Sign-up

ID

VAR-201511-0126


CVE

CVE-2015-8126


TITLE

libpng Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-201511-246

DESCRIPTION

Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. Description: IBM Java SE version 6 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update fixes several vulnerabilities in the IBM Java Runtime Environment and the IBM Java Software Development Kit. Further information about these flaws can be found on the IBM Java Security alerts page, listed in the References section. (CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126, CVE-2015-8472, CVE-2015-8540, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483, CVE-2016-0494) Note: This update also disallows the use of the MD5 hash algorithm in the certification path processing. The use of MD5 can be re-enabled by removing MD5 from the jdk.certpath.disabledAlgorithms security property defined in the java.security file. All running instances of IBM Java must be restarted for the update to take effect. Bugs fixed (https://bugzilla.redhat.com/): 1276416 - CVE-2015-7981 libpng: Out-of-bounds read in png_convert_to_rfc1123 1281756 - CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions 1289841 - CVE-2015-7575 TLS 1.2 Transcipt Collision attacks against MD5 in key exchange protocol (SLOTH) 1291312 - CVE-2015-8540 libpng: underflow read in png_check_keyword() 1298906 - CVE-2016-0494 ICU: integer signedness issue in IndicRearrangementProcessor (OpenJDK 2D, 8140543) 1298957 - CVE-2016-0402 OpenJDK: URL deserialization inconsistencies (Networking, 8059054) 1299073 - CVE-2016-0448 OpenJDK: logging of RMI connection secrets (JMX, 8130710) 1299385 - CVE-2016-0466 OpenJDK: insufficient enforcement of totalEntitySizeLimit (JAXP, 8133962) 1299441 - CVE-2016-0483 OpenJDK: incorrect boundary check in JPEG decoder (AWT, 8139017) 1302689 - CVE-2015-5041 IBM JDK: J9 JVM allows code to invoke non-public interface methods 6. ============================================================================ Ubuntu Security Notice USN-2815-1 November 19, 2015 libpng vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.10 - Ubuntu 15.04 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: libpng could be made to crash or run programs as your login if it opened a specially crafted file. This issue only affected Ubuntu 12.04 LTS. (CVE-2012-3425) Qixue Xiao discovered that libpng incorrectly handled certain time values. (CVE-2015-7981) It was discovered that libpng incorrectly handled certain small bit-depth values. (CVE-2015-8126) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.10: libpng12-0 1.2.51-0ubuntu3.15.10.1 Ubuntu 15.04: libpng12-0 1.2.51-0ubuntu3.15.04.1 Ubuntu 14.04 LTS: libpng12-0 1.2.50-1ubuntu2.14.04.1 Ubuntu 12.04 LTS: libpng12-0 1.2.46-3ubuntu4.1 After a standard system update you need to restart your session to make all the necessary changes. 6) - i386, x86_64 3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: libpng12 security update Advisory ID: RHSA-2015:2595-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-2595.html Issue date: 2015-12-09 CVE Names: CVE-2015-7981 CVE-2015-8126 CVE-2015-8472 ===================================================================== 1. Summary: Updated libpng12 packages that fix three security issues are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - aarch64, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The libpng12 packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files. It was discovered that the png_get_PLTE() and png_set_PLTE() functions of libpng did not correctly calculate the maximum palette sizes for bit depths of less than 8. In case an application tried to use these functions in combination with properly calculated palette sizes, this could lead to a buffer overflow or out-of-bounds reads. An attacker could exploit this to cause a crash or potentially execute arbitrary code by tricking an unsuspecting user into processing a specially crafted PNG image. However, the exact impact is dependent on the application using the library. (CVE-2015-8126, CVE-2015-8472) An array-indexing error was discovered in the png_convert_to_rfc1123() function of libpng. An attacker could possibly use this flaw to cause an out-of-bounds read by tricking an unsuspecting user into processing a specially crafted PNG image. (CVE-2015-7981) All libpng12 users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1276416 - CVE-2015-7981 libpng: Out-of-bounds read in png_convert_to_rfc1123 1281756 - CVE-2015-8126 CVE-2015-8472 libpng: Buffer overflow vulnerabilities in png_get_PLTE/png_set_PLTE functions 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: libpng12-1.2.50-7.el7_2.src.rpm x86_64: libpng12-1.2.50-7.el7_2.i686.rpm libpng12-1.2.50-7.el7_2.x86_64.rpm libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm libpng12-devel-1.2.50-7.el7_2.i686.rpm libpng12-devel-1.2.50-7.el7_2.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: libpng12-1.2.50-7.el7_2.src.rpm x86_64: libpng12-1.2.50-7.el7_2.i686.rpm libpng12-1.2.50-7.el7_2.x86_64.rpm libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm libpng12-devel-1.2.50-7.el7_2.i686.rpm libpng12-devel-1.2.50-7.el7_2.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: libpng12-1.2.50-7.el7_2.src.rpm aarch64: libpng12-1.2.50-7.el7_2.aarch64.rpm libpng12-debuginfo-1.2.50-7.el7_2.aarch64.rpm ppc64: libpng12-1.2.50-7.el7_2.ppc.rpm libpng12-1.2.50-7.el7_2.ppc64.rpm libpng12-debuginfo-1.2.50-7.el7_2.ppc.rpm libpng12-debuginfo-1.2.50-7.el7_2.ppc64.rpm ppc64le: libpng12-1.2.50-7.el7_2.ppc64le.rpm libpng12-debuginfo-1.2.50-7.el7_2.ppc64le.rpm s390x: libpng12-1.2.50-7.el7_2.s390.rpm libpng12-1.2.50-7.el7_2.s390x.rpm libpng12-debuginfo-1.2.50-7.el7_2.s390.rpm libpng12-debuginfo-1.2.50-7.el7_2.s390x.rpm x86_64: libpng12-1.2.50-7.el7_2.i686.rpm libpng12-1.2.50-7.el7_2.x86_64.rpm libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): aarch64: libpng12-debuginfo-1.2.50-7.el7_2.aarch64.rpm libpng12-devel-1.2.50-7.el7_2.aarch64.rpm ppc64: libpng12-debuginfo-1.2.50-7.el7_2.ppc.rpm libpng12-debuginfo-1.2.50-7.el7_2.ppc64.rpm libpng12-devel-1.2.50-7.el7_2.ppc.rpm libpng12-devel-1.2.50-7.el7_2.ppc64.rpm ppc64le: libpng12-debuginfo-1.2.50-7.el7_2.ppc64le.rpm libpng12-devel-1.2.50-7.el7_2.ppc64le.rpm s390x: libpng12-debuginfo-1.2.50-7.el7_2.s390.rpm libpng12-debuginfo-1.2.50-7.el7_2.s390x.rpm libpng12-devel-1.2.50-7.el7_2.s390.rpm libpng12-devel-1.2.50-7.el7_2.s390x.rpm x86_64: libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm libpng12-devel-1.2.50-7.el7_2.i686.rpm libpng12-devel-1.2.50-7.el7_2.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: libpng12-1.2.50-7.el7_2.src.rpm x86_64: libpng12-1.2.50-7.el7_2.i686.rpm libpng12-1.2.50-7.el7_2.x86_64.rpm libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: libpng12-debuginfo-1.2.50-7.el7_2.i686.rpm libpng12-debuginfo-1.2.50-7.el7_2.x86_64.rpm libpng12-devel-1.2.50-7.el7_2.i686.rpm libpng12-devel-1.2.50-7.el7_2.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2015-7981 https://access.redhat.com/security/cve/CVE-2015-8126 https://access.redhat.com/security/cve/CVE-2015-8472 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD4DBQFWaEOWXlSAg2UNWIIRArqQAJiXHpRTjePlByUwb2yeLtnA6ZHDAJ483rVP N/LWwsGEwId3XWZYVPOUSQ== =s2GT -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . (CVE-2015-4734, CVE-2015-4803, CVE-2015-4805, CVE-2015-4806, CVE-2015-4810, CVE-2015-4835, CVE-2015-4840, CVE-2015-4842, CVE-2015-4843, CVE-2015-4844, CVE-2015-4860, CVE-2015-4871, CVE-2015-4872, CVE-2015-4882, CVE-2015-4883, CVE-2015-4893, CVE-2015-4902, CVE-2015-4903, CVE-2015-5006, CVE-2015-5041, CVE-2015-7575, CVE-2015-7981, CVE-2015-8126, CVE-2015-8472, CVE-2015-8540, CVE-2016-0264, CVE-2016-0363, CVE-2016-0376, CVE-2016-0402, CVE-2016-0448, CVE-2016-0466, CVE-2016-0483, CVE-2016-0494, CVE-2016-0686, CVE-2016-0687, CVE-2016-3422, CVE-2016-3426, CVE-2016-3427, CVE-2016-3443, CVE-2016-3449) Red Hat would like to thank Andrea Palazzo of Truel IT for reporting the CVE-2015-4806 issue. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-7981 Qixue Xiao discovered an out-of-bounds read vulnerability in the png_convert_to_rfc1123 function. A remote attacker can potentially take advantage of this flaw to cause disclosure of information from process memory. CVE-2015-8126 Multiple buffer overflows were discovered in the png_set_PLTE and png_get_PLTE functions. For the oldstable distribution (wheezy), these problems have been fixed in version 1.2.49-1+deb7u1. For the stable distribution (jessie), these problems have been fixed in version 1.2.50-2+deb8u1. For the unstable distribution (sid), these problems have been fixed in version 1.2.54-1

Trust: 2.07

sources: NVD: CVE-2015-8126 // VULHUB: VHN-86087 // VULMON: CVE-2015-8126 // PACKETSTORM: 135555 // PACKETSTORM: 135556 // PACKETSTORM: 135558 // PACKETSTORM: 134452 // PACKETSTORM: 135339 // PACKETSTORM: 135338 // PACKETSTORM: 134722 // PACKETSTORM: 134719 // PACKETSTORM: 137932 // PACKETSTORM: 135341 // PACKETSTORM: 134436

AFFECTED PRODUCTS

vendor:canonicalmodel:ubuntu linuxscope:eqversion:15.04

Trust: 1.0

vendor:oraclemodel:jdkscope:eqversion:1.6.0

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:22

Trust: 1.0

vendor:susemodel:linux enterprise serverscope:eqversion:12

Trust: 1.0

vendor:libpngmodel:libpngscope:ltversion:1.6.19

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:7.6

Trust: 1.0

vendor:libpngmodel:libpngscope:ltversion:1.5.24

Trust: 1.0

vendor:redhatmodel:enterprise linux server tusscope:eqversion:7.7

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:7.4

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.11.4

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:14.04

Trust: 1.0

vendor:libpngmodel:libpngscope:gteversion:1.3.0

Trust: 1.0

vendor:redhatmodel:satellitescope:eqversion:5.7

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:7.6

Trust: 1.0

vendor:oraclemodel:jrescope:eqversion:1.7.0

Trust: 1.0

vendor:oraclemodel:solarisscope:eqversion:11.3

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:8.0

Trust: 1.0

vendor:libpngmodel:libpngscope:gteversion:1.6.0

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:7.4

Trust: 1.0

vendor:redhatmodel:enterprise linux desktopscope:eqversion:7.0

Trust: 1.0

vendor:libpngmodel:libpngscope:ltversion:1.0.64

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:7.3

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:21

Trust: 1.0

vendor:oraclemodel:jrescope:eqversion:1.8.0

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:12.04

Trust: 1.0

vendor:redhatmodel:enterprise linux workstationscope:eqversion:6.0

Trust: 1.0

vendor:oraclemodel:linuxscope:eqversion:7

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:15.10

Trust: 1.0

vendor:redhatmodel:enterprise linux serverscope:eqversion:6.0

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:7.3

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:6.7

Trust: 1.0

vendor:redhatmodel:enterprise linux server tusscope:eqversion:7.6

Trust: 1.0

vendor:opensusemodel:leapscope:eqversion:42.1

Trust: 1.0

vendor:oraclemodel:jdkscope:eqversion:1.7.0

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:7.2

Trust: 1.0

vendor:libpngmodel:libpngscope:gteversion:1.5.0

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:7.5

Trust: 1.0

vendor:libpngmodel:libpngscope:gteversion:1.1.1

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:7.2

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:7.7

Trust: 1.0

vendor:oraclemodel:jdkscope:eqversion:1.8.0

Trust: 1.0

vendor:redhatmodel:enterprise linux workstationscope:eqversion:7.0

Trust: 1.0

vendor:opensusemodel:opensusescope:eqversion:13.2

Trust: 1.0

vendor:redhatmodel:enterprise linux server tusscope:eqversion:7.3

Trust: 1.0

vendor:libpngmodel:libpngscope:ltversion:1.2.54

Trust: 1.0

vendor:redhatmodel:enterprise linux eusscope:eqversion:7.7

Trust: 1.0

vendor:redhatmodel:enterprise linux serverscope:eqversion:7.0

Trust: 1.0

vendor:oraclemodel:jrescope:eqversion:1.6.0

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:23

Trust: 1.0

vendor:redhatmodel:satellitescope:eqversion:5.6

Trust: 1.0

vendor:libpngmodel:libpngscope:ltversion:1.4.17

Trust: 1.0

vendor:opensusemodel:opensusescope:eqversion:13.1

Trust: 1.0

vendor:susemodel:linux enterprise desktopscope:eqversion:12

Trust: 1.0

vendor:oraclemodel:linuxscope:eqversion:6

Trust: 1.0

vendor:redhatmodel:enterprise linux desktopscope:eqversion:6.0

Trust: 1.0

vendor:redhatmodel:enterprise linux server tusscope:eqversion:7.2

Trust: 1.0

vendor:susemodel:linux enterprise desktopscope:eqversion:11

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:7.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.11.3

Trust: 0.6

sources: CNNVD: CNNVD-201511-246 // NVD: CVE-2015-8126

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-8126
value: HIGH

Trust: 1.0

CNNVD: CNNVD-201511-246
value: HIGH

Trust: 0.6

VULHUB: VHN-86087
value: HIGH

Trust: 0.1

VULMON: CVE-2015-8126
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-8126
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-86087
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-86087 // VULMON: CVE-2015-8126 // CNNVD: CNNVD-201511-246 // NVD: CVE-2015-8126

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.1

problemtype:CWE-119

Trust: 0.1

sources: VULHUB: VHN-86087 // NVD: CVE-2015-8126

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201511-246

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201511-246

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-86087

PATCH
title:libpng Buffer Overflow Vulnerability Fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58735
Trust: 0.6
title:The Registerurl:https://www.theregister.co.uk/2016/01/20/oracle_q1_2016_patch_release/
Trust: 0.2
title:Red Hat: Moderate: libpng12 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20152595 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: libpng security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20152596 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: libpng security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20152594 - Security Advisory
Trust: 0.1
title:Debian CVElist Bug Report Logs: CVE-2015-8126: buffer overflowurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=48ea0ad3686f0e21036476817f732c90
Trust: 0.1
title:Debian CVElist Bug Report Logs: libpng: CVE-2015-7981: out-of-bound readurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=83b375e2e219a2891fcbdacbafaee367
Trust: 0.1
title:Ubuntu Security Notice: libpng vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-2815-1
Trust: 0.1
title:Debian CVElist Bug Report Logs: libpng: Incomplete fix for CVE-2015-8126url:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=386e683fecec564e81371b5dca873869
Trust: 0.1
title:Debian Security Advisories: DSA-3399-1 libpng -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=6c419f27840ce87aab71c3d89dad3813
Trust: 0.1
title:Amazon Linux AMI: ALAS-2015-611url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2015-611
Trust: 0.1
title:Red Hat: CVE-2015-8126url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2015-8126
Trust: 0.1
title:Debian Security Advisories: DSA-3443-1 libpng -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=57e4bc5fc071e2986f7cef65414ffe23
Trust: 0.1
title:Apple: OS X El Capitan v10.11.4 and Security Update 2016-002url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=ef054ba76412200e34091eb91c38c281
Trust: 0.1
title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2016url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=ac5af5dd99788925425f5747ec672707
Trust: 0.1
title:Oracle Linux Bulletins: Oracle Linux Bulletin - October 2015url:https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins&qid=435ed9abc2fb1e74ce2a69605a01e326
Trust: 0.1
title:Oracle: Oracle Critical Patch Update Advisory - January 2016url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=63802a6c83b107c4e6e0c7f9241a66a8
Trust: 0.1
title:IBM: Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM Netezza Analytics for NPSurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=c36fc403a4c2c6439b732d2fca738f58
Trust: 0.1
title:chequeurl:https://github.com/sonatype-nexus-community/cheque 
Trust: 0.1
title:clair-laburl:https://github.com/sjourdan/clair-lab 
Trust: 0.1
title:afl-cveurl:https://github.com/mrash/afl-cve 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2015-8126 // 
            
            
            
            CNNVD: CNNVD-201511-246

EXTERNAL IDS
db:NVDid:CVE-2015-8126
Trust: 2.9
db:BIDid:77568
Trust: 1.8
db:SECTRACKid:1034142
Trust: 1.8
db:OPENWALLid:OSS-SECURITY/2015/11/12/2
Trust: 1.8
db:MCAFEEid:SB10148
Trust: 1.8
db:CNNVDid:CNNVD-201511-246
Trust: 0.7
db:PACKETSTORMid:135338
Trust: 0.2
db:PACKETSTORMid:136095
Trust: 0.1
db:PACKETSTORMid:134720
Trust: 0.1
db:SEEBUGid:SSVID-89794
Trust: 0.1
db:VULHUBid:VHN-86087
Trust: 0.1
db:VULMONid:CVE-2015-8126
Trust: 0.1
db:PACKETSTORMid:135555
Trust: 0.1
db:PACKETSTORMid:135556
Trust: 0.1
db:PACKETSTORMid:135558
Trust: 0.1
db:PACKETSTORMid:134452
Trust: 0.1
db:PACKETSTORMid:135339
Trust: 0.1
db:PACKETSTORMid:134722
Trust: 0.1
db:PACKETSTORMid:134719
Trust: 0.1
db:PACKETSTORMid:137932
Trust: 0.1
db:PACKETSTORMid:135341
Trust: 0.1
db:PACKETSTORMid:134436
Trust: 0.1
sources:
            
            
            VULHUB: VHN-86087 // 
            
            
            
            VULMON: CVE-2015-8126 // 
            
            
            
            PACKETSTORM: 135555 // 
            
            
            
            PACKETSTORM: 135556 // 
            
            
            
            PACKETSTORM: 135558 // 
            
            
            
            PACKETSTORM: 134452 // 
            
            
            
            PACKETSTORM: 135339 // 
            
            
            
            PACKETSTORM: 135338 // 
            
            
            
            PACKETSTORM: 134722 // 
            
            
            
            PACKETSTORM: 134719 // 
            
            
            
            PACKETSTORM: 137932 // 
            
            
            
            PACKETSTORM: 135341 // 
            
            
            
            PACKETSTORM: 134436 // 
            
            
            
            CNNVD: CNNVD-201511-246 // 
            
            
            
            NVD: CVE-2015-8126

REFERENCES
url:http://www.securityfocus.com/bid/77568
Trust: 1.9
url:http://rhn.redhat.com/errata/rhsa-2015-2594.html
Trust: 1.9
url:http://rhn.redhat.com/errata/rhsa-2015-2595.html
Trust: 1.9
url:http://rhn.redhat.com/errata/rhsa-2016-0055.html
Trust: 1.9
url:http://rhn.redhat.com/errata/rhsa-2016-0056.html
Trust: 1.9
url:http://rhn.redhat.com/errata/rhsa-2016-0057.html
Trust: 1.9
url:https://access.redhat.com/errata/rhsa-2016:1430
Trust: 1.9
url:http://www.ubuntu.com/usn/usn-2815-1
Trust: 1.9
url:http://lists.apple.com/archives/security-announce/2016/mar/msg00004.html
Trust: 1.8
url:http://googlechromereleases.blogspot.com/2016/03/stable-channel-update.html
Trust: 1.8
url:http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html
Trust: 1.8
url:http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
Trust: 1.8
url:http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
Trust: 1.8
url:https://code.google.com/p/chromium/issues/detail?id=560291
Trust: 1.8
url:https://support.apple.com/ht206167
Trust: 1.8
url:http://www.debian.org/security/2015/dsa-3399
Trust: 1.8
url:http://www.debian.org/security/2016/dsa-3507
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2015-november/172769.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2015-november/172620.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2016-january/174936.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2016-january/175073.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2015-november/172663.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2015-november/172324.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2015-november/172823.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2015-november/172797.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2016-january/174905.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2015-november/172647.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2016-february/177382.html
Trust: 1.8
url:http://lists.fedoraproject.org/pipermail/package-announce/2016-february/177344.html
Trust: 1.8
url:https://security.gentoo.org/glsa/201603-09
Trust: 1.8
url:https://security.gentoo.org/glsa/201611-08
Trust: 1.8
url:http://www.openwall.com/lists/oss-security/2015/11/12/2
Trust: 1.8
url:http://rhn.redhat.com/errata/rhsa-2015-2596.html
Trust: 1.8
url:http://www.securitytracker.com/id/1034142
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00015.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00033.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00034.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-updates/2015-11/msg00159.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-updates/2015-11/msg00160.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-updates/2015-12/msg00062.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-updates/2015-12/msg00063.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-updates/2016-01/msg00028.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-updates/2016-01/msg00029.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-updates/2016-01/msg00030.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00014.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00018.html
Trust: 1.8
url:http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00028.html
Trust: 1.8
url:https://kc.mcafee.com/corporate/index?page=content&id=sb10148
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2015-8126
Trust: 1.1
url:https://access.redhat.com/security/cve/cve-2015-8126
Trust: 1.0
url:https://nvd.nist.gov/vuln/detail/cve-2015-8472
Trust: 0.9
url:https://access.redhat.com/articles/11258
Trust: 0.9
url:https://access.redhat.com/security/team/contact/
Trust: 0.9
url:https://www.redhat.com/mailman/listinfo/rhsa-announce
Trust: 0.9
url:https://bugzilla.redhat.com/):
Trust: 0.9
url:https://access.redhat.com/security/team/key/
Trust: 0.9
url:https://access.redhat.com/security/cve/cve-2015-8472
Trust: 0.9
url:https://access.redhat.com/security/cve/cve-2016-0448
Trust: 0.7
url:https://access.redhat.com/security/cve/cve-2016-0483
Trust: 0.7
url:https://access.redhat.com/security/cve/cve-2016-0402
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2015-7981
Trust: 0.7
url:https://access.redhat.com/security/cve/cve-2016-0466
Trust: 0.7
url:https://access.redhat.com/security/cve/cve-2016-0494
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2016-0448
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2015-7575
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2016-0466
Trust: 0.6
url:https://access.redhat.com/security/cve/cve-2015-7575
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2016-0483
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2016-0494
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2016-0402
Trust: 0.6
url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-affect-ibm-netezza-analytics/
Trust: 0.6
url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-affect-ibm-netezza-analytics-for-nps/
Trust: 0.6
url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-jre-8-0-1-1-affect-ibm-netezza-platform-software-clients/
Trust: 0.6
url:https://access.redhat.com/security/updates/classification/#critical
Trust: 0.5
url:https://access.redhat.com/security/cve/cve-2015-7981
Trust: 0.5
url:https://nvd.nist.gov/vuln/detail/cve-2015-5041
Trust: 0.4
url:https://access.redhat.com/security/cve/cve-2015-5041
Trust: 0.4
url:http://www.ibm.com/developerworks/java/jdk/alerts/
Trust: 0.3
url:https://access.redhat.com/security/cve/cve-2015-8540
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2015-8540
Trust: 0.3
url:http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#appendixjava
Trust: 0.3
url:https://access.redhat.com/security/updates/classification/#moderate
Trust: 0.3
url:https://access.redhat.com/security/cve/cve-2016-0475
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2016-0475
Trust: 0.2
url:https://kc.mcafee.com/corporate/index?page=content&amp;id=sb10148
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/120.html
Trust: 0.1
url:https://access.redhat.com/errata/rhsa-2015:2595
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/sonatype-nexus-community/cheque
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=43864
Trust: 0.1
url:https://usn.ubuntu.com/2815-1/
Trust: 0.1
url:https://rhn.redhat.com/errata/rhsa-2016-0100.html
Trust: 0.1
url:https://rhn.redhat.com/errata/rhsa-2016-0098.html
Trust: 0.1
url:https://rhn.redhat.com/errata/rhsa-2016-0101.html
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/libpng/1.2.51-0ubuntu3.15.04.1
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/libpng/1.2.46-3ubuntu4.1
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/libpng/1.2.50-1ubuntu2.14.04.1
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2012-3425
Trust: 0.1
url:https://launchpad.net/ubuntu/+source/libpng/1.2.51-0ubuntu3.15.10.1
Trust: 0.1
url:https://access.redhat.com/security/updates/classification/#important
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4883
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4840
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-3422
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4882
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4903
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4872
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4844
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4806
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-3449
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-0363
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-0264
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4871
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4860
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4893
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4871
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-0376
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4803
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4840
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-0376
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4734
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4860
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4842
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4843
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4835
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4903
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4805
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4902
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4883
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4810
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4805
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4893
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-3443
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-0363
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4882
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4842
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4843
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4835
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4810
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4902
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4872
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-0686
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-3426
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4734
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4803
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-4806
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-4844
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-5006
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-3427
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-5006
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2016-0687
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-0264
Trust: 0.1
url:https://www.debian.org/security/
Trust: 0.1
url:https://www.debian.org/security/faq
Trust: 0.1
sources:
            
            
            VULHUB: VHN-86087 // 
            
            
            
            VULMON: CVE-2015-8126 // 
            
            
            
            PACKETSTORM: 135555 // 
            
            
            
            PACKETSTORM: 135556 // 
            
            
            
            PACKETSTORM: 135558 // 
            
            
            
            PACKETSTORM: 134452 // 
            
            
            
            PACKETSTORM: 135339 // 
            
            
            
            PACKETSTORM: 135338 // 
            
            
            
            PACKETSTORM: 134722 // 
            
            
            
            PACKETSTORM: 134719 // 
            
            
            
            PACKETSTORM: 137932 // 
            
            
            
            PACKETSTORM: 135341 // 
            
            
            
            PACKETSTORM: 134436 // 
            
            
            
            CNNVD: CNNVD-201511-246 // 
            
            
            
            NVD: CVE-2015-8126

CREDITS
Red Hat
Trust: 0.9
sources:
            
            
            PACKETSTORM: 135555 // 
            
            
            
            PACKETSTORM: 135556 // 
            
            
            
            PACKETSTORM: 135558 // 
            
            
            
            PACKETSTORM: 135339 // 
            
            
            
            PACKETSTORM: 135338 // 
            
            
            
            PACKETSTORM: 134722 // 
            
            
            
            PACKETSTORM: 134719 // 
            
            
            
            PACKETSTORM: 137932 // 
            
            
            
            PACKETSTORM: 135341

SOURCES
db:VULHUBid:VHN-86087
db:VULMONid:CVE-2015-8126
db:PACKETSTORMid:135555
db:PACKETSTORMid:135556
db:PACKETSTORMid:135558
db:PACKETSTORMid:134452
db:PACKETSTORMid:135339
db:PACKETSTORMid:135338
db:PACKETSTORMid:134722
db:PACKETSTORMid:134719
db:PACKETSTORMid:137932
db:PACKETSTORMid:135341
db:PACKETSTORMid:134436
db:CNNVDid:CNNVD-201511-246
db:NVDid:CVE-2015-8126

LAST UPDATE DATE
2024-09-18T23:34:55.362000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-86087date:2020-08-31T00:00:00
db:VULMONid:CVE-2015-8126date:2020-09-08T00:00:00
db:CNNVDid:CNNVD-201511-246date:2022-05-16T00:00:00
db:NVDid:CVE-2015-8126date:2022-05-13T14:57:21.083

SOURCES RELEASE DATE
db:VULHUBid:VHN-86087date:2015-11-13T00:00:00
db:VULMONid:CVE-2015-8126date:2015-11-13T00:00:00
db:PACKETSTORMid:135555date:2016-02-02T16:43:57
db:PACKETSTORMid:135556date:2016-02-02T16:44:07
db:PACKETSTORMid:135558date:2016-02-02T16:44:18
db:PACKETSTORMid:134452date:2015-11-20T00:42:48
db:PACKETSTORMid:135339date:2016-01-21T14:47:36
db:PACKETSTORMid:135338date:2016-01-21T14:47:29
db:PACKETSTORMid:134722date:2015-12-10T00:40:23
db:PACKETSTORMid:134719date:2015-12-10T00:39:51
db:PACKETSTORMid:137932date:2016-07-18T19:51:43
db:PACKETSTORMid:135341date:2016-01-21T14:47:53
db:PACKETSTORMid:134436date:2015-11-19T14:13:58
db:CNNVDid:CNNVD-201511-246date:2015-11-16T00:00:00
db:NVDid:CVE-2015-8126date:2015-11-13T03:59:05.917