 for Mozilla 10.0.6 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers [2.6.32-300.39.1] - hugepages: fix use after free bug in 'quota' handling [15842385] {CVE-2012-2133} - mm: Hold a file reference in madvise_remove [15842884] {CVE-2012-3511} - udf: Fortify loading of sparing table [15843730] {CVE-2012-3400} - udf: Avoid run away loop when partition table length is corrupt [15843730] {CVE-2012-3400} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 bind97 [32:9.7.0-10.P2.3] - fix CVE-2012-4244 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 libjpeg [6b-38] - Add patch for CVE-2013-6629 - Resolves: #1031952 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bind97 The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. It contains a DNS server (named), a resolver library with routines for applications to use when interfacing with DNS, and tools for verifying that the DNS server is operating correctly. These packages contain version 9.7 of the BIND suite. A denial of service flaw was found in the way BIND handled queries for NSEC3-signed zones. A remote attacker could use this flaw against an authoritative name server that served NCES3-signed zones by sending a specially crafted query, which, when processed, would cause named to crash. (CVE-2014-0591) Note: The CVE-2014-0591 issue does not directly affect the version of bind97 shipped in Red Hat Enterprise Linux 5. This issue is being addressed however to assure it is not introduced in future builds of bind97 (possibly built with a different compiler or C library optimization). This update also fixes the following bug: * Previously, the bind97 initscript did not check for the existence of the ROOTDIR variable when shutting down the named daemon. As a consequence, some parts of the file system that are mounted when using bind97 in a chroot environment were unmounted on daemon shut down, even if bind97 was not running in a chroot environment. With this update, the initscript has been fixed to check for the existence of the ROOTDIR variable when unmounting some parts of the file system on named daemon shut down. Now, when shutting down bind97 that is not running in a chroot environment, no parts of the file system are unmounted. (BZ#1059118) All bind97 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the update, the BIND daemon (named) will be restarted automatically. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.209.2] - dm snapshot: fix data corruption (Mikulas Patocka) [Orabug: 17618492] {CVE-2013-4299} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 samba3x samba [3.6.9-168] - resolves: #1073905 - Fix CVE-2012-6150. - resolves: #1073905 - Fix CVE-2013-4496. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php53 [5.3.3-26] - fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710 [5.3.3-25] - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668 - core: fix integer overflow in unserialize() CVE-2014-3669 - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [17.0.6-1.0.1.el6_4] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat ones [17.0.6-1] - Update to 17.0.6 ESR [17.0.5-2] - Updated XulRunner check xulrunner [17.0.6-2.0.1.el6_4] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js - Removed XULRUNNER_VERSION from SOURCE21 [17.0.6-2] - Update to 17.0.6 ESR [17.0.5-2] - Updated nss and nspr versions Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gnupg [1.4.5-18] - fix CVE-2013-4351 gpg treats no-usage-permitted keys as all-usages-permitted [1.4.5-17] - fix CVE-2012-6085 GnuPG: read_block() corrupt key input validation - fix CVE-2013-4242 GnuPG susceptible to Yarom/Falkner side-channel attack - fix CVE-2013-4402 GnuPG: infinite recursion in the compressed packet parser [1.4.5-15] - fix error when decrypting certain files (#510500) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 openssl [0.9.8e-27.4] - fix CVE-2014-0221 - recursion in DTLS code leading to DoS - fix CVE-2014-3505 - doublefree in DTLS packet processing - fix CVE-2014-3506 - avoid memory exhaustion in DTLS - fix CVE-2014-3508 - fix OID handling to avoid information leak - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel kernel [2.6.18-371.11.1] - [fs] dcache: fix cleanup on warning in d_splice_alias (Denys Vlasenko) [1109720 1080606] - [net] neigh: Make neigh_add_timer symmetrical to neigh_del_timer (Marcelo Ricardo Leitner) [1111195 1109888] - [net] neigh: set NUD_INCOMPLETE when probing router reachability (Marcelo Ricardo Leitner) [1106354 1090806] - [net] ipv6: router reachability probing (Marcelo Ricardo Leitner) [1106354 1090806] - [net] ipv6: probe routes asynchronous in rt6_probe (Marcelo Ricardo Leitner) [1106354 1090806] - [net] ndisc: Update neigh->updated with write lock (Marcelo Ricardo Leitner) [1106354 1090806] - [net] ipv6: remove the unnecessary statement in find_match() (Marcelo Ricardo Leitner) [1106354 1090806] - [net] ipv6: fix route selection if CONFIG_IPV6_ROUTER_PREF unset (Marcelo Ricardo Leitner) [1106354 1090806] - [net] ipv6: Fix def route failover when CONFIG_IPV6_ROUTER_PREF=n (Marcelo Ricardo Leitner) [1106354 1090806] - [net] ipv6: Prefer reachable nexthop only if the caller requests (Marcelo Ricardo Leitner) [1106354 1090806] - [fs] ext4/jbd2: don't wait forever stale tid caused by wraparound (Eric Sandeen) [1097528 980268] - [fs] ext4: Initialize fsync transaction ids in ext4_new_inode() (Eric Sandeen) [1097528 980268] - [fs] jbd2: don't wake kjournald unnecessarily (Eric Sandeen) [1097528 980268] - [fs] jbd2: fix fsync() tid wraparound bug (Eric Sandeen) [1097528 980268] - [infiniband] rds: do not deref NULL dev in rds_iw_laddr_check() (Jacob Tanenbaum) [1093311 1093312] {CVE-2014-2678} - [fs] nfs4: Add recovery for individual stateids - partial backport. (Dave Wysochanski) [1113468 867570] - [fs] nfs4: Don't start state recovery in nfs4_close_done - clean backport. (Dave Wysochanski) [1113468 867570] - [xen] page-alloc: scrub anonymous domain heap pages upon freeing (Vitaly Kuznetsov) [1103648 1103649] {CVE-2014-4021} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 xen [3.0.3-142.el5_9.1] - libxc: move error checking next to the function which returned the error (rhbz 876997) - libxc: builder: limit maximum size of kernel/ramdisk (rhbz 876997) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 7 Oracle Linux 5 bash The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-6271) For additional information on the CVE-2014-6271 flaw, refer to the Knowledgebase article at <A HREF="https://access.redhat.com/articles/1200223">https://access.redhat.com/articles/1200223</A> Red Hat would like to thank Stephane Chazelas for reporting this issue. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.6.0-openjdk The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2014-0429) Multiple flaws were discovered in the Hotspot and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to trigger Java Virtual Machine memory corruption and possibly bypass Java sandbox restrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421) Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0457, CVE-2014-0461) Multiple improper permission check issues were discovered in the AWT, JAX-WS, JAXB, Libraries, and Sound components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-2412, CVE-2014-0451, CVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-0446, CVE-2014-2427) Multiple flaws were identified in the Java Naming and Directory Interface (JNDI) DNS client. These flaws could make it easier for a remote attacker to perform DNS spoofing attacks. (CVE-2014-0460) It was discovered that the JAXP component did not properly prevent access to arbitrary files when a SecurityManager was present. This flaw could cause a Java application using JAXP to leak sensitive information, or affect application availability. (CVE-2014-2403) It was discovered that the Security component in OpenJDK could leak some timing information when performing PKCS#1 unpadding. This could possibly lead to the disclosure of some information that was meant to be protected by encryption. (CVE-2014-0453) It was discovered that the fix for CVE-2013-5797 did not properly resolve input sanitization flaws in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting (XSS) attacks. (CVE-2014-2398) An insecure temporary file use flaw was found in the way the unpack200 utility created log files. A local attacker could possibly use this flaw to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running unpack200. (CVE-2014-1876) This update also fixes the following bug: * The OpenJDK update to IcedTea version 1.13 introduced a regression related to the handling of the jdk_version_info variable. This variable was not properly zeroed out before being passed to the Java Virtual Machine, resulting in a memory leak in the java.lang.ref.Finalizer class. This update fixes this issue, and memory leaks no longer occur. (BZ#1085373) All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-300.17.3] - mm/hotplug: correctly add new zone to all other nodes zone lists (Jiang Liu) [Orabug: 16020976 Bug-db: 14798] {CVE-2012-5517} - Divide by zero in TCP congestion control Algorithm. (Jesper Dangaard Brouer) [Orabug: 16020656 Bug-db: 14798] {CVE-2012-4565} - Fix length of buffer copied in __nfs4_get_acl_uncached (Sachin Prabhu) [Bug- db: 14798] {CVE-2012-2375} - Avoid reading past buffer when calling GETACL (Sachin Prabhu) [Bug-db: 14798] {CVE-2012-2375} - Avoid beyond bounds copy while caching ACL (Sachin Prabhu) [Bug-db: 14798] {CVE-2012-2375} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 pixman [0.26.2-5.1] - Fix CVE 2013-6425 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-348.4.1.0.1] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sssd [1.5.1-70] - Fix IPA provider performance issue when storing large host groups - Resolves: rhbz#979047 - sssd_be goes to 99% CPU and causes significant login delays when client is under load Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 nss nss-devel nss-pkcs11-devel nss-tools nss-sysinit [3.15.3-3.0.1.el6_5] - Added nss-vendor.patch to change vendor [3.15.3-3] - Revoke trust in one mis-issued anssi certificate - Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) [rhel-6.6] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-100.7.1.el6uek] - KVM: Ensure all vcpus are consistent with in-kernel irqchip settings (Avi Kivity) [Bugdb: 13871] {CVE-2012-1601} - jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer (Eric Sandeen) [Bugdb: 13871] {CVE-2011-4086} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 squid Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects. A flaw was found in the way Squid handled malformed HTTP Range headers. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2014-3609) A buffer overflow flaw was found in Squid&#39;s DNS lookup module. A remote attacker able to send HTTP requests to the Squid proxy could use this flaw to crash Squid. (CVE-2013-4115) Red Hat would like to thank the Squid project for reporting the CVE-2014-3609 issue. Upstream acknowledges Matthew Daley as the original reporter. All Squid users are advised to upgrade to this updated package, which contains backported patches to correct these issues. After installing this update, the squid service will be restarted automatically. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner firefox [10.0.7-1.0.1.el6_3] - Replace firefox-redhat-default-prefs.js with firefox-oracle-default-prefs.js [10.0.7-1] - Update to 10.0.7 ESR xulrunner [10.0.7-1.0.1.el6_3] - Replace xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js [10.0.7-1] - Update to 10.0.7 ESR [10.0.6-2] - Added fix for rhbz#770276 - Firefox segfaults, should have a font dependency Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 samba [3.0.33-3.40.el5] - Security Release, fixes CVE-2013-0213 and CVE-2013-4124 - resolves: #1073350 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 axis Apache Axis is an implementation of SOAP (Simple Object Access Protocol). It can be used to build both web service clients and servers. It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject&#39;s Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2014-3596) For additional information on this flaw, refer to the Knowledgebase article in the References section. This issue was discovered by David Jorm and Arun Neelicattu of Red Hat Product Security. All axis users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using Apache Axis must be restarted for this update to take effect. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird [10.0.8-2.0.1.el6_3] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Replace clean.gif in tarball [10.0.8-2] - Added patches from 10.0.9 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libxslt [1.1.26-2.0.2.el6_3.1] - Increment release to avoid ULN conflict with previous release. [1.1.26-2.0.1.el6_3.1] - Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball [1.1.26-2.el6_3.1] - fixes CVE-2011-1202 CVE-2011-3970 CVE-2012-2825 CVE-2012-2871 CVE-2012-2870 - Fix direct pattern matching bug - Fix popping of vars in xsltCompilerNodePop - Fix bug 602515 - Fix generate-id() to not expose object addresses (CVE-2011-1202) - Fix some case of pattern parsing errors (CVE-2011-3970) - Fix a bug in selecting XSLT elements (CVE-2012-2825) - Fix portability to upcoming libxml2-2.9.0 - Fix default template processing on namespace nodes (CVE-2012-2871) - Cleanup of the pattern compilation code (CVE-2012-2870) - Hardening of code checking node types in various entry point (CVE-2012-2870) - Hardening of code checking node types in EXSLT (CVE-2012-2870) - Fix system-property with unknown namespace - Xsltproc should return an error code if xinclude fails - Fix a dictionary string usage - Avoid a heap use after free error Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 krb5 Kerberos is an authentication system which allows clients and services to authenticate to each other with the help of a trusted third party, a Kerberos Key Distribution Center (KDC). A buffer overflow was found in the KADM5 administration server (kadmind) when it was used with an LDAP back end for the KDC database. A remote, authenticated attacker could potentially use this flaw to execute arbitrary code on the system running kadmind. (CVE-2014-4345) All krb5 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the krb5kdc and kadmind daemons will be restarted automatically. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird [10.0.11-1.0.1.el6_3] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [10.0.11-1] - Update to 10.0.11 ESR Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel kernel [2.6.18-371.8.1] - [virt] HID: memory corruption flaw drivers/usb/input/hid-core.c (Jacob Tanenbaum) [1032996 1032999] {CVE-2013-2888} - [virt] HID: memory corruption flaw in drivers/hv/hid-core.c (Jacob Tanenbaum) [1032996 1032999] {CVE-2013-2888} - [scsi] lpfc: Fix task management commands having a fixed timeout (Ewan Milne) [1073123 1061120] - [net] tcp: drop SYN+FIN messages (Jiri Pirko) [1066057 1066058] {CVE-2012-6638} - [fs] GFS2: Check if glock held in gfs2_readpage (Robert S Peterson) [1073953 1063434] - [net] sunrpc: fix deadlock in task wakeup code (Jeff Layton) [1073731 998126] [2.6.18-371.7.1] - [s390x] af_iucv: Kernel panic during connect (IUCV transport) (Hendrik Brueckner) [1077045 1026388] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.7.0-openjdk The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2014-0429) Multiple flaws were discovered in the Hotspot and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to trigger Java Virtual Machine memory corruption and possibly bypass Java sandbox restrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421) Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0457, CVE-2014-0455, CVE-2014-0461) Multiple improper permission check issues were discovered in the AWT, JAX-WS, JAXB, Libraries, Security, Sound, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-2412, CVE-2014-0451, CVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-2402, CVE-2014-0446, CVE-2014-2413, CVE-2014-0454, CVE-2014-2427, CVE-2014-0459) Multiple flaws were identified in the Java Naming and Directory Interface (JNDI) DNS client. These flaws could make it easier for a remote attacker to perform DNS spoofing attacks. (CVE-2014-0460) It was discovered that the JAXP component did not properly prevent access to arbitrary files when a SecurityManager was present. This flaw could cause a Java application using JAXP to leak sensitive information, or affect application availability. (CVE-2014-2403) It was discovered that the Security component in OpenJDK could leak some timing information when performing PKCS#1 unpadding. This could possibly lead to the disclosure of some information that was meant to be protected by encryption. (CVE-2014-0453) It was discovered that the fix for CVE-2013-5797 did not properly resolve input sanitization flaws in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting (XSS) attacks. (CVE-2014-2398) An insecure temporary file use flaw was found in the way the unpack200 utility created log files. A local attacker could possibly use this flaw to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running unpack200. (CVE-2014-1876) All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 yum-updatesd [1:0.9-6] - updatesd: prevent installing unsigned packages. - Resolves: rhbz#1125185 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 httpd The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. It was found that the mod_dav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the mod_dav module (for example when using the mod_dav_svn module), a remote attacker could send a specially crafted DAV request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the &quot;apache&quot; user. (CVE-2013-6438) A buffer over-read flaw was found in the httpd mod_log_config module. In configurations where cookie logging is enabled (on Red Hat Enterprise Linux it is disabled by default), a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie header. (CVE-2014-0098) All httpd users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-348.3.1.0.1] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.7.0-openjdk [1:1.7.0.71-2.5.3.1.0.1.el5_11] - Add oracle-enterprise.patch - Fix DISTRO_NAME to 'Enterprise Linux' [1:1.7.0.71-2.5.3.1] - Bump to 2.5.3 with security updates. - Remove obsolete patches which are now included upstream. - Disable LCMS via environment variables rather than maintaining a patch. - Resolves: rhbz#1148890 Sergey Artykhov DRAFT Maria Mikhno INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 xalan-j2 Xalan-Java is an XSLT processor for transforming XML documents into HTML, text, or other XML document types. It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features. A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java. (CVE-2014-0107) All xalan-j2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 7 Oracle Linux 6 Oracle Linux 5 procmail The procmail program is used for local mail delivery. In addition to just delivering mail, procmail can be used for automatic filtering, presorting, and other mail handling jobs. A heap-based buffer overflow flaw was found in procmail&#39;s formail utility. A remote attacker could send an email with specially crafted headers that, when processed by formail, could cause procmail to crash or, possibly, execute arbitrary code as the user running formail. (CVE-2014-3618) All procmail users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The kernel packages contain the Linux kernel, the core of any Linux operating system. * An out-of-bounds memory access flaw was found in the Linux kernel&#39;s system call auditing implementation. On a system with existing audit rules defined, a local, unprivileged user could use this flaw to leak kernel memory to user space or, potentially, crash the system. (CVE-2014-3917, Moderate) This update also fixes the following bugs: * A bug in the journaling code (jbd and jbd2) could, under very heavy workload of fsync() operations, trigger a BUG_ON and result in a kernel oops. Also, fdatasync() could fail to immediately write out changes in the file size only. These problems have been resolved by backporting a series of patches that fixed these problems in the respective code on Red Hat Enterprise Linux 6. This update also improves performance of ext3 and ext4 file systems. (BZ#1116027) * Due to a bug in the ext4 code, the fdatasync() system call did not force the inode size change to be written to the disk if it was the only metadata change in the file. This could result in the wrong inode size and possible data loss if the system terminated unexpectedly. The code handling inode updates has been fixed and fdatasync() now writes data to the disk as expected in this situation. (BZ#1117665) * A workaround to a DMA read problem in the tg3 driver was incorrectly applied to the whole Broadcom 5719 and 5720 chipset family. This workaround is valid only to the A0 revision of the 5719 chips and for other revisions and chips causes occasional Tx timeouts. This update correctly applies the aforementioned workaround only to the A0 revision of the 5719 chips. (BZ#1121017) * Due to a bug in the page writeback code, the system could become unresponsive when being under memory pressure and heavy NFS load. This update fixes the code responsible for handling of dirty pages, and dirty page write outs no longer flood the work queue. (BZ#1125246) All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 automake Automake is a tool for automatically generating Makefile.in files compliant with the GNU Coding Standards. It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running &quot;make distcheck&quot;. (CVE-2012-3386) Red Hat would like to thank Jim Meyering for reporting this issue. Upstream acknowledges Stefano Lattarini as the original reporter. All automake users are advised to upgrade to this updated package, which contains a backported patch to correct this issue. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird [24.4.0-1.0.1] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [24.4.0-1] - Update to 24.4.0 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gnupg [1.4.5-18.1] - fix CVE-2013-4576 acoustic side channel attack on RSA private keys Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php [5.1.6-43] - drop unneeded patch [5.1.6-42] - add security fixes for CVE-2012-2688, CVE-2011-1398, CVE-2013-1643, CVE-2013-6420 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 mysql [5.0.95-3] - Re-add patch for CVE-2009-4030, mistakenly removed in 5.0.95 rebase Resolves: CVE-2012-4452 [5.0.95-2] - Support rotation of mysqld log (though this is not enabled by default) Resolves: #647223 - Fix crash with EXPLAIN and prepared statements Resolves: #654000 - Adopt init script updates from the last Fedora init script (F-15) Resolves: #703476 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk [ 1:1.6.0.0-1.36.1.11.9.0.1.el5_9] - Add oracle-enterprise.patch [1:1.6.0.0-1.36.1.11.9] - Updated to icedtea6 1.11.9 - Resolves: rhbz#917176 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 xulrunner [17.0.3-2.0.1.el6_4] - Replaced xulrunner-redhat-default-prefs.js with xulrunner-oracle-default-prefs.js - Removed XULRUNNER_VERSION from SOURCE21 [17.0.3-2] - Added fix for #848644 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-371.3.1.0.1] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-348.12.1.0.1] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printks when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sos [1.7-9.62.0.1.el5_9.1] - add patch to remove all sysrq echo commands from sysreport.legacy (John Sobecki) [orabug 11061754] - comment out rh-upload-core and README.rh-upload-core in specfile [1.7-9.62.el5_9.1] - Remove anaconda-ks.cfg collection from general plug-in Resolves: bz965807 [1.7-9.62.el5_9] - Elide passwords in anaconda-ks.cfg and yum.repos.d Resolves: bz965807 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.36.10uek] - USB: whiteheat: Added bounds checking for bulk command response (James Forshaw) [Orabug: 19849336] {CVE-2014-3185} - HID: fix a couple of off-by-ones (Jiri Kosina) [Orabug: 19849320] {CVE-2014-3181} logging macros to functions (Joe Perches) [Orabug: 19847630] {CVE-2014-3535} logging macros to functions (Joe Perches) [Orabug: 19847630] - vsprintf: Recursive vsnprintf: Add '%pV', struct va_format (Joe Perches) [Orabug: 19847630] - KVM: x86: Improve thread safety in pit (Andy Honig) [Orabug: 19905688] {CVE-2014-3611} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.215.4] - l2tp: fix an unprivileged user to kernel privilege escalation (Sasha Levin) [Orabug: 19229505] {CVE-2014-4943} {CVE-2014-4943} - ptrace,x86: force IRET path after a ptrace_stop() (Tejun Heo) [Orabug: 19230690] {CVE-2014-4699} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 bash [3.2-33.1.0.1] - Preliminary fix for CVE-2014-7169 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel ocfs2 oracleasm kernel-PAE kernel-PAE-devel kernel-debug kernel-debug-devel kernel-devel kernel-doc kernel-headers kernel-xen kernel-xen-devel kernel [2.6.18-371.11.1.0.1] - ocfs2: dlm: fix recovery hung (Junxiao Bi) [orabug 13956772] - i386: fix MTRR code (Zhenzhong Duan) [orabug 15862649] - [oprofile] x86, mm: Add __get_user_pages_fast() [orabug 14277030] - [oprofile] export __get_user_pages_fast() function [orabug 14277030] - [oprofile] oprofile, x86: Fix nmi-unsafe callgraph support [orabug 14277030] - [oprofile] oprofile: use KM_NMI slot for kmap_atomic [orabug 14277030] - [oprofile] oprofile: i386 add get_user_pages_fast support [orabug 14277030] - [kernel] Initialize the local uninitialized variable stats. [orabug 14051367] - [fs] JBD:make jbd support 512B blocks correctly for ocfs2. [orabug 13477763] - [x86 ] fix fpu context corrupt when preempt in signal context [orabug 14038272] - [mm] fix hugetlb page leak (Dave McCracken) [orabug 12375075] - fix ia64 build error due to add-support-above-32-vcpus.patch(Zhenzhong Duan) - [x86] use dynamic vcpu_info remap to support more than 32 vcpus (Zhenzhong Duan) - [x86] Fix lvt0 reset when hvm boot up with noapic param - [scsi] remove printk's when doing I/O to a dead device (John Sobecki, Chris Mason) [orabug 12342275] - [char] ipmi: Fix IPMI errors due to timing problems (Joe Jin) [orabug 12561346] - [scsi] Fix race when removing SCSI devices (Joe Jin) [orabug 12404566] - [net] net: Redo the broken redhat netconsole over bonding (Tina Yang) [orabug 12740042] - [fs] nfs: Fix __put_nfs_open_context() NULL pointer panic (Joe Jin) [orabug 12687646] - fix filp_close() race (Joe Jin) [orabug 10335998] - make xenkbd.abs_pointer=1 by default [orabug 67188919] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - [net] Enable entropy for bnx2,bnx2x,e1000e,igb,ixgb,ixgbe,ixgbevf (John Sobecki) [orabug 10315433] - [NET] Add xen pv netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] Patch shrink_zone to yield during severe mempressure events, avoiding hangs and evictions (John Sobecki,Chris Mason) [orabug 6086839] - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki,Chris Mason,Herbert van den Bergh) [orabug 9245919] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] - [ib] fix memory corruption (Andy Grover) [orabug 9972346] - [usb] USB: fix __must_check warnings in drivers/usb/core/ (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix endpoint device creation (Junxiao Bi) [orabug 14795203] - [usb] usbcore: fix refcount bug in endpoint removal (Junxiao Bi) [orabug 14795203] Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware [2.6.39-400.214.4] - netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (Daniel Borkmann) [Orabug: 18462070] {CVE-2014-2523} - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable (Daniel Borkmann) [Orabug: 18461090] {CVE-2014-0101} - vhost-net: insufficient handling of error conditions in get_rx_bufs() (Guangyu Sun) [Orabug: 18461089] {CVE-2014-0055} Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mysql55-mysql [5.5.36-2] - Fix CVE-2014-0001 Related: #1055875 [5.5.36-1] - Update to MySQL 5.5.36, for various fixes described at http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-36.html Including fixes for CVE-2014-0412, CVE-2014-0437, CVE-2013-5908, CVE-2013-5807, CVE-2014-0420, CVE-2014-0393, CVE-2013-5891, CVE-2014-0386, CVE-2013-3839, CVE-2014-0401, CVE-2014-0402, Resolves: #1055875 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 scsi-target-utils [0.0-6.20091205snap.3] - Fix buffer overflow in isns scn handling (CVE-2010-2221) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird [17.0.8-5.0.1.el6_4] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [17.0.8-5] - Update to 17.0.8 ESR - Added strict aliasing patch (mozbz#821502) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 kernel-uek [2.6.39-400.215.10.el6uek] - auditsc: audit_krule mask accesses need bounds checking (Andy Lutomirski) [Orabug: 19590597] {CVE-2014-3917} [2.6.39-400.215.9.el6uek] - oracleasm: Add support for new error return codes from block/SCSI (Martin K. Petersen) [Orabug: 18438934] [2.6.39-400.215.8.el6uek] - ib_ipoib: CSUM support in connected mode (Yuval Shaia) [Orabug: 18692878] - net: Reduce high cpu usage in bonding driver by do_csum (Venkat Venkatsubra) [Orabug: 18141731] - [random] Partially revert 6d7c7e49: random: make 'add_interrupt_randomness() (John Sobecki) [Orabug: 17740293] - oracleasm: claim FMODE_EXCL access on disk during asm_open (Srinivas Eeda) [Orabug: 19453460] - notify block layer when using temporary change to cache_type (Vaughan Cao) [Orabug: 19448451] - sd: Fix parsing of 'temporary ' cache mode prefix (Ben Hutchings) [Orabug: 19448451] - sd: fix array cache flushing bug causing performance problems (James Bottomley) [Orabug: 19448451] - block: fix max discard sectors limit (James Bottomley) [Orabug: 18961244] - xen-netback: fix deadlock in high memory pressure (Junxiao Bi) [Orabug: 18959416] - sdp: fix keepalive functionality (shamir rabinovitch) [Orabug: 18728784] - SELinux: Fix possible NULL pointer dereference in selinux_inode_permission() (Steven Rostedt) [Orabug: 18552029] - refcount: take rw_lock in ocfs2_reflink (Wengang Wang) [Orabug: 18406219] - ipv6: check return value for dst_alloc (Madalin Bucur) [Orabug: 17865160] - cciss: bug fix to prevent cciss from loading in kdump crash kernel (Mike Miller) [Orabug: 17740446] - configfs: fix race between dentry put and lookup (Junxiao Bi) [Orabug: 17627075] Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 krb5 Kerberos is an authentication system which allows clients and services to authenticate to each other with the help of a trusted third party, a Kerberos Key Distribution Center (KDC). It was found that if a KDC served multiple realms, certain requests could cause the setup_server_realm() function to dereference a NULL pointer. A remote, unauthenticated attacker could use this flaw to crash the KDC using a specially crafted request. (CVE-2013-1418, CVE-2013-6800) A NULL pointer dereference flaw was found in the MIT Kerberos SPNEGO acceptor for continuation tokens. A remote, unauthenticated attacker could use this flaw to crash a GSSAPI-enabled server application. (CVE-2014-4344) A buffer over-read flaw was found in the way MIT Kerberos handled certain requests. A man-in-the-middle attacker with a valid Kerberos ticket who is able to inject packets into a client or server application&#39;s GSSAPI session could use this flaw to crash the application. (CVE-2014-4341) This update also fixes the following bugs: * Prior to this update, the libkrb5 library occasionally attempted to free already freed memory when encrypting credentials. As a consequence, the calling process terminated unexpectedly with a segmentation fault. With this update, libkrb5 frees memory correctly, which allows the credentials to be encrypted appropriately and thus prevents the mentioned crash. (BZ#1004632) * Previously, when the krb5 client library was waiting for a response from a server, the timeout variable in certain cases became a negative number. Consequently, the client could enter a loop while checking for responses. With this update, the client logic has been modified and the described error no longer occurs. (BZ#1089732) All krb5 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kernel-uek mlnx_en ofa kernel-uek-debug kernel-uek-debug-devel kernel-uek-devel kernel-uek-doc kernel-uek-firmware kernel-uek-headers kernel-uek [2.6.32-400.29.3uek] - block: do not pass disk names as format strings (Jerry Snitselaar) [Orabug: 17230124] {CVE-2013-2851} - af_key: initialize satype in key_notify_policy_flush() (Nicolas Dichtel) [Orabug: 17370765] {CVE-2013-2237} - Bluetooth: L2CAP - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17371054] {CVE-2012-6544} - Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) (Mathias Krause) [Orabug: 17371072] {CVE-2012-6544} - ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Eric Dumazet) [Orabug: 17371079] {CVE-2013-2232} - sctp: Use correct sideffect command in duplicate cookie handling (Vlad Yasevich) [Orabug: 17371121] {CVE-2013-2206} - sctp: deal with multiple COOKIE_ECHO chunks (Max Matveev) [Orabug: 17372129] {CVE-2013-2206} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel kernel [2.6.18-371.3.1] - [net] be2net: don't use GRO for packets w/ re-inserted VLAN tags (Ivan Vecera) [1023348 1008691] - [net] tg3: call pci_enable_wake() to set power state (John Feeney) [1014973 996331] - [misc] backport fixes for percpu-rw-semaphore (Mikulas Patocka) [1014715 867997] - [xen] information leak via I/O instruction emulation (Igor Mammedov) [1009602 1009603] {CVE-2013-4355} [2.6.18-371.2.1] - [scsi] mpt2sas: bump version (Tomas Henzl) [1018458 956330] - [scsi] mpt2sas: fix the incorrect scsi_dma_map error checking (Tomas Henzl) [1018458 956330] - [xen] x86: check segment descriptor read result in 64-bit OUTS emulation (Radim Krcmar) [1012958 1012959] {CVE-2013-4368} - [md] dm snapshot: fix data corruption (Mikulas Patocka) [1004734 975353] {CVE-2013-4299} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 php53 php [5.3.3-27] - add security fix for CVE-2013-6420 Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 xorg-x11-server [1.13.0-23.1] - Fix root window damage reports when Xinerama is active (#919165) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 scsi-target-utils [0.0-6.20091205snap.2] - 576359 Fix format string vulnerability (CVE-2010-0743) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gnutls [1.4.1-14] - Renamed gnutls-1.4.1-cve-2014-0092-1.patch to cve-2014-5138.patch - Renamed gnutls-1.4.1-cve-2014-0092-2.patch to cve-2014-0092.patch [1.4.1-13] - fix issues of CVE-2014-0092 (#1069888) [1.4.1-12] - fix CVE-2013-2116 - fix DoS regression in CVE-2013-1619 upstream patch (#966754) [1.4.1-11] - fix CVE-2013-1619 - fix TLS-CBC timing attack (#908238) Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 struts [1.2.9-4jpp.7] - Resolves: rhbz#1092457 - CVE-2014-0114: Fixed ClassLoader manipulation vulnerability - Added dist tag to release Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 wireshark [1.0.15-7.0.1.el5] - Added oracle-ocfs2-network.patch - increase max packet size to 65536 (Herbert van den Bergh) [orabug 13542633] [1.0.15-7] - security patches - Resolves: CVE-2014-6421 CVE-2014-6423 CVE-2014-6425 CVE-2014-6428 CVE-2014-6429 Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 kernel-uek kernel-uek [2.6.32-400.36.8.el6uek] - auditsc: audit_krule mask accesses need bounds checking (Andy Lutomirski) [Orabug: 19590638] {CVE-2014-3917} - futex: Fix errors in nested key ref-counting (Darren Hart) [Orabug: 19590443] {CVE-2014-0205} Sergey Artykhov DRAFT INTERIM ACCEPTED Maria Kedovskaya INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 Oracle Linux 7 java-1.6.0-openjdk [1:1.6.0.33-1.13.5.0] - Update to IcedTea 1.13.5 - Remove upstreamed patches. - Regenerate add-final-location-rpaths patch against new release. - Change versioning to match java-1.7.0-openjdk so revisions work. - Use xz for tarballs to reduce file size. - No need to explicitly disable system LCMS any more (bug fixed upstream). - Add icedteasnapshot to setup lines so they work with pre-release tarballs. - Resolves: rhbz#1148901 Sergey Artykhov DRAFT Maria Mikhno INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 7 The operating system installed on the system is Oracle Linux 7.x Maria Mikhno DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 nss Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. (BZ#1110857, BZ#1110860) This update also fixes the following bugs: * Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as &quot;grep&quot;, could not handle failures properly. This update improves error detection in the specification file, and &quot;grep&quot; and other utilities now handle missing files or crashes as intended. (BZ#1035281) * Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. (BZ#1042684) * Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5. (BZ#11015864) Users of nss and nspr are advised to upgrade to these updated packages, which correct these issues and add these enhancements. Sergey Artykhov DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1533, CVE-2014-1538, CVE-2014-1541) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Christoph Diehl, Christian Holler, Hannes Verschore, Jan de Mooij, Ryan VanderMeulen, Jeff Walden, Kyle Huey, Abhishek Arya, and Nils as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 24.6.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 24.6.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-ibm IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-0457, CVE-2014-2421, CVE-2014-0429, CVE-2014-0461, CVE-2014-2428, CVE-2014-0446, CVE-2014-0452, CVE-2014-0451, CVE-2014-2423, CVE-2014-2427, CVE-2014-0458, CVE-2014-2414, CVE-2014-2412, CVE-2014-2409, CVE-2014-0460, CVE-2013-6954, CVE-2013-6629, CVE-2014-2401, CVE-2014-0449, CVE-2014-0453, CVE-2014-2398, CVE-2014-1876, CVE-2014-2420) All users of java-1.6.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 6 SR16 release. All running instances of IBM Java must be restarted for the update to take effect. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security Bulletin APSB14-16, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2014-0534, CVE-2014-0535, CVE-2014-0536) Multiple flaws in flash-plugin could allow an attacker to conduct cross-site scripting (XSS) attacks if a victim were tricked into visiting a specially crafted web page. (CVE-2014-0531, CVE-2014-0532, CVE-2014-0533) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.378. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 openssl097a openssl098e OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. (CVE-2014-0224) Note: In order to exploit this flaw, both the server and the client must be using a vulnerable version of OpenSSL; the server must be using OpenSSL version 1.0.1 and above, and the client must be using any version of OpenSSL. For more information about this flaw, refer to: https://access.redhat.com/site/articles/904433 Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges KIKUCHI Masashi of Lepidum as the original reporter of this issue. All OpenSSL users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all services linked to the OpenSSL library (such as httpd and other SSL-enabled services) must be restarted or the system rebooted. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openssl OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. (CVE-2014-0224) Note: In order to exploit this flaw, both the server and the client must be using a vulnerable version of OpenSSL; the server must be using OpenSSL version 1.0.1 and above, and the client must be using any version of OpenSSL. For more information about this flaw, refer to: https://access.redhat.com/site/articles/904433 Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges KIKUCHI Masashi of Lepidum as the original reporter of this issue. All OpenSSL users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all services linked to the OpenSSL library (such as httpd and other SSL-enabled services) must be restarted or the system rebooted. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 7 Oracle Linux 6 Oracle Linux 5 firefox xulrunner Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1533, CVE-2014-1538, CVE-2014-1541) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Christoph Diehl, Christian Holler, Hannes Verschore, Jan de Mooij, Ryan VanderMeulen, Jeff Walden, Kyle Huey, Abhishek Arya, and Nils as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.6.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 24.6.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Red Hat Enterprise Linux 7 The operating system installed on the system is Red Hat Enterprise Linux 7. Maria Mikhno DRAFT INTERIM ACCEPTED ACCEPTED Oracle Linux 5 struts Apache Struts is a framework for building web applications with Java. It was found that the Struts 1 ActionForm object allowed access to the 'class' parameter, which is directly mapped to the getClass() method. A remote attacker could use this flaw to manipulate the ClassLoader used by an application server running Struts 1. This could lead to remote code execution under certain conditions. (CVE-2014-0114) All struts users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using struts must be restarted for this update to take effect. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory. (CVE-2014-1737, Important) * It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement. (CVE-2014-1738, Low) Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system. * A NULL pointer dereference flaw was found in the rds_ib_laddr_check() function in the Linux kernel's implementation of Reliable Datagram Sockets (RDS). A local, unprivileged user could use this flaw to crash the system. (CVE-2013-7339, Moderate) Red Hat would like to thank Matthew Daley for reporting CVE-2014-1737 and CVE-2014-1738. This update also fixes the following bugs: * A bug in the futex system call could result in an overflow when passing a very large positive timeout. As a consequence, the FUTEX_WAIT operation did not work as intended and the system call was timing out immediately. A backported patch fixes this bug by limiting very large positive timeouts to the maximal supported value. (BZ#1091832) * A new Linux Security Module (LSM) functionality related to the setrlimit hooks should produce a warning message when used by a third party module that could not cope with it. However, due to a programming error, the kernel could print this warning message when a process was setting rlimits for a different process, or if rlimits were modified by another than the main thread even though there was no incompatible third party module. This update fixes the relevant code and ensures that the kernel handles this warning message correctly. (BZ#1092869) * Previously, the kernel was unable to detect KVM on system boot if the Hyper-V emulation was enabled. A patch has been applied to ensure that both KVM and Hyper-V hypervisors are now correctly detected during system boot. (BZ#1094152) * A function in the RPC code responsible for verifying whether cached credentials match the current process did not perform the check correctly. The code checked only whether the groups in the current process credentials appear in the same order as in the cached credentials but did not ensure that no other groups are present in the cached credentials. As a consequence, when accessing files in NFS mounts, a process with the same UID and GID as the original process but with a non-matching group list could have been granted an unauthorized access to a file, or under certain circumstances, the process could have been wrongly prevented from accessing the file. The incorrect test condition has been fixed and the problem can no longer occur. (BZ#1095062) * When being under heavy load, some Fibre Channel storage devices, such as Hitachi and HP Open-V series, can send a logout (LOGO) message to the host system. However, due to a bug in the lpfc driver, this could result in a loss of active paths to the storage and the paths could not be recovered without manual intervention. This update corrects the lpfc driver to ensure automatic recovery of the lost paths to the storage in this scenario. (BZ#1096061) All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.5.0-ibm IBM J2SE version 5.0 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-0457, CVE-2014-2421, CVE-2014-0429, CVE-2014-0446, CVE-2014-0451, CVE-2014-2427, CVE-2014-2412, CVE-2014-0460, CVE-2013-6629, CVE-2014-2401, CVE-2014-0453, CVE-2014-2398, CVE-2014-1876) All users of java-1.5.0-ibm are advised to upgrade to these updated packages, containing the IBM J2SE 5.0 SR16-FP6 release. All running instances of IBM Java must be restarted for this update to take effect. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.7.0-ibm IBM Java SE version 7 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Detailed vulnerability descriptions are linked from the IBM Security alerts page, listed in the References section. (CVE-2014-0457, CVE-2014-2421, CVE-2014-0429, CVE-2014-0461, CVE-2014-0455, CVE-2014-2428, CVE-2014-0448, CVE-2014-0454, CVE-2014-0446, CVE-2014-0452, CVE-2014-0451, CVE-2014-2402, CVE-2014-2423, CVE-2014-2427, CVE-2014-0458, CVE-2014-2414, CVE-2014-2412, CVE-2014-2409, CVE-2014-0460, CVE-2013-6954, CVE-2013-6629, CVE-2014-2401, CVE-2014-0449, CVE-2014-0459, CVE-2014-0453, CVE-2014-2398, CVE-2014-1876, CVE-2014-2420) All users of java-1.7.0-ibm are advised to upgrade to these updated packages, containing the IBM Java SE 7 SR7 release. All running instances of IBM Java must be restarted for the update to take effect. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.7.0-oracle Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2013-6629, CVE-2013-6954, CVE-2014-0429, CVE-2014-0432, CVE-2014-0446, CVE-2014-0448, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2397, CVE-2014-2398, CVE-2014-2401, CVE-2014-2402, CVE-2014-2403, CVE-2014-2409, CVE-2014-2412, CVE-2014-2413, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2422, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428) All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 55 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.6.0-sun Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory pages, listed in the References section. (CVE-2013-1500, CVE-2013-1571, CVE-2013-2407, CVE-2013-2412, CVE-2013-2437, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2461, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743, CVE-2013-3829, CVE-2013-4002, CVE-2013-5772, CVE-2013-5774, CVE-2013-5776, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5789, CVE-2013-5790, CVE-2013-5797, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5852, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2013-5905, CVE-2013-5906, CVE-2013-5907, CVE-2013-5910, CVE-2013-6629, CVE-2013-6954, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428, CVE-2014-0429, CVE-2014-0446, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2398, CVE-2014-2401, CVE-2014-2403, CVE-2014-2409, CVE-2014-2412, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428) All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide Oracle Java 6 Update 75 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mysql55-mysql MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon (mysqld) and many client programs and libraries. This update fixes several vulnerabilities in the MySQL database server. Information about these flaws can be found on the Oracle Critical Patch Update Advisory page, listed in the References section. (CVE-2014-2436, CVE-2014-2440, CVE-2014-0384, CVE-2014-2419, CVE-2014-2430, CVE-2014-2431, CVE-2014-2432, CVE-2014-2438) These updated packages upgrade MySQL to version 5.5.37. Refer to the MySQL Release Notes listed in the References section for a complete list of changes. All MySQL users should upgrade to these updated packages, which correct these issues. After installing this update, the MySQL server daemon (mysqld) will be restarted automatically. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1518, CVE-2014-1524, CVE-2014-1529, CVE-2014-1531) A use-after-free flaw was found in the way Thunderbird resolved hosts in certain circumstances. An attacker could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1532) An out-of-bounds read flaw was found in the way Thunderbird decoded JPEG images. Loading an email or a web page containing a specially crafted JPEG image could cause Thunderbird to crash. (CVE-2014-1523) A flaw was found in the way Thunderbird handled browser navigations through history. An attacker could possibly use this flaw to cause the address bar of the browser to display a web page name while loading content from an entirely different web page, which could allow for cross-site scripting (XSS) attacks. (CVE-2014-1530) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Jesse Ruderman, Nathan Froyd, Christian Holler, Abhishek Arya, Mariusz Mlynski, moz_bug_r_a4, Nils, Tyson Smith and Jesse Schwartzentrube as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 24.5.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 24.5.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.7.0-openjdk The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2014-0429) Multiple flaws were discovered in the Hotspot and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to trigger Java Virtual Machine memory corruption and possibly bypass Java sandbox restrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421) Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0457, CVE-2014-0455, CVE-2014-0461) Multiple improper permission check issues were discovered in the AWT, JAX-WS, JAXB, Libraries, Security, Sound, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-2412, CVE-2014-0451, CVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-2402, CVE-2014-0446, CVE-2014-2413, CVE-2014-0454, CVE-2014-2427, CVE-2014-0459) Multiple flaws were identified in the Java Naming and Directory Interface (JNDI) DNS client. These flaws could make it easier for a remote attacker to perform DNS spoofing attacks. (CVE-2014-0460) It was discovered that the JAXP component did not properly prevent access to arbitrary files when a SecurityManager was present. This flaw could cause a Java application using JAXP to leak sensitive information, or affect application availability. (CVE-2014-2403) It was discovered that the Security component in OpenJDK could leak some timing information when performing PKCS#1 unpadding. This could possibly lead to the disclosure of some information that was meant to be protected by encryption. (CVE-2014-0453) It was discovered that the fix for CVE-2013-5797 did not properly resolve input sanitization flaws in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting (XSS) attacks. (CVE-2014-2398) An insecure temporary file use flaw was found in the way the unpack200 utility created log files. A local attacker could possibly use this flaw to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running unpack200. (CVE-2014-1876) All users of java-1.7.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.6.0-sun Oracle Java SE version 6 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory pages, listed in the References section. (CVE-2013-1500, CVE-2013-1571, CVE-2013-2407, CVE-2013-2412, CVE-2013-2437, CVE-2013-2442, CVE-2013-2443, CVE-2013-2444, CVE-2013-2445, CVE-2013-2446, CVE-2013-2447, CVE-2013-2448, CVE-2013-2450, CVE-2013-2451, CVE-2013-2452, CVE-2013-2453, CVE-2013-2454, CVE-2013-2455, CVE-2013-2456, CVE-2013-2457, CVE-2013-2459, CVE-2013-2461, CVE-2013-2463, CVE-2013-2464, CVE-2013-2465, CVE-2013-2466, CVE-2013-2468, CVE-2013-2469, CVE-2013-2470, CVE-2013-2471, CVE-2013-2472, CVE-2013-2473, CVE-2013-3743, CVE-2013-3829, CVE-2013-4002, CVE-2013-5772, CVE-2013-5774, CVE-2013-5776, CVE-2013-5778, CVE-2013-5780, CVE-2013-5782, CVE-2013-5783, CVE-2013-5784, CVE-2013-5787, CVE-2013-5789, CVE-2013-5790, CVE-2013-5797, CVE-2013-5801, CVE-2013-5802, CVE-2013-5803, CVE-2013-5804, CVE-2013-5809, CVE-2013-5812, CVE-2013-5814, CVE-2013-5817, CVE-2013-5818, CVE-2013-5819, CVE-2013-5820, CVE-2013-5823, CVE-2013-5824, CVE-2013-5825, CVE-2013-5829, CVE-2013-5830, CVE-2013-5831, CVE-2013-5832, CVE-2013-5840, CVE-2013-5842, CVE-2013-5843, CVE-2013-5848, CVE-2013-5849, CVE-2013-5850, CVE-2013-5852, CVE-2013-5878, CVE-2013-5884, CVE-2013-5887, CVE-2013-5888, CVE-2013-5889, CVE-2013-5896, CVE-2013-5898, CVE-2013-5899, CVE-2013-5902, CVE-2013-5905, CVE-2013-5906, CVE-2013-5907, CVE-2013-5910, CVE-2013-6629, CVE-2013-6954, CVE-2014-0368, CVE-2014-0373, CVE-2014-0375, CVE-2014-0376, CVE-2014-0387, CVE-2014-0403, CVE-2014-0410, CVE-2014-0411, CVE-2014-0415, CVE-2014-0416, CVE-2014-0417, CVE-2014-0418, CVE-2014-0422, CVE-2014-0423, CVE-2014-0424, CVE-2014-0428, CVE-2014-0429, CVE-2014-0446, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2398, CVE-2014-2401, CVE-2014-2403, CVE-2014-2409, CVE-2014-2412, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428) All users of java-1.6.0-sun are advised to upgrade to these updated packages, which provide Oracle Java 6 Update 75 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel The kernel packages contain the Linux kernel, the core of any Linux operating system. * A flaw was found in the way the Linux kernel's TCP/IP protocol suite implementation handled TCP packets with both the SYN and FIN flags set. A remote attacker could use this flaw to consume an excessive amount of resources on the target system, potentially resulting in a denial of service. (CVE-2012-6638, Moderate) * A flaw was found in the way the Linux kernel handled HID (Human Interface Device) reports with an out-of-bounds Report ID. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2013-2888, Moderate) This update also fixes the following bugs: * A previous change to the sunrpc code introduced a race condition between the rpc_wake_up_task() and rpc_wake_up_status() functions. A race between threads operating on these functions could result in a deadlock situation, subsequently triggering a "soft lockup" event and rendering the system unresponsive. This problem has been fixed by re-ordering tasks in the RPC wait queue. (BZ#1073731) * Running a process in the background on a GFS2 file system could sometimes trigger a glock recursion error that resulted in a kernel panic. This happened when a readpage operation attempted to take a glock that had already been held by another function. To prevent this error, GFS2 now verifies whether the glock is already held when performing the readpage operation. (BZ#1073953) * A previous patch backport to the IUCV (Inter User Communication Vehicle) code was incomplete. Consequently, when establishing an IUCV connection, the kernel could, under certain circumstances, dereference a NULL pointer, resulting in a kernel panic. A patch has been applied to correct this problem by calling the proper function when removing IUCV paths. (BZ#1077045) In addition, this update adds the following enhancement: * The lpfc driver had a fixed timeout of 60 seconds for SCSI task management commands. With this update, the lpfc driver enables the user to set this timeout within the range from 5 to 180 seconds. The timeout can be changed by modifying the "lpfc_task_mgmt_tmo" parameter for the lpfc driver. (BZ#1073123) All kernel users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. The system must be rebooted for this update to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.7.0-oracle Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2013-6629, CVE-2013-6954, CVE-2014-0429, CVE-2014-0432, CVE-2014-0446, CVE-2014-0448, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2397, CVE-2014-2398, CVE-2014-2401, CVE-2014-2402, CVE-2014-2403, CVE-2014-2409, CVE-2014-2412, CVE-2014-2413, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2422, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428) All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 55 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 samba3x samba Samba is an open-source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information. It was found that certain Samba configurations did not enforce the password lockout mechanism. A remote attacker could use this flaw to perform password guessing attacks on Samba user accounts. Note: this flaw only affected Samba when deployed as a Primary Domain Controller. (CVE-2013-4496) A flaw was found in the way the pam_winbind module handled configurations that specified a non-existent group as required. An authenticated user could possibly use this flaw to gain access to a service using pam_winbind in its PAM configuration when group restriction was intended for access to the service. (CVE-2012-6150) Red Hat would like to thank the Samba project for reporting CVE-2013-4496 and Sam Richardson for reporting CVE-2012-6150. Upstream acknowledges Andrew Bartlett as the original reporter of CVE-2013-4496. All users of Samba are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 gnutls The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). The gnutls packages also include the libtasn1 library, which provides Abstract Syntax Notation One (ASN.1) parsing and structures management, and Distinguished Encoding Rules (DER) encoding and decoding functions. A flaw was found in the way GnuTLS parsed session IDs from ServerHello messages of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS/SSL client application using GnuTLS, causing the client application to crash or, possibly, execute arbitrary code. (CVE-2014-3466) It was discovered that the asn1_get_bit_der() function of the libtasn1 library incorrectly reported the length of ASN.1-encoded data. Specially crafted ASN.1 input could cause an application using libtasn1 to perform an out-of-bounds access operation, causing the application to crash or, possibly, execute arbitrary code. (CVE-2014-3468) Multiple incorrect buffer boundary check issues were discovered in libtasn1. Specially crafted ASN.1 input could cause an application using libtasn1 to crash. (CVE-2014-3467) Multiple NULL pointer dereference flaws were found in libtasn1's asn1_read_value() function. Specially crafted ASN.1 input could cause an application using libtasn1 to crash, if the application used the aforementioned function in a certain way. (CVE-2014-3469) Red Hat would like to thank GnuTLS upstream for reporting these issues. Upstream acknowledges Joonas Kuorilehto of Codenomicon as the original reporter of CVE-2014-3466. Users of GnuTLS are advised to upgrade to these updated packages, which correct these issues. For the update to take effect, all applications linked to the GnuTLS or libtasn1 library must be restarted. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 xalan-j2 Xalan-Java is an XSLT processor for transforming XML documents into HTML, text, or other XML document types. It was found that the secure processing feature of Xalan-Java had insufficient restrictions defined for certain properties and features. A remote attacker able to provide Extensible Stylesheet Language Transformations (XSLT) content to be processed by an application using Xalan-Java could use this flaw to bypass the intended constraints of the secure processing feature. Depending on the components available in the classpath, this could lead to arbitrary remote code execution in the context of the application server running the application that uses Xalan-Java. (CVE-2014-0107) All xalan-j2 users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 samba3x samba Samba is an open-source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information. It was found that certain Samba configurations did not enforce the password lockout mechanism. A remote attacker could use this flaw to perform password guessing attacks on Samba user accounts. Note: this flaw only affected Samba when deployed as a Primary Domain Controller. (CVE-2013-4496) A flaw was found in the way the pam_winbind module handled configurations that specified a non-existent group as required. An authenticated user could possibly use this flaw to gain access to a service using pam_winbind in its PAM configuration when group restriction was intended for access to the service. (CVE-2012-6150) Red Hat would like to thank the Samba project for reporting CVE-2013-4496 and Sam Richardson for reporting CVE-2012-6150. Upstream acknowledges Andrew Bartlett as the original reporter of CVE-2013-4496. All users of Samba are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 postgresql84 postgresql PostgreSQL is an advanced object-relational database management system (DBMS). Multiple stack-based buffer overflow flaws were found in the date/time implementation of PostgreSQL. An authenticated database user could provide a specially crafted date/time value that, when processed, could cause PostgreSQL to crash or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2014-0063) Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in various type input functions in PostgreSQL. An authenticated database user could possibly use these flaws to crash PostgreSQL or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2014-0064) Multiple potential buffer overflow flaws were found in PostgreSQL. An authenticated database user could possibly use these flaws to crash PostgreSQL or, potentially, execute arbitrary code with the permissions of the user running PostgreSQL. (CVE-2014-0065) It was found that granting an SQL role to a database user in a PostgreSQL database without specifying the "ADMIN" option allowed the grantee to remove other users from their granted role. An authenticated database user could use this flaw to remove a user from an SQL role which they were granted access to. (CVE-2014-0060) A flaw was found in the validator functions provided by PostgreSQL's procedural languages (PLs). An authenticated database user could possibly use this flaw to escalate their privileges. (CVE-2014-0061) A race condition was found in the way the CREATE INDEX command performed multiple independent lookups of a table that had to be indexed. An authenticated database user could possibly use this flaw to escalate their privileges. (CVE-2014-0062) It was found that the chkpass extension of PostgreSQL did not check the return value of the crypt() function. An authenticated database user could possibly use this flaw to crash PostgreSQL via a null pointer dereference. (CVE-2014-0066) Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Noah Misch as the original reporter of CVE-2014-0060 and CVE-2014-0063, Heikki Linnakangas and Noah Misch as the original reporters of CVE-2014-0064, Peter Eisentraut and Jozef Mlich as the original reporters of CVE-2014-0065, Andres Freund as the original reporter of CVE-2014-0061, Robert Haas and Andres Freund as the original reporters of CVE-2014-0062, and Honza Horak and Bruce Momjian as the original reporters of CVE-2014-0066. These updated packages upgrade PostgreSQL to version 8.4.20, which fixes these issues as well as several non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes: http://www.postgresql.org/docs/8.4/static/release-8-4-19.html http://www.postgresql.org/docs/8.4/static/release-8-4-20.html All PostgreSQL users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Firefox processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Firefox rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1509) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O'Callahan, Mariusz Mlynski, Jüri Aedla, George Hotz, and the security research firm VUPEN as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.4.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 24.4.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 wireshark Wireshark is a network protocol analyzer. It is used to capture and browse the traffic running on a computer network. Multiple flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2013-3559, CVE-2013-4083, CVE-2014-2281, CVE-2014-2299) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2012-5595, CVE-2012-5598, CVE-2012-5599, CVE-2012-5600, CVE-2012-6056, CVE-2012-6060, CVE-2012-6061, CVE-2012-6062, CVE-2013-3557, CVE-2013-4081, CVE-2013-4927, CVE-2013-4931, CVE-2013-4932, CVE-2013-4933, CVE-2013-4934, CVE-2013-4935, CVE-2013-5721, CVE-2013-7112) All Wireshark users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of Wireshark must be restarted for the update to take effect. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Thunderbird to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1509) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O'Callahan, Mariusz Mlynski, Jüri Aedla, George Hotz, and the security research firm VUPEN as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially-crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 24.4.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 24.4.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.7.0-oracle Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2013-6629, CVE-2013-6954, CVE-2014-0429, CVE-2014-0432, CVE-2014-0446, CVE-2014-0448, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2397, CVE-2014-2398, CVE-2014-2401, CVE-2014-2402, CVE-2014-2403, CVE-2014-2409, CVE-2014-2412, CVE-2014-2413, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2422, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428) All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 55 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox Mozilla Firefox is an open source web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1518, CVE-2014-1524, CVE-2014-1529, CVE-2014-1531) A use-after-free flaw was found in the way Firefox resolved hosts in certain circumstances. An attacker could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1532) An out-of-bounds read flaw was found in the way Firefox decoded JPEG images. Loading a web page containing a specially crafted JPEG image could cause Firefox to crash. (CVE-2014-1523) A flaw was found in the way Firefox handled browser navigations through history. An attacker could possibly use this flaw to cause the address bar of the browser to display a web page name while loading content from an entirely different web page, which could allow for cross-site scripting (XSS) attacks. (CVE-2014-1530) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Jesse Ruderman, Nathan Froyd, Christian Holler, Abhishek Arya, Mariusz Mlynski, moz_bug_r_a4, Nils, Tyson Smith, and Jesse Schwartzentrube as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.5.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to this updated package, which contains Firefox version 24.5.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514) Several information disclosure flaws were found in the way Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Thunderbird to crash. (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505) A memory corruption flaw was found in the way Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1509) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Benoit Jacob, Olli Pettay, Jan Varga, Jan de Mooij, Jesse Ruderman, Dan Gohman, Christoph Diehl, Atte Kettunen, Tyson Smith, Jesse Schwartzentruber, John Thomson, Robert O'Callahan, Mariusz Mlynski, Jüri Aedla, George Hotz, and the security research firm VUPEN as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially-crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 24.4.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 24.4.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 httpd The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. It was found that the mod_dav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the mod_dav module (for example when using the mod_dav_svn module), a remote attacker could send a specially crafted DAV request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user. (CVE-2013-6438) A buffer over-read flaw was found in the httpd mod_log_config module. In configurations where cookie logging is enabled (on Red Hat Enterprise Linux it is disabled by default), a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie header. (CVE-2014-0098) All httpd users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon will be restarted automatically. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 samba Samba is an open-source implementation of the Server Message Block (SMB) or Common Internet File System (CIFS) protocol, which allows PC-compatible machines to share files, printers, and other information. It was discovered that the Samba Web Administration Tool (SWAT) did not protect against being opened in a web page frame. A remote attacker could possibly use this flaw to conduct a clickjacking attack against SWAT users or users with an active SWAT session. (CVE-2013-0213) A flaw was found in the Cross-Site Request Forgery (CSRF) protection mechanism implemented in SWAT. An attacker with the knowledge of a victim's password could use this flaw to bypass CSRF protections and conduct a CSRF attack against the victim SWAT user. (CVE-2013-0214) An integer overflow flaw was found in the way Samba handled an Extended Attribute (EA) list provided by a client. A malicious client could send a specially crafted EA list that triggered an overflow, causing the server to loop and reprocess the list using an excessive amount of memory. (CVE-2013-4124) Note: This issue did not affect the default configuration of the Samba server. Red Hat would like to thank the Samba project for reporting CVE-2013-0213 and CVE-2013-0214. Upstream acknowledges Jann Horn as the original reporter of CVE-2013-0213 and CVE-2013-0214. All users of Samba are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the smb service will be restarted automatically. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 openldap OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap package contains configuration files, libraries, and documentation for OpenLDAP. A denial of service flaw was found in the way the OpenLDAP server daemon (slapd) performed reference counting when using the rwm (rewrite/remap) overlay. A remote attacker able to query the OpenLDAP server could use this flaw to crash the server by immediately unbinding from the server after sending a search request. (CVE-2013-4449) Red Hat would like to thank Michael Vishchers from Seven Principles AG for reporting this issue. All openldap users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 net-snmp The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser. A denial of service flaw was found in the way snmpd, the Net-SNMP daemon, handled subagent timeouts. A remote attacker able to trigger a subagent timeout could use this flaw to cause snmpd to loop infinitely or crash. (CVE-2012-6151) A denial of service flaw was found in the way the snmptrapd service, which receives and logs SNMP trap messages, handled SNMP trap requests with an empty community string when the Perl handler (provided by the net-snmp-perl package) was enabled. A remote attacker could use this flaw to crash snmptrapd by sending a trap request with an empty community string. (CVE-2014-2285) All net-snmp users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, the snmpd and snmptrapd services will be restarted automatically. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 gnutls The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker. (CVE-2014-0092) A flaw was found in the way GnuTLS handled version 1 X.509 certificates. An attacker able to obtain a version 1 certificate from a trusted certificate authority could use this flaw to issue certificates for other sites that would be accepted by GnuTLS as valid. (CVE-2009-5138) The CVE-2014-0092 issue was discovered by Nikos Mavrogiannopoulos of the Red Hat Security Technologies Team. Users of GnuTLS are advised to upgrade to these updated packages, which correct these issues. For the update to take effect, all applications linked to the GnuTLS library must be restarted. Sushant Kumar Singh DRAFT INTERIM Maria Mikhno ACCEPTED ACCEPTED Oracle Linux 5 sudo Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security Bulletin APSB14-14, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2014-0510, CVE-2014-0517, CVE-2014-0518, CVE-2014-0519, CVE-2014-0520) A flaw in flash-plugin could allow an attacker to bypass the same-origin policy. (CVE-2014-0516) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.359. Prashant Kumar DRAFT Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 xalan-j2 ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 vino The vino_server_client_data_pending function in vino-server.c in GNOME Vino 2.26.1, 2.32.1, 3.7.3, and earlier, and 3.8 when encryption is disabled, does not properly clear client data when an error causes the connection to close during authentication, which allows remote attackers to cause a denial of service (infinite loop, CPU and disk consumption) via multiple crafted requests during authentication. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 pixman Integer underflow in the pixman_trapezoid_valid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo, allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to "insufficient security checks in IIOP streams," which allows attackers to escape the sandbox. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1518, CVE-2014-1524, CVE-2014-1529, CVE-2014-1531) A use-after-free flaw was found in the way Thunderbird resolved hosts in certain circumstances. An attacker could use this flaw to crash Thunderbird or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1532) An out-of-bounds read flaw was found in the way Thunderbird decoded JPEG images. Loading an email or a web page containing a specially crafted JPEG image could cause Thunderbird to crash. (CVE-2014-1523) A flaw was found in the way Thunderbird handled browser navigations through history. An attacker could possibly use this flaw to cause the address bar of the browser to display a web page name while loading content from an entirely different web page, which could allow for cross-site scripting (XSS) attacks. (CVE-2014-1530) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Jesse Ruderman, Nathan Froyd, Christian Holler, Abhishek Arya, Mariusz Mlynski, moz_bug_r_a4, Nils, Tyson Smith and Jesse Schwartzentrube as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 24.5.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 24.5.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 pidgin The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 php53 php The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes one vulnerability in Adobe Flash Player. This vulnerability is detailed in the Adobe Security Bulletin APSB14-13, listed in the References section. A flaw was found in the way flash-plugin displayed certain SWF content. An attacker could use this flaw to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2014-0515) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.356. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 xorg-x11-server Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 php ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libXfont Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in a character name in a BDF font file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 xinetd xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via crafted documents. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 httpd mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 postgresql84 postgresql The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 thunderbird Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary files by leveraging a download to a fixed pathname or other predictable pathname. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 xorg-x11-server Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary files by leveraging a download to a fixed pathname or other predictable pathname. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 pidgin upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.7.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to bypassing the Java sandbox using "method handle intrinsic frames." Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 postgresql84 postgresql WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ByteBandedRaster size checks" in 2D. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox Mozilla Firefox is an open source web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1518, CVE-2014-1524, CVE-2014-1529, CVE-2014-1531) A use-after-free flaw was found in the way Firefox resolved hosts in certain circumstances. An attacker could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1532) An out-of-bounds read flaw was found in the way Firefox decoded JPEG images. Loading a web page containing a specially crafted JPEG image could cause Firefox to crash. (CVE-2014-1523) A flaw was found in the way Firefox handled browser navigations through history. An attacker could possibly use this flaw to cause the address bar of the browser to display a web page name while loading content from an entirely different web page, which could allow for cross-site scripting (XSS) attacks. (CVE-2014-1530) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij, Jesse Ruderman, Nathan Froyd, Christian Holler, Abhishek Arya, Mariusz Mlynski, moz_bug_r_a4, Nils, Tyson Smith, and Jesse Schwartzentrube as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.5.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to this updated package, which contains Firefox version 24.5.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Use-after-free vulnerability in the nsContentUtils::RemoveScriptBlocker function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libgcrypt GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 elinks The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes one vulnerability in Adobe Flash Player. This vulnerability is detailed in the Adobe Security Bulletin APSB14-13, listed in the References section. A flaw was found in the way flash-plugin displayed certain SWF content. An attacker could use this flaw to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2014-0515) All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.356. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 ruby The OpenSSL::SSL.verify_certificate_identity function in lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9 before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2014-0429) Multiple flaws were discovered in the Hotspot and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to trigger Java Virtual Machine memory corruption and possibly bypass Java sandbox restrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421) Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0457, CVE-2014-0461) Multiple improper permission check issues were discovered in the AWT, JAX-WS, JAXB, Libraries, and Sound components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-2412, CVE-2014-0451, CVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-0446, CVE-2014-2427) Multiple flaws were identified in the Java Naming and Directory Interface (JNDI) DNS client. These flaws could make it easier for a remote attacker to perform DNS spoofing attacks. (CVE-2014-0460) It was discovered that the JAXP component did not properly prevent access to arbitrary files when a SecurityManager was present. This flaw could cause a Java application using JAXP to leak sensitive information, or affect application availability. (CVE-2014-2403) It was discovered that the Security component in OpenJDK could leak some timing information when performing PKCS#1 unpadding. This could possibly lead to the disclosure of some information that was meant to be protected by encryption. (CVE-2014-0453) It was discovered that the fix for CVE-2013-5797 did not properly resolve input sanitization flaws in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting (XSS) attacks. (CVE-2014-2398) An insecure temporary file use flaw was found in the way the unpack200 utility created log files. A local attacker could possibly use this flaw to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running unpack200. (CVE-2014-1876) This update also fixes the following bug: * The OpenJDK update to IcedTea version 1.13 introduced a regression related to the handling of the jdk_version_info variable. This variable was not properly zeroed out before being passed to the Java Virtual Machine, resulting in a memory leak in the java.lang.ref.Finalizer class. This update fixes this issue, and memory leaks no longer occur. (BZ#1085373) All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 cups CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 boost Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to be allocated than expected. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 firefox xulrunner The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that injects this code and triggers an eval operation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. An input validation flaw was discovered in the medialib library in the 2D component. A specially crafted image could trigger Java Virtual Machine memory corruption when processed. A remote attacker, or an untrusted Java application or applet, could possibly use this flaw to execute arbitrary code with the privileges of the user running the Java Virtual Machine. (CVE-2014-0429) Multiple flaws were discovered in the Hotspot and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to trigger Java Virtual Machine memory corruption and possibly bypass Java sandbox restrictions. (CVE-2014-0456, CVE-2014-2397, CVE-2014-2421) Multiple improper permission check issues were discovered in the Libraries component in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2014-0457, CVE-2014-0461) Multiple improper permission check issues were discovered in the AWT, JAX-WS, JAXB, Libraries, and Sound components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass certain Java sandbox restrictions. (CVE-2014-2412, CVE-2014-0451, CVE-2014-0458, CVE-2014-2423, CVE-2014-0452, CVE-2014-2414, CVE-2014-0446, CVE-2014-2427) Multiple flaws were identified in the Java Naming and Directory Interface (JNDI) DNS client. These flaws could make it easier for a remote attacker to perform DNS spoofing attacks. (CVE-2014-0460) It was discovered that the JAXP component did not properly prevent access to arbitrary files when a SecurityManager was present. This flaw could cause a Java application using JAXP to leak sensitive information, or affect application availability. (CVE-2014-2403) It was discovered that the Security component in OpenJDK could leak some timing information when performing PKCS#1 unpadding. This could possibly lead to the disclosure of some information that was meant to be protected by encryption. (CVE-2014-0453) It was discovered that the fix for CVE-2013-5797 did not properly resolve input sanitization flaws in javadoc. When javadoc documentation was generated from an untrusted Java source code and hosted on a domain not controlled by the code author, these issues could make it easier to perform cross-site scripting (XSS) attacks. (CVE-2014-2398) An insecure temporary file use flaw was found in the way the unpack200 utility created log files. A local attacker could possibly use this flaw to perform a symbolic link attack and overwrite arbitrary files with the privileges of the user running unpack200. (CVE-2014-1876) This update also fixes the following bug: * The OpenJDK update to IcedTea version 1.13 introduced a regression related to the handling of the jdk_version_info variable. This variable was not properly zeroed out before being passed to the Java Virtual Machine, resulting in a memory leak in the java.lang.ref.Finalizer class. This update fixes this issue, and memory leaks no longer occur. (BZ#1085373) All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libxml2 libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 libexif Integer underflow in the exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 might allow remote attackers to execute arbitrary code via vectors involving a crafted buffer-size parameter during the formatting of an EXIF tag, leading to a heap-based buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 mod_nss mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection attack that defeats certain protection mechanisms for this object. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same Origin Policy and read the properties of a Location object, or execute arbitrary JavaScript code, via a crafted web site. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 curl The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 php Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Use-after-free vulnerability in the nsContentUtils::RemoveScriptBlocker function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libxml2 Multiple integer overflows in libxml2, as used in Google Chrome before 20.0.1132.43 and other products, on 64-bit Linux platforms allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 pidgin Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libtiff Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libtiff Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libxml2 Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 krb5 schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 firefox The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use of JavaScript code for ordered list elements. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 gnutls The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 openssl The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 libtiff The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 gnupg2 The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 openswan Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 libxslt Double free vulnerability in libxslt, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XSL transforms. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 subversion The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 subscription-manager rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that injects this code and triggers an eval operation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 sudo sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 samba3x samba Samba 3.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS). Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by adding the (1) SECURITY DEFINER or (2) SET attributes to a procedural language's call handler. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 gimp Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an X Window System (XWD) image dump with more colors than color map entries. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code via vectors that trigger a character-set conversion failure. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 freetype The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to BDF fonts and an incorrect calculation that triggers an out-of-bounds read. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 nss Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. It was found that a subordinate Certificate Authority (CA) mis-issued an intermediate certificate, which could be used to conduct man-in-the-middle attacks. This update renders that particular intermediate certificate as untrusted. (BZ#1038894) Note: This fix only applies to applications using the NSS Builtin Object Token. It does not render the certificates untrusted for applications that use the NSS library, but do not use the NSS Builtin Object Token. All NSS users should upgrade to these updated packages, which correct this issue. After installing the update, applications using NSS must be restarted for the changes to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 systemtap SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service (kernel panic and crash) via vectors related to crafted DWARF data, which triggers a read of an invalid pointer. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 dbus-glib The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 httpd mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 php sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code via vectors that trigger a character-set conversion failure. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 xulrunner Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid (1) RSS or (2) Atom XML content. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.7.0-oracle Oracle Java SE version 7 includes the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. This update fixes several vulnerabilities in the Oracle Java Runtime Environment and the Oracle Java Software Development Kit. Further information about these flaws can be found on the Oracle Java SE Critical Patch Update Advisory page, listed in the References section. (CVE-2013-6629, CVE-2013-6954, CVE-2014-0429, CVE-2014-0432, CVE-2014-0446, CVE-2014-0448, CVE-2014-0449, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2397, CVE-2014-2398, CVE-2014-2401, CVE-2014-2402, CVE-2014-2403, CVE-2014-2409, CVE-2014-2412, CVE-2014-2413, CVE-2014-2414, CVE-2014-2420, CVE-2014-2421, CVE-2014-2422, CVE-2014-2423, CVE-2014-2427, CVE-2014-2428) All users of java-1.7.0-oracle are advised to upgrade to these updated packages, which provide Oracle Java 7 Update 55 and resolve these issues. All running instances of Oracle Java must be restarted for the update to take effect. Ajin Cherian DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 freetype FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via a crafted TrueType font. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 firefox The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 openswan Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2052 and CVE-2013-2054. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 xorg-x11-server The ProcRenderAddGlyphs function in the Render extension (render/render.c) in X.Org xserver 1.7.7 and earlier allows local users to read arbitrary memory and possibly cause a denial of service (server crash) via unspecified vectors related to an "input sanitization flaw." Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 Oracle Linux 4 libvorbis Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 rpm The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.7.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 nss nspr Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. It was found that a Certificate Authority (CA) issued fraudulent HTTPS certificates. This update renders any HTTPS certificates signed by that CA as untrusted. This covers all uses of the certificates, including SSL, S/MIME, and code signing. (BZ#734316) Note: This fix only applies to applications using the NSS Builtin Object Token. It does not render the certificates untrusted for applications that use the NSS library, but do not use the NSS Builtin Object Token. These updated packages upgrade NSS to version 3.12.10 on Red Hat Enterprise Linux 4 and 5. As well, they upgrade NSPR to version 4.8.8 on Red Hat Enterprise Linux 4 and 5, as required by the NSS update. The packages for Red Hat Enterprise Linux 6 include a backported patch. All NSS and NSPR users should upgrade to these updated packages, which correct this issue. After installing the update, applications using NSS and NSPR must be restarted for the changes to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 perl-DBD-Pg Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers in (1) a crafted database warning to the pg_warn function or (2) a crafted DBD statement to the dbd_st_prepare function. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libpng Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 cyrus-imapd Stack-based buffer overflow in the split_wildmats function in nntpd.c in nntpd in Cyrus IMAP Server before 2.3.17 and 2.4.x before 2.4.11 allows remote attackers to execute arbitrary code via a crafted NNTP command. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.6.0-openjdk Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and integrity, related to JSSE. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 icu Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libxml2 libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Adobe Flash Player before 10.3.181.26 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.23 and earlier on Android, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in June 2011. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2140, and CVE-2011-2417. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 openssl The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message, a different vulnerability than CVE-2006-7250. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libtiff Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.5.0-ibm Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, and 5.0 Update 29 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 curl Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 do not properly handle JavaScript files that contain many functions, which allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted file that is accessed by debugging APIs, as demonstrated by Firebug. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 perl The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libpng libpng10 Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 openssl openssl097a openssl098e The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 postgresql The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 expat Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 acroread Unspecified vulnerability in the PRC component in Adobe Reader and Acrobat 9.x before 9.4.7 on Windows, Adobe Reader and Acrobat 9.x through 9.4.6 on Mac OS X, Adobe Reader and Acrobat 10.x through 10.1.1 on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 jakarta-commons-httpclient Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering for drop events. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 bind query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 openssl Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin The NetStream class in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228 on Windows, Mac OS X, and Linux; Flash Player before 10.3.183.18 and 11.x before 11.2.202.223 on Solaris; Flash Player before 11.1.111.8 on Android 2.x and 3.x; and AIR before 3.2.0.2070 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site scripting issue," as exploited in the wild in September 2011. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid (1) RSS or (2) Atom XML content. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 acroread Integer overflow in Adobe Reader 9.x before 9.4.6 on Linux allows attackers to execute arbitrary code via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 acroread The EScript.api plugin in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.1, and 8.x before 8.2.6 on Windows and Mac OS X allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document that triggers memory corruption, involving the printSeps function. NOTE: some of these details are obtained from third party information. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. This erratum blacklists a small number of HTTPS certificates. (BZ#689430) This update also fixes the following bug: * The RHSA-2011:0312 and RHSA-2011:0311 updates introduced a regression, preventing some Java content and plug-ins written in Java from loading. With this update, the Java content and plug-ins work as expected. (BZ#683076) All Thunderbird users should upgrade to this updated package, which resolves these issues. All running instances of Thunderbird must be restarted for the update to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 piranha The Piranha Configuration Tool in Piranha 0.8.6 does not properly restrict access to webpages, which allows remote attackers to bypass authentication and read or modify the LVS configuration via an HTTP POST request. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 samba The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 libjpeg The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 bind ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to "insufficient security checks in IIOP streams," which allows attackers to escape the sandbox. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 dovecot lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, and CVE-2011-2459. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kdelibs kdelibs3 The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libXfont Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in a character name in a BDF font file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 apr-util Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 freetype FreeType in CoreGraphics in Apple iOS before 5.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font in a document. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-sun The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 ghostscript Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 acroread The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 on Mac OS X and Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 bind ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 apr The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 qspice Stack-based buffer overflow in the reds_handle_ticket function in server/reds.c in SPICE 0.12.0 allows remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-ibm Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, and 5.0 Update 29 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Adobe Flash Player before 10.3.183.16 and 11.x before 11.1.102.63 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.7 on Android 2.x and 3.x; and before 11.1.115.7 on Android 4.x does not properly handle integers, which allows attackers to obtain sensitive information via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.5.0-ibm The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.6.0-ibm Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Deployment. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 pixman Integer underflow in the pixman_trapezoid_valid macro in pixman.h in Pixman before 0.32.0, as used in X.Org server and cairo, allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 php The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 php53 php PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.7.0-openjdk Unspecified vulnerability in Oracle Java SE 7u40 and earlier and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality via vectors related to JAXP. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 nss Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. It was found that a subordinate Certificate Authority (CA) mis-issued an intermediate certificate, which could be used to conduct man-in-the-middle attacks. This update renders that particular intermediate certificate as untrusted. (BZ#1038894) Note: This fix only applies to applications using the NSS Builtin Object Token. It does not render the certificates untrusted for applications that use the NSS library, but do not use the NSS Builtin Object Token. All NSS users should upgrade to these updated packages, which correct this issue. After installing the update, applications using NSS must be restarted for the changes to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. It was found that a Certificate Authority (CA) issued a fraudulent HTTPS certificate. This update renders any HTTPS certificates signed by that CA as untrusted, except for a select few. The now untrusted certificates that were issued before July 1, 2011 can be manually re-enabled and used again at your own risk in Thunderbird; however, affected certificates issued after this date cannot be re-enabled or used. (BZ#734316) All Thunderbird users should upgrade to this updated package, which resolves this issue. All running instances of Thunderbird must be restarted for the update to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 apr Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.5.0-ibm Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Deployment. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 cvs Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 openswan Openswan 2.6.39 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 java-1.7.0-openjdk Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 dbus The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service (connection loss), obtain potentially sensitive information, or conduct unspecified state-modification attacks via crafted messages. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 xinetd xinetd does not enforce the user and group configuration directives for TCPMUX services, which causes these services to be run as root and makes it easier for remote attackers to gain privileges by leveraging another vulnerability in a service. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 freetype Buffer overflow in the ft_var_readpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TrueType GX font. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ByteBandedRaster size checks" in 2D. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 openoffice.org Integer overflow in filter/source/msfilter/msdffimp.cxx in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the length of an Escher graphics record in a PowerPoint (.ppt) document, which triggers a buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 rpm RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.5.0-ibm Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Unspecified vulnerability in Mozilla Firefox 3.6.x before 3.6.13 and Thunderbird 3.1.x before 3.1.7 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 php53 php crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 mesa Multiple integer overflows in X.org libGLX in Mesa 9.1.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XF86DRIOpenConnection and (2) XF86DRIGetClientDriverName functions. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 hypervkvpd The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The AMD IOMMU support in Xen 4.2.x, 4.1.x, 3.3, and other versions, when using AMD-Vi for PCI passthrough, uses the same interrupt remapping table for the host and all guests, which allows guests to cause a denial of service by injecting an interrupt into other guests. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class. Sushant Kumar Singh DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 acroread Stack-based buffer overflow in rt3d.dll in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors related to a crafted length value, a different vulnerability than CVE-2011-0563 and CVE-2011-0589. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 systemtap The staprun runtime tool in SystemTap 1.3 does not verify that a module to unload was previously loaded by SystemTap, which allows local users to cause a denial of service (unloading of arbitrary kernel modules). Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 postgresql84 postgresql WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed XSLT stylesheet that is embedded in a document. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting attacks via crafted header values. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 curl The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 openswan Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service (pluto IKE daemon crash) via vectors related to the (1) quick_outI1_continue and (2) quick_outI1 functions. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to bypassing the Java sandbox using "method handle intrinsic frames." Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 tomcat5 The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 openssl The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 net-snmp Array index error in the handle_nsExtendOutput2Table function in agent/mibgroup/agent/extend.c in Net-SNMP 5.7.1 allows remote authenticated users to cause a denial of service (out-of-bounds read and snmpd crash) via an SNMP GET request for an entry not in the extension table. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 gnutls The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 OpenIPMI ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 curl Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 samba3x samba Samba 3.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS). Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 thunderbird The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.7.0-openjdk Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45; Java SE Embedded 7u45; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the January 2014 CPU. Oracle has not commented on third-party claims that the issue is related to "insufficient security checks in IIOP streams," which allows attackers to escape the sandbox. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 krb5 schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 httpd The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 gnupg2 The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 dbus-glib The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 httpd mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 squirrelmail functions/imap_general.php in SquirrelMail, as used in Red Hat Enterprise Linux (RHEL) 4 and 5, does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preference files. NOTE: this issue exists because of an incorrect fix for CVE-2010-2813. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 devhelp firefox xulrunner yelp libproxy Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The (1) XENMEM_decrease_reservation, (2) XENMEM_populate_physmap, and (3) XENMEM_exchange hypercalls in Xen 4.2 and earlier allow local guest administrators to cause a denial of service (long loop and hang) via a crafted extent_order value. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.7.0-openjdk Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.6.0-ibm Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 firefox The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gnupg The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. The RHSA-2011:1243 Thunderbird update rendered HTTPS certificates signed by a certain Certificate Authority (CA) as untrusted, but made an exception for a select few. This update removes that exception, rendering every HTTPS certificate signed by that CA as untrusted. (BZ#735483) All Thunderbird users should upgrade to this updated package, which resolves this issue. All running instances of Thunderbird must be restarted for the update to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libxml2 libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.5.0-ibm Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the color profile parser that allows remote attackers to execute arbitrary code via a crafted Tag structure in a color profile. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 gnutls The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 nss nspr Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. It was found that a Certificate Authority (CA) mis-issued two intermediate certificates to customers. These certificates could be used to launch man-in-the-middle attacks. This update renders those certificates as untrusted. This covers all uses of the certificates, including SSL, S/MIME, and code signing. (BZ#890605) In addition, the nss package has been upgraded to upstream version 3.13.6, and the nspr package has been upgraded to upstream version 4.9.2. These updates provide a number of bug fixes and enhancements over the previous versions. (BZ#893371, BZ#893372) All NSS and NSPR users should upgrade to these updated packages, which correct these issues and add these enhancements. After installing the update, applications using NSS and NSPR must be restarted for the changes to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libgcrypt GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libxml2 Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 cyrus-imapd The index_get_ids function in index.c in imapd in Cyrus IMAP Server before 2.4.11, when server-side threading is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted References header in an e-mail message. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.6.0-openjdk The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via crafted documents. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xen The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 ecryptfs-utils ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 ruby Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 pidgin The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 perl The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 postgresql CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 gnome-vfs2 neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 php53 ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.5.0-ibm Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, and 5.0 Update 29 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xen The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection attack that defeats certain protection mechanisms for this object. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 qt4 Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 bind ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.6.0-ibm The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libXfont The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 bind97 ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 libvirt Integer overflow in libvirt before 0.9.3 allows remote authenticated users to cause a denial of service (libvirtd crash) and possibly execute arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers memory corruption. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openssl The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. It was found that a Certificate Authority (CA) issued a fraudulent HTTPS certificate. This update renders any HTTPS certificates signed by that CA as untrusted, except for a select few. The now untrusted certificates that were issued before July 1, 2011 can be manually re-enabled and used again at your own risk in Thunderbird; however, affected certificates issued after this date cannot be re-enabled or used. (BZ#734316) All Thunderbird users should upgrade to this updated package, which resolves this issue. All running instances of Thunderbird must be restarted for the update to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 gimp Heap-based buffer overflow in the read_xwd_cols function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an X Window System (XWD) image dump with more colors than color map entries. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 bind query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 firefox The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use of JavaScript code for ordered list elements. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 quagga Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure length is smaller than the value in the Length header field. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site scripting issue," as exploited in the wild in September 2011. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 php sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel A certain Red Hat patch to the be2net implementation in the kernel package before 2.6.32-218.el6 on Red Hat Enterprise Linux (RHEL) 6, when promiscuous mode is enabled, allows remote attackers to cause a denial of service (system crash) via non-member VLAN packets. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 hplip3 The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 elinks The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 dhcp The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Use-after-free vulnerability in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote attackers to execute arbitrary code via vectors involving an empty argument to the array.join function in conjunction with the triggering of garbage collection. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 openssl Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 ecryptfs-utils ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.7.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect ByteBandedRaster size checks" in 2D. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 tcl Algorithmic complexity vulnerability in the regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows remote authenticated users to cause a denial of service (memory consumption) via a crafted "complex" regular expression with doubly-nested states. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 php ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. It was found that a Certificate Authority (CA) issued a fraudulent HTTPS certificate. This update renders any HTTPS certificates signed by that CA as untrusted, except for a select few. The now untrusted certificates that were issued before July 1, 2011 can be manually re-enabled and used again at your own risk in Firefox; however, affected certificates issued after this date cannot be re-enabled or used. (BZ#734316) All Firefox users should upgrade to these updated packages, which contain a backported patch. After installing the update, Firefox must be restarted for the changes to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libXfont The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 freetype FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font, a different vulnerability than CVE-2011-0226. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 thunderbird Mozilla Firefox before 3.6.20, Thunderbird 2.x and 3.x before 3.1.12, SeaMonkey 1.x and 2.x, and possibly other products does not properly handle the RegExp.input property, which allows remote attackers to bypass the Same Origin Policy and read data from a different domain via a crafted web site, possibly related to a use-after-free. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 initscripts The default IPSec ifup script in Red Hat Enterprise Linux 3 through 5 configures racoon to use aggressive IKE mode instead of main IKE mode, which makes it easier for remote attackers to conduct brute force attacks by sniffing an unencrypted preshared key (PSK) hash. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 pidgin upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 krb5 ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 bind ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 subscription-manager rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 flash-plugin Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2140, and CVE-2011-2417. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 bind ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 libexif Integer underflow in the exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 might allow remote attackers to execute arbitrary code via vectors involving a crafted buffer-size parameter during the formatting of an EXIF tag, leading to a heap-based buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 nspr nss The ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services (NSS) before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10, allows remote attackers to cause a denial of service (application crash) via a zero-length item, as demonstrated by (1) a zero-length basic constraint or (2) a zero-length field in an OCSP response. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 systemtap The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 libuser libuser before 0.57 uses a cleartext password value of (1) !! or (2) x for new LDAP user accounts, which makes it easier for remote attackers to obtain access by specifying one of these values. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 autofs Unspecified vulnerability in autofs, as used in Red Hat Enterprise Linux (RHEL) 5, allows local users to cause a denial of service (autofs crash and delayed mounts) or prevent "mount expiration" via unspecified vectors related to "using an LDAP-based automount map." Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 boost Integer overflow in the ordered_malloc function in boost/pool/pool.hpp in Boost Pool before 3.9 makes it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large memory chunk size value, which causes less memory to be allocated than expected. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 rsync Unspecified vulnerability in rsync before 3.0.0pre6, when running a writable rsync daemon, allows remote attackers to bypass exclude, exclude_from, and filter and read or write hidden files via (1) symlink, (2) partial-dir, (3) backup-dir, and unspecified (4) dest options. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libpng The png_set_text_2 function in pngset.c in libpng 1.0.x before 1.0.59, 1.2.x before 1.2.49, 1.4.x before 1.4.11, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted text chunk in a PNG image file, which triggers a memory allocation failure that is not properly handled, leading to a heap-based buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-sun Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, and 5.0 Update 29 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed XSLT stylesheet that is embedded in a document. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 mod_nss mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 expat Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code via vectors that trigger a character-set conversion failure. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.6.0-sun Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, and JavaFX 2.0 allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 tomcat5 Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 nss nspr Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. It was found that a Certificate Authority (CA) issued fraudulent HTTPS certificates. This update renders any HTTPS certificates signed by that CA as untrusted. This covers all uses of the certificates, including SSL, S/MIME, and code signing. (BZ#734316) Note: This fix only applies to applications using the NSS Builtin Object Token. It does not render the certificates untrusted for applications that use the NSS library, but do not use the NSS Builtin Object Token. These updated packages upgrade NSS to version 3.12.10 on Red Hat Enterprise Linux 4 and 5. As well, they upgrade NSPR to version 4.8.8 on Red Hat Enterprise Linux 4 and 5, as required by the NSS update. The packages for Red Hat Enterprise Linux 6 include a backported patch. All NSS and NSPR users should upgrade to these updated packages, which correct this issue. After installing the update, applications using NSS and NSPR must be restarted for the changes to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ImageMagick Untrusted search path vulnerability in configure.c in ImageMagick before 6.6.5-5, when MAGICKCORE_INSTALLED_SUPPORT is defined, allows local users to gain privileges via a Trojan horse configuration file in the current working directory. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mysql Stack-based buffer overflow in the acl_get function in Oracle MySQL 5.5.19 and other versions through 5.5.28, and 5.1.53 and other versions through 5.1.66, and MariaDB 5.5.2.x before 5.5.28a, 5.3.x before 5.3.11, 5.2.x before 5.2.13 and 5.1.x before 5.1.66, allows remote authenticated users to execute arbitrary code via a long argument to the GRANT FILE command. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 jakarta-commons-httpclient Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sysstat The init script (sysstat.in) in sysstat 5.1.2 up to 7.1.6 creates /tmp/sysstat.run insecurely, which allows local users to execute arbitrary code. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 bind97 query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.6.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 httpd mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 samba The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 rpm RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 flash-plugin Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 cups CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.4.2-ibm The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different vulnerability than CVE-2011-0311. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 kdelibs kdelibs3 The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 php The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 postgresql84 crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 system-config-printer pysmb.py in system-config-printer 0.6.x and 0.7.x, as used in foomatic-gui and possibly other products, allows remote SMB servers to execute arbitrary commands via shell metacharacters in the (1) NetBIOS or (2) workgroup name, which are not properly handled when searching for network printers. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 gnupg GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 openssl openssl097a openssl098e The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 freetype FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via a crafted TrueType font. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by adding the (1) SECURITY DEFINER or (2) SET attributes to a procedural language's call handler. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 wireshark The CIP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.6.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mysql Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect availability via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 libvirt libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access unintended USB devices. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel Off-by-one error in the __addr_ok macro in Xen 3.3 and earlier allows local 64 bit PV guest administrators to cause a denial of service (host crash) via unspecified hypercalls that ignore virtual-address bits. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 icu Stack-based buffer overflow in the _canonicalize function in common/uloc.c in International Components for Unicode (ICU) before 49.1 allows remote attackers to execute arbitrary code via a crafted locale ID that is not properly handled during variant canonicalization. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 openoffice.org Multiple heap-based buffer overflows in the XML manifest encryption tag parsing functionality in OpenOffice.org and LibreOffice before 3.5.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Open Document Text (.odt) file with (1) a child tag within an incorrect parent tag, (2) duplicate tags, or (3) a Base64 ChecksumAttribute whose length is not evenly divisible by four. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libxml2 Multiple integer overflows in libxml2, as used in Google Chrome before 20.0.1132.43 and other products, on 64-bit Linux platforms allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 pango Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 postfix The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 httpd The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection attack that defeats certain protection mechanisms for this object. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ibutils ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 nss Network Security Services (NSS) is a set of libraries designed to support the development of security-enabled client and server applications. It was found that the Malaysia-based Digicert Sdn. Bhd. subordinate Certificate Authority (CA) issued HTTPS certificates with weak keys. This update renders any HTTPS certificates signed by that CA as untrusted. This covers all uses of the certificates, including SSL, S/MIME, and code signing. Note: Digicert Sdn. Bhd. is not the same company as found at digicert.com. (BZ#751366) Note: This fix only applies to applications using the NSS Builtin Object Token. It does not render the certificates untrusted for applications that use the NSS library, but do not use the NSS Builtin Object Token. This update also fixes the following bug on Oracle Linux 5.x: * When using mod_nss with the Apache HTTP Server, a bug in NSS on Red Hat Enterprise Linux 5 resulted in file descriptors leaking each time the Apache HTTP Server was restarted with the "service httpd reload" command. This could have prevented the Apache HTTP Server from functioning properly if all available file descriptors were consumed. (BZ#743508) For Red Hat Enterprise Linux 6, these updated packages upgrade NSS to version 3.12.10. As well, they upgrade NSPR (Netscape Portable Runtime) to version 4.8.8 and nss-util to version 3.12.10 on Red Hat Enterprise Linux 6, as required by the NSS update. (BZ#735972, BZ#736272, BZ#735973) All NSS users should upgrade to these updated packages, which correct this issue. After installing the update, applications using NSS must be restarted for the changes to take effect. In addition, on Red Hat Enterprise Linux 6, applications using NSPR and nss-util must also be restarted. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 thunderbird CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \n (newline) character, which is not properly handled in a JavaScript "document.cookie =" expression, a different vulnerability than CVE-2011-2374. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, and CVE-2011-2459. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sudo check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 gimp Multiple integer overflows in the load_image function in file-pcx.c in the Personal Computer Exchange (PCX) plugin in GIMP 2.6.x and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PCX image that triggers a heap-based buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 dbus Stack consumption vulnerability in D-Bus (aka DBus) before 1.4.1 allows local users to cause a denial of service (daemon crash) via a message containing many nested variants. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 quota The good_client function in rquotad (rquota_svc.c) in Linux DiskQuota (aka quota) before 3.17 invokes the hosts_ctl function the first time without a host name, which might allow remote attackers to bypass TCP Wrappers rules in hosts.deny. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 freeradius2 Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 openswan Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service (pluto IKE daemon crash) via vectors related to the (1) quick_outI1_continue and (2) quick_outI1 functions. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 cvs Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.5.0-ibm Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the color profile parser that allows remote attackers to execute arbitrary code via a crafted Tag structure in a color profile. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.6.0-openjdk Unspecified vulnerability in Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, and Java SE Embedded 7u40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 3.6.20, SeaMonkey 2.x, Thunderbird 3.x before 3.1.12, and possibly other products does not properly handle the dropping of a tab element, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by establishing a content area and registering for drop events. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 mailman Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Unspecified vulnerability in Mozilla Firefox 3.6.x before 3.6.13 and Thunderbird 3.1.x before 3.1.7 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 flash-plugin The NetStream class in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228 on Windows, Mac OS X, and Linux; Flash Player before 10.3.183.18 and 11.x before 11.2.202.223 on Solaris; Flash Player before 11.1.111.8 on Android 2.x and 3.x; and AIR before 3.2.0.2070 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 postgresql84 postgresql CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 firefox xulrunner The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that injects this code and triggers an eval operation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 sudo A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux (RHEL) 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. It was found that a Certificate Authority (CA) issued a fraudulent HTTPS certificate. This update renders any HTTPS certificates signed by that CA as untrusted, except for a select few. The now untrusted certificates that were issued before July 1, 2011 can be manually re-enabled and used again at your own risk in Firefox; however, affected certificates issued after this date cannot be re-enabled or used. (BZ#734316) All Firefox users should upgrade to these updated packages, which contain a backported patch. After installing the update, Firefox must be restarted for the changes to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 apr The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.4.2-ibm Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and panic) via IGMP packets. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.7.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 axis Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 samba The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 krb5 Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 vino The vino_server_client_data_pending function in vino-server.c in GNOME Vino 2.26.1, 2.32.1, 3.7.3, and earlier, and 3.8 when encryption is disabled, does not properly clear client data when an error causes the connection to close during authentication, which allows remote attackers to cause a denial of service (infinite loop, CPU and disk consumption) via multiple crafted requests during authentication. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid (1) RSS or (2) Atom XML content. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 xulrunner Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bind97 ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 nfs-utils The nfs_addmntent function in support/nfs/nfs_mntent.c in the mount.nsf tool in nfs-utils before 1.2.4 attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to corrupt this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel Race condition in the __exit_signal function in kernel/exit.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors related to multithreaded exec, the use of a thread group leader in kernel/posix-cpu-timers.c, and the selection of a new thread group leader in the de_thread function in fs/exec.c. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 perl Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird The web console in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that injects this code and triggers an eval operation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 python The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Integer overflow in Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows remote attackers to execute arbitrary code via ActionScript that improperly handles a long array object. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 thunderbird Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted text with Shift JIS encoding. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 php53 The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 acroread Integer overflow in Adobe Reader 9.x before 9.4.6 on Linux allows attackers to execute arbitrary code via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 ghostscript Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow. NOTE: this issue is also described as an array index error. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 krb5 The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9, when an LDAP backend is used, allows remote attackers to cause a denial of service (NULL pointer dereference or buffer over-read, and daemon crash) via a crafted principal name. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 freeradius2 modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 libxml2 Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code via vectors that trigger a character-set conversion failure. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 xinetd builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mysql The Gis_line_string::init_from_wkb function in sql/spatial.cc in MySQL 5.1 before 5.1.51 allows remote authenticated users to cause a denial of service (server crash) by calling the PolyFromWKB function with Well-Known Binary (WKB) data containing a crafted number of (1) line strings or (2) line points. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 cyrus-imapd Stack-based buffer overflow in the split_wildmats function in nntpd.c in nntpd in Cyrus IMAP Server before 2.3.17 and 2.4.x before 2.4.11 allows remote attackers to execute arbitrary code via a crafted NNTP command. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 flash-plugin Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 php53 php PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 apr Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 php53 php The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and "updating a negative key into a fully instantiated key." Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 rgmanager The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-ibm Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 postgresql The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 freetype FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font, a different vulnerability than CVE-2011-0226. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers, which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl call in conjunction with a modified Local Descriptor Table (LDT). Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 samba3x Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FD_SET macro, which allows remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening a large number of files, related to (1) Winbind or (2) smbd. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 conga Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 php53 The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.5.0-ibm Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 thunderbird Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 samba3x samba The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 pidgin Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 libpng libpng10 Memory leak in pngrutil.c in libpng before 1.2.44, and 1.4.x before 1.4.3, allows remote attackers to cause a denial of service (memory consumption and application crash) via a PNG image containing malformed Physical Scale (aka sCAL) chunks. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 bind ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 freetype Buffer overflow in the ft_var_readpackedpoints function in truetype/ttgxvar.c in FreeType 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TrueType GX font. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm Linux kernel 2.6.33 and 2.6.34.y does not initialize the kvm_vcpu_events->interrupt.pad structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 nspr nss Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate, a related issue to CVE-2013-1741. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 gcc Absolute path traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a full pathname for a file within a .jar archive, a related issue to CVE-2010-0831. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 squirrelmail Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mysql MySQL 5.0.88, and possibly other versions and platforms, allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames without symlinks, and that can point to tables created at a future time at which a pathname is modified to contain a symlink to a subdirectory of the MySQL data home directory, related to incorrect calculation of the mysql_unpacked_real_data_home value. NOTE: this vulnerability exists because of a CVE-2009-4030 regression, which was not omitted in other packages and versions such as MySQL 5.0.95 in Red Hat Enterprise Linux 6. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 util-linux mount in util-linux 2.19 and earlier does not remove the /etc/mtab~ lock file after a failed attempt to add a mount entry, which has unspecified impact and local attack vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 sudo sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 bind97 ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 tetex Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a special command in a DVI file, related to the (1) predospecial and (2) bbdospecial functions, a different vulnerability than CVE-2010-0739. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 rpm The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 tomcat5 The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, (c) catalina.out, or (d) tomcat7-initd.log. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 samba3x samba The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-ibm Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business JDK and JRE 6 Update 18 and 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Heap-based buffer overflow in the Convolve3x3 function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ruby lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 thunderbird A certain application-launch script in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 on Linux places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 ruby The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openoffice.org Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.6.0-ibm Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, and JavaFX 2.0 allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 ghostscript ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 pam The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 firefox nss xulrunner The LookupGetterOrSetter function in js3250.dll in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 does not properly support window.__lookupGetter__ function calls that lack arguments, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via vectors involving a "dangling pointer" and the JS_ValueToId function. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 rhn-client-tools yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 wireshark epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted .pcap file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 ruby The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 freetype The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to BDF fonts and an incorrect calculation that triggers an out-of-bounds read. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel Integer overflow in the ext4_ext_get_blocks function in fs/ext4/extents.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service (BUG and system crash) via a write operation on the last block of a large file, followed by a sync operation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 bind ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service (daemon crash) via a DNS query. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 samba3x The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 do not properly implement the JavaScript sandbox utility, which allows remote attackers to execute arbitrary JavaScript code with improper privileges via a javascript: URL. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.5.0-ibm Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow in a decoding routine used by the JPEGImageDecoderImpl interface, which allows code execution via a crafted JPEG image. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 acroread The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 on Mac OS X and Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bzip2 Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libpng Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 thunderbird The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 openswan Buffer overflow in the atodn function in Openswan before 2.6.39, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records. NOTE: this might be the same vulnerability as CVE-2013-2052 and CVE-2013-2054. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php53 Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 avahi avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.181.22 on Windows, Mac OS X, Linux, and Solaris, and 10.3.185.22 and earlier on Android, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to a "universal cross-site scripting vulnerability." Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mysql Buffer overflow in MySQL 5.0 through 5.0.91 and 5.1 before 5.1.47 allows remote authenticated users to execute arbitrary code via a COM_FIELD_LIST command with a long table name. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 xulrunner Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 pidgin The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 subversion The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 postgresql84 Buffer overflow in the gettoken function in contrib/intarray/_int_bool.c in the intarray array module in PostgreSQL 9.0.x before 9.0.3, 8.4.x before 8.4.7, 8.3.x before 8.3.14, and 8.2.x before 8.2.20 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via integers with a large number of digits to unspecified functions. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 devhelp firefox xulrunner yelp libproxy Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kexec-tools The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, includes all of root's SSH private keys within a vmcore file, which allows context-dependent attackers to obtain sensitive information by inspecting the file content. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 systemtap SystemTap 1.4 and earlier, when unprivileged (aka stapusr) mode is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) via a crafted ELF program with DWARF expressions that are not properly handled by a stap script that performs context variable access. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 flash-plugin Adobe Flash Player 10.1.82.76 and earlier on Windows, Mac OS X, Linux, and Solaris and 10.1.92.10 on Android; authplay.dll in Adobe Reader and Acrobat 9.x before 9.4; and authplay.dll in Adobe Reader and Acrobat 8.x before 8.2.5 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in September 2010. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.6.0-sun Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, and JavaFX 2.0 allows remote attackers to affect confidentiality via unknown vectors related to Deployment. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 tetex Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sssd The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service (infinite loop, crash, and login prevention) via a crafted packet. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm The KVM implementation in the Linux kernel before 3.3.4 does not properly manage the relationships between memory slots and the iommu, which allows guest OS users to cause a denial of service (memory leak and host OS crash) by leveraging administrative access to the guest OS to conduct hotunplug and hotplug operations on devices. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 mikmod Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in Winamp before 5.57, and libmikmod 3.1.12, might allow remote attackers to execute arbitrary code via an Ultratracker file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 xorg-x11-server Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 ghostscript ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.4.2-ibm Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Deployment. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 postgresql84 PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 xorg-x11-server The ProcRenderAddGlyphs function in the Render extension (render/render.c) in X.Org xserver 1.7.7 and earlier allows local users to read arbitrary memory and possibly cause a denial of service (server crash) via unspecified vectors related to an "input sanitization flaw." Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 libtiff Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted THUNDER_2BITDELTAS data in a .tiff file that has an unexpected BitsPerSample value. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 thunderbird Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same Origin Policy and read the properties of a Location object, or execute arbitrary JavaScript code, via a crafted web site. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gimp Integer overflow in the ReadImage function in plug-ins/common/file-gif-load.c in the GIF image format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted height and len properties in a GIF image file, which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 xmlsec1 xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm 0.12, and possibly other versions, allows guest OS users to cause a denial of service (QEMU crash) and possibly execute arbitrary code via crafted legacy mode packets. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 php The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 libwpd The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used. NOTE: some sources report this issue as an integer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 xulrunner Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same Origin Policy and read the properties of a Location object, or execute arbitrary JavaScript code, via a crafted web site. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 firefox Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. The RHSA-2011:1242 Firefox update rendered HTTPS certificates signed by a certain Certificate Authority (CA) as untrusted, but made an exception for a select few. This update removes that exception, rendering every HTTPS certificate signed by that CA as untrusted. (BZ#735483) All Firefox users should upgrade to these updated packages, which contain Firefox version 3.6.22. After installing the update, Firefox must be restarted for the changes to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.5.0-sun Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow in a decoding routine used by the JPEGImageDecoderImpl interface, which allows code execution via a crafted JPEG image. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The napi_reuse_skb function in net/core/dev.c in the Generic Receive Offload (GRO) implementation in the Linux kernel before 2.6.38 does not reset the values of certain structure members, which might allow remote attackers to cause a denial of service (NULL pointer dereference) via a malformed VLAN frame. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Use-after-free vulnerability in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote attackers to execute arbitrary code via vectors involving an empty argument to the array.join function in conjunction with the triggering of garbage collection. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 dhcp The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel Race condition in the sctp_rcv function in net/sctp/input.c in the Linux kernel before 2.6.29 allows remote attackers to cause a denial of service (system hang) via SCTP packets. NOTE: in some environments, this issue exists because of an incomplete fix for CVE-2011-2482. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openssl097a The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 gdm initscripts GNOME Display Manager (gdm) before 2.21.1 allows local users to change permissions of arbitrary directories via a symlink attack on /tmp/.X11-unix/. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openldap chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libxml2 libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 php53 strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation, which is not properly handled in x87 FPU registers, as demonstrated using 2.2250738585072011e-308. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 nss_db The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 libuser libuser before 0.57 uses a cleartext password value of (1) !! or (2) x for new LDAP user accounts, which makes it easier for remote attackers to obtain access by specifying one of these values. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kvm The subpage MMIO initialization functionality in the subpage_register function in exec.c in QEMU-KVM, as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and KVM 83, does not properly select the index for access to the callback array, which allows guest OS users to cause a denial of service (guest OS crash) or possibly gain privileges via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sudo The command matching functionality in sudo 1.6.8 through 1.7.2p5 does not properly handle when a file in the current working directory has the same name as a pseudo-command in the sudoers file and the PATH contains an entry for ".", which allows local users to execute arbitrary commands via a Trojan horse executable, as demonstrated using sudoedit, a different vulnerability than CVE-2010-0426. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 gnutls gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 cups The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not properly restrict writing of segment selectors to segment registers, which might allow guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, and replacing an instruction in between emulator entry and instruction fetch. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 tomcat5 Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer." Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.4.2-ibm Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, and 1.4.2_33 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and integrity, related to JSSE. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 bind97 ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 xen Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 systemtap Multiple integer signedness errors in the (1) __get_argv and (2) __get_compat_argv functions in tapset/aux_syscalls.stp in SystemTap 1.1 allow local users to cause a denial of service (script crash, or system crash or hang) via a process with a large number of arguments, leading to a buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 freetype FreeType in CoreGraphics in Apple iOS before 5.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font in a document. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gfs-kmod The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances involving an IPv6 TUN network interface and a large number of neighbors, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openoffice.org Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file in an ODF or Microsoft Office document. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The XENMEM_exchange handler in Xen 4.2 and earlier does not properly check the memory address, which allows local PV guest OS administrators to cause a denial of service (crash) or possibly gain privileges via unspecified vectors that overwrite memory in the hypervisor reserved range. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 python Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.4.2-ibm Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sendmail sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 wireshark Buffer overflow in the sect_enttec_dmx_da function in epan/dissectors/packet-enttec.c in Wireshark 1.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ENTTEC DMX packet with Run Length Encoding (RLE) compression. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 samba ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 exim Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a "cache stuffing" issue and MS-DFS referrals. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 samba Stack-based buffer overflow in the (1) sid_parse and (2) dom_sid_parse functions in Samba before 3.5.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Windows Security ID (SID) on a file share. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sudo sudo 1.6.x before 1.6.9p21, when the runas_default option is used, does not properly set group memberships, which allows local users to gain privileges via a sudo command. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 pam_krb5 pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openssl The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 java-1.5.0-ibm Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality via unknown vectors related to Deployment. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc Integer overflow in posix/fnmatch.c in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long UTF8 string that is used in an fnmatch call with a crafted pattern argument, a different vulnerability than CVE-2011-1071. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Firefox before 16.0.2, Firefox ESR 10.x before 10.0.10, Thunderbird before 16.0.2, Thunderbird ESR 10.x before 10.0.10, and SeaMonkey before 2.13.2 allow remote attackers to bypass the Same Origin Policy and read the Location object via a prototype property-injection attack that defeats certain protection mechanisms for this object. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xorg-x11-server The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 perl-Archive-Tar Directory traversal vulnerability in the Archive::Tar Perl module 1.36 and earlier allows user-assisted remote attackers to overwrite arbitrary files via a TAR archive that contains a file whose name is an absolute path or has ".." sequences. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openldap libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. The RHSA-2011:1243 Thunderbird update rendered HTTPS certificates signed by a certain Certificate Authority (CA) as untrusted, but made an exception for a select few. This update removes that exception, rendering every HTTPS certificate signed by that CA as untrusted. (BZ#735483) All Thunderbird users should upgrade to this updated package, which resolves this issue. All running instances of Thunderbird must be restarted for the update to take effect. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 bash bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) aliasconv.sh, (2) aliasconv.bash, and (3) cshtobash scripts. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 postgresql The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 java-1.7.0-openjdk Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 httpd Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 thunderbird dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not properly suppress a script's URL in certain circumstances involving a redirect and an error message, which allows remote attackers to obtain sensitive information about script parameters via a crafted HTML document, related to the window.onerror handler. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 xorg-x11-server Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 scsi-target-utils Multiple buffer overflows in the iSNS implementation in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) before 1.0.6, (2) iSCSI Enterprise Target (aka iscsitarget or IET) 1.4.20.1 and earlier, and (3) Generic SCSI Target Subsystem for Linux (aka SCST or iscsi-scst) 1.0.1.1 and earlier allow remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via (a) a long iSCSI Name string in an SCN message or (b) an invalid PDU. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 apr-util Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gcc gcc4 ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 krb5 The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 ntp ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 nss Network Security Services (NSS) is a set of libraries designed to support the development of security-enabled client and server applications. It was found that the Malaysia-based Digicert Sdn. Bhd. subordinate Certificate Authority (CA) issued HTTPS certificates with weak keys. This update renders any HTTPS certificates signed by that CA as untrusted. This covers all uses of the certificates, including SSL, S/MIME, and code signing. Note: Digicert Sdn. Bhd. is not the same company as found at digicert.com. (BZ#751366) Note: This fix only applies to applications using the NSS Builtin Object Token. It does not render the certificates untrusted for applications that use the NSS library, but do not use the NSS Builtin Object Token. This update also fixes the following bug on Oracle Linux 5.x: * When using mod_nss with the Apache HTTP Server, a bug in NSS on Red Hat Enterprise Linux 5 resulted in file descriptors leaking each time the Apache HTTP Server was restarted with the "service httpd reload" command. This could have prevented the Apache HTTP Server from functioning properly if all available file descriptors were consumed. (BZ#743508) For Red Hat Enterprise Linux 6, these updated packages upgrade NSS to version 3.12.10. As well, they upgrade NSPR (Netscape Portable Runtime) to version 4.8.8 and nss-util to version 3.12.10 on Red Hat Enterprise Linux 6, as required by the NSS update. (BZ#735972, BZ#736272, BZ#735973) All NSS users should upgrade to these updated packages, which correct this issue. After installing the update, applications using NSS must be restarted for the changes to take effect. In addition, on Red Hat Enterprise Linux 6, applications using NSPR and nss-util must also be restarted. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 thunderbird Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.19 and 3.6.x before 3.6.17, Thunderbird before 3.1.10, and SeaMonkey before 2.0.14 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 subversion Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 flash-plugin Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 conga Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 xerces-j2 XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 php The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 bind97 libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 firefox xulrunner dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not properly suppress a script's URL in certain circumstances involving a redirect and an error message, which allows remote attackers to obtain sensitive information about script parameters via a crafted HTML document, related to the window.onerror handler. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 dovecot lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 curl content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid (1) RSS or (2) Atom XML content. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 3 Oracle Linux 4 Oracle Linux 5 wireshark The SigComp Universal Decompressor Virtual Machine (UDVM) in Wireshark 0.10.8 through 1.0.14 and 1.2.0 through 1.2.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to sigcomp-udvm.c and an off-by-one error, which triggers a buffer overflow, different vulnerabilities than CVE-2010-2287. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 freetype Integer overflow in base/ftstream.c in libXft (aka the X FreeType library) in FreeType before 2.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Compact Font Format (CFF) font file that triggers a heap-based buffer overflow, related to an "input stream position error" issue, a different vulnerability than CVE-2010-1797. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 samba3x Stack-based buffer overflow in the (1) sid_parse and (2) dom_sid_parse functions in Samba before 3.5.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Windows Security ID (SID) on a file share. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 flash-plugin Adobe Flash Player before 10.0.45.2 and Adobe AIR before 1.5.3.9130 allow remote attackers to cause a denial of service (application crash) via a modified SWF file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 acpid A certain Red Hat patch for acpid 1.0.4 effectively triggers a call to the open function with insufficient arguments, which might allow local users to leverage weak permissions on /var/log/acpid, and obtain sensitive information by reading this file, cause a denial of service by overwriting this file, or gain privileges by executing this file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 glibc elf/dl-load.c in ld.so in the GNU C Library (aka glibc or libc6) through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LD_AUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object (DSO) located in an arbitrary directory. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.7.0-openjdk The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 libtool ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 perl-DBD-Pg Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers in (1) a crafted database warning to the pg_warn function or (2) a crafted DBD statement to the dbd_st_prepare function. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 pidgin Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 krb5 Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 xulrunner Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same Origin Policy and read the properties of a Location object, or execute arbitrary JavaScript code, via a crafted web site. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 gzip Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression, leading to an array index error. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 PyXML The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 scsi-target-utils Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 gnutls The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using jumbo frames for a large amount of network traffic, as demonstrated by a flood ping. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 httpd protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 flash-plugin Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by calling the ActionScript native object 2200 connect method multiple times with different arguments, a different vulnerability than CVE-2010-2160, CVE-2010-2165, CVE-2010-2166, CVE-2010-2171, CVE-2010-2175, CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2180, CVE-2010-2182, CVE-2010-2184, and CVE-2010-2187. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 xen Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space." Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 sudo The secure path feature in env.c in sudo 1.3.1 through 1.6.9p22 and 1.7.0 through 1.7.2p6 does not properly handle an environment that contains multiple PATH variables, which might allow local users to gain privileges via a crafted value of the last PATH variable. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.6.0-openjdk Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 nspr nss The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 gnupg2 Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 acroread Buffer overflow in Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a PDF file containing Flash content with a crafted #1023 (3FFh) tag, a different vulnerability than CVE-2010-1295, CVE-2010-2202, CVE-2010-2207, CVE-2010-2209, CVE-2010-2210, and CVE-2010-2211. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 acroread Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-2890, CVE-2010-3619, CVE-2010-3621, CVE-2010-3622, CVE-2010-3628, and CVE-2010-3632. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openssl Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 firefox nspr xulrunner Multiple unspecified vulnerabilities in WebKit in Apple Safari before 4.0.4 on Windows allow remote FTP servers to execute arbitrary code, cause a denial of service (application crash), or obtain sensitive information via a crafted directory listing in a reply. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 pidgin gtkimhtml.c in Pidgin before 2.6.6 allows remote attackers to cause a denial of service (CPU consumption and application hang) by sending many smileys in a (1) IM or (2) chat. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libpng libpng10 Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 cyrus-imapd Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 libxslt Double free vulnerability in libxslt, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XSL transforms. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 xmlsec1 The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in products including (1) the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; (2) the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; (3) Mono before 2.4.2.2; (4) XML Security Library before 1.2.12; (5) IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; (6) Sun JDK and JRE Update 14 and earlier; (7) Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.6.0-openjdk The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, allows remote attackers to determine the existence of local files via vectors related to handling of zoneinfo (aka tz) files, aka Bug Id 6824265. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 tomcat5 The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel memory via vectors involving a dump operation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2942. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 pidgin The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.6.0-ibm Unspecified vulnerability in JNLPAppletlauncher in Sun Java SE, and SE for Business, in JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier; and Java SE for Business in SDK and JRE 1.4.2_21 and earlier; allows remote attackers to create or modify arbitrary files via vectors involving an untrusted Java applet that accesses an old version of JNLPAppletLauncher. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, which makes it easier for remote attackers to conduct HTTP response splitting attacks via crafted header values. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.4.2-ibm Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to cause a denial of service (memory consumption) via crafted HTTP headers, which are not properly parsed by the ASN.1 DER input stream parser, aka Bug Id 6864911. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Use-after-free vulnerability in the nsContentUtils::RemoveScriptBlocker function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 glibc Multiple integer overflows in the (1) strtod, (2) strtof, (3) strtold, (4) strtod_l, and other unspecified "related functions" in stdlib in GNU C Library (aka glibc or libc6) 2.16 allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 rgmanager Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel before 2.6.19 allows local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 subversion The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 netpbm The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 pidgin libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 xen Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.6.0-openjdk Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 qspice-client Race condition in the SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows local users to obtain sensitive information, and conduct man-in-the-middle attacks, by providing a UNIX socket for communication between this plug-in and the client (aka qspice-client) in qspice 0.3.0, and then accessing this socket. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 poppler Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 cups Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kernel Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes the socket to be freed and triggers list corruption, related to the sctp_wait_for_connect function. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 NetworkManager nm-connection-editor in NetworkManager (NM) 0.7.x exports connection objects over D-Bus upon actions in the connection editor GUI, which allows local users to obtain sensitive information by reading D-Bus signals, as demonstrated by using dbus-monitor to discover the password for the WiFi network. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 acroread Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 on Unix, when Debug mode is enabled, allow attackers to execute arbitrary code via unspecified vectors, related to a "format bug." Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.6.0-sun Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 java-1.6.0-sun Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is a heap-based buffer overflow in a decoding routine used by the JPEGImageDecoderImpl interface, which allows code execution via a crafted JPEG image. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 openssh Error handling in the SSH protocol in (1) SSH Tectia Client and Server and Connector 4.0 through 4.4.11, 5.0 through 5.2.4, and 5.3 through 5.3.8; Client and Server and ConnectSecure 6.0 through 6.0.4; Server for Linux on IBM System z 6.0.4; Server for IBM z/OS 5.5.1 and earlier, 6.0.0, and 6.0.1; and Client 4.0-J through 4.3.3-J and 4.0-K through 4.3.10-K; and (2) OpenSSH 4.7p1 and possibly other versions, when using a block cipher algorithm in Cipher Block Chaining (CBC) mode, makes it easier for remote attackers to recover certain plaintext data from an arbitrary block of ciphertext in an SSH session via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 libtiff Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted THUNDER_2BITDELTAS data in a .tiff file that has an unexpected BitsPerSample value. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 java-1.6.0-sun The Java Web Start implementation in Sun Java SE 6 before Update 17 does not properly handle the interaction between a signed JAR file and a JNLP (1) application or (2) applet, which has unspecified impact and attack vectors, related to a "regression," aka Bug Id 6870531. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 ImageMagick The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 ipa-client The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate from the server, which allows man-in-the-middle attackers to spoof a join procedure via a crafted certificate. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 6 Oracle Linux 5 postgresql crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 php53 php crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 neon neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 openssl The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message, a different vulnerability than CVE-2006-7250. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 6 Oracle Linux 5 dbus The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service (connection loss), obtain potentially sensitive information, or conduct unspecified state-modification attacks via crafted messages. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 Oracle Linux 6 java-1.6.0-sun Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 Update 25 and earlier, and 5.0 Update 29 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 kernel A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 postgresql PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 dstat Multiple untrusted search path vulnerabilities in dstat before 0.7.0 allow local users to gain privileges via a Trojan horse Python module in (1) the current working directory or (2) a certain subdirectory of the current working directory. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 freetype Multiple stack-based buffer overflows in the cff_decoder_parse_charstrings function in the CFF Type2 CharStrings interpreter in cff/cffgload.c in FreeType before 2.4.2, as used in Apple iOS before 4.0.2 on the iPhone and iPod touch and before 3.2.2 on the iPad, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted CFF opcodes in embedded fonts in a PDF document, as demonstrated by JailbreakMe. NOTE: some of these details are obtained from third party information. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 firefox xulrunner Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED Maria Mikhno DEPRECATED DEPRECATED Oracle Linux 5 httpd mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request. NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 kvm The pit_ioport_read function in the Programmable Interval Timer (PIT) emulation in i8254.c in KVM 83 does not properly use the pit_state data structure, which allows guest OS users to cause a denial of service (host OS crash or hang) by attempting to read the /dev/port file. Vinay Naikar DRAFT INTERIM ACCEPTED Maria Mikhno INTERIM ACCEPTED ACCEPTED Oracle Linux 5 Oracle Linux 6 thunderbird Mozilla Thunderbird is a standalone mail and newsgroup client. This erratum blacklists a small number of HTTPS certificates. (BZ#689430) This update also fixes the following bug: * The RHSA-2011:0312 and RHSA-2011:0311 updates introduced a regression, preventing some Java content and plug-ins written in Java from loading. With this update, the Java content and plug-ins work as expected. (BZ#683076) All Thunderbird users should upgrade to this updated package, which resolves these issues. All running instances of Thunderbird must be restarted for the update to take effect. Vinay Naikar DRAFT