ID

VAR-201512-0325


CVE

CVE-2015-8242


TITLE

libxml2 of HTML Parser push Interface SAX2.c of xmlSAX2TextNode Service disruption in functions (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2015-006437

DESCRIPTION

The xmlSAX2TextNode function in SAX2.c in the push interface in the HTML parser in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (stack-based buffer over-read and application crash) or obtain sensitive information via crafted XML data. libxml2 is prone to multiple information-disclosure vulnerabilities. Attackers can exploit these issues to obtain sensitive information that may aid in launching further attacks. libxml2 2.9.2 is vulnerable; other versions may also be affected. It supports multiple encoding formats, XPath analysis, Well-formed and valid verification, etc. There is a security vulnerability in the 'xmlSAX2TextNode' function in the SAX2.c file of the push interface in the HTML parser of versions prior to libxml2 2.9.3. Summary: Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6 and 7, Solaris, and Microsoft Windows from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. This release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References. Security Fix(es): * Several denial of service flaws were found in libxml2, a library providing support for reading, modifying, and writing XML and HTML files. (CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-7942, CVE-2015-8035, CVE-2015-8710, CVE-2015-7941, CVE-2015-8241, CVE-2015-8242, CVE-2015-8317) * A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346) * A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351) * It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714) * A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763) * A use-after-free flaw was found in the way OpenSSL imported malformed Elliptic Curve private keys. A specially crafted key file could cause an application using OpenSSL to crash when imported. (CVE-2015-0209) * It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345) * It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured. This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706) Red Hat would like to thank the GNOME project for reporting CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, CVE-2015-7500, CVE-2015-8241, CVE-2015-8242, and CVE-2015-8317. Upstream acknowledges Kostya Serebryany as the original reporter of CVE-2015-7497, CVE-2015-7498, CVE-2015-7499, and CVE-2015-7500; Hugh Davenport as the original reporter of CVE-2015-8241 and CVE-2015-8242; and Hanno Boeck as the original reporter of CVE-2015-8317. 3. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). After installing the updated packages, the httpd daemon will be restarted automatically. 4. Bugs fixed (https://bugzilla.redhat.com/): 1196737 - CVE-2015-0209 openssl: use-after-free on invalid EC private key import 1213957 - CVE-2015-8710 libxml2: out-of-bounds memory access when parsing an unclosed HTML comment 1274222 - CVE-2015-7941 libxml2: Out-of-bounds memory access 1276297 - CVE-2015-7942 libxml2: heap-based buffer overflow in xmlParseConditionalSections() 1276693 - CVE-2015-5312 libxml2: CPU exhaustion when processing specially crafted XML input 1277146 - CVE-2015-8035 libxml2: DoS when parsing specially crafted XML document if XZ support is enabled 1281862 - CVE-2015-7497 libxml2: Heap-based buffer overflow in xmlDictComputeFastQKey 1281879 - CVE-2015-7498 libxml2: Heap-based buffer overflow in xmlParseXmlDecl 1281925 - CVE-2015-7499 libxml2: Heap-based buffer overflow in xmlGROW 1281930 - CVE-2015-8317 libxml2: Out-of-bounds heap read when parsing file with unfinished xml declaration 1281936 - CVE-2015-8241 libxml2: Buffer overread with XML parser in xmlNextChar 1281943 - CVE-2015-7500 libxml2: Heap buffer overflow in xmlParseMisc 1281950 - CVE-2015-8242 libxml2: Buffer overread with HTML parser in push mode in xmlSAX2TextNode 1311076 - CVE-2015-5351 tomcat: CSRF token leak 1311082 - CVE-2016-0714 tomcat: Security Manager bypass via persistence mechanisms 1311085 - CVE-2015-5346 tomcat: Session fixation 1311087 - CVE-2016-0706 tomcat: security manager bypass via StatusManagerServlet 1311089 - CVE-2015-5345 tomcat: directory disclosure 1311093 - CVE-2016-0763 tomcat: security manager bypass via setGlobalContext() 5. JIRA issues fixed (https://issues.jboss.org/): JWS-271 - User submitted session ID JWS-272 - User submitted session ID JWS-276 - Welcome File processing refactoring - CVE-2015-5345 low JWS-277 - Welcome File processing refactoring - CVE-2015-5345 low JWS-303 - Avoid useless session creation for manager webapps - CVE-2015-5351 moderate JWS-304 - Restrict another manager servlet - CVE-2016-0706 low JWS-349 - Session serialization safety - CVE-2016-0714 moderate JWS-350 - Protect ResourceLinkFactory.setGlobalContext() - CVE-2016-0763 moderate 6. References: https://access.redhat.com/security/cve/CVE-2015-0209 https://access.redhat.com/security/cve/CVE-2015-5312 https://access.redhat.com/security/cve/CVE-2015-5345 https://access.redhat.com/security/cve/CVE-2015-5346 https://access.redhat.com/security/cve/CVE-2015-5351 https://access.redhat.com/security/cve/CVE-2015-7497 https://access.redhat.com/security/cve/CVE-2015-7498 https://access.redhat.com/security/cve/CVE-2015-7499 https://access.redhat.com/security/cve/CVE-2015-7500 https://access.redhat.com/security/cve/CVE-2015-7941 https://access.redhat.com/security/cve/CVE-2015-7942 https://access.redhat.com/security/cve/CVE-2015-8035 https://access.redhat.com/security/cve/CVE-2015-8241 https://access.redhat.com/security/cve/CVE-2015-8242 https://access.redhat.com/security/cve/CVE-2015-8317 https://access.redhat.com/security/cve/CVE-2015-8710 https://access.redhat.com/security/cve/CVE-2016-0706 https://access.redhat.com/security/cve/CVE-2016-0714 https://access.redhat.com/security/cve/CVE-2016-0763 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Web_Server/3/html-single/3.0.3_Release_Notes/index.html https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=webserver&version=3.0.3 7. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFXO0eWXlSAg2UNWIIRAjqoAJ9kJfUdG/dzrjc6CPe+Ah1NIaqvsACfZE1q 9d1Ta2CX5a+zVXOqLprEvM0= =ByHT -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_n a-c04944172 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04944172 Version: 1 HPSBGN03537 rev.1 - HPE IceWall Federation Agent and IceWall File Manager running libXML2, Remote or Local Denial of Service (DoS) NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. - IceWall File Manager 3.0 - IceWall Federation Agent 3.0 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2015-5312 (AV:N/AC:M/Au:N/C:N/I:N/A:C) 7.1 CVE-2015-7497 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2015-7498 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2015-7499 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 CVE-2015-7500 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2015-7941 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3 CVE-2015-7942 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8 CVE-2015-8241 (AV:N/AC:L/Au:N/C:P/I:N/A:P) 6.4 CVE-2015-8242 (AV:N/AC:M/Au:N/C:P/I:N/A:P) 5.8 CVE-2015-8317 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 5.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HPE recommends applying the latest OS vendor security patches for libXML2 to resolve the vulnerabilities in the libXML2 library. Please note that the HP IceWall product is only available in Japan. HISTORY Version:1 (rev.1) - 22 January 2016 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HPE Services support channel. Report: To report a potential security vulnerability with any HPE supported product, send Email to: security-alert@hpe.com Subscribe: To initiate a subscription to receive future HPE Security Bulletin alerts via Email: http://www.hpe.com/support/Subscriber_Choice Security Bulletin Archive: A list of recently released Security Bulletins is available here: http://www.hpe.com/support/Security_Bulletin_Archive Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HPE General Software HF = HPE Hardware and Firmware MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PV = ProCurve ST = Storage Software UX = HP-UX Copyright 2016 Hewlett Packard Enterprise Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett Packard Enterprise and the names of Hewlett Packard Enterprise products referenced herein are trademarks of Hewlett Packard Enterprise in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. CVE-ID CVE-2016-1722 : Joshua J. CVE-ID CVE-2016-1781 : Devdatta Akhawe of Dropbox, Inc. WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A website may be able to track sensitive user information Description: A hidden web page may be able to access device- orientation and device-motion data. This issue was addressed by suspending the availability of this data when the web view is hidden. CVE-ID CVE-2016-1780 : Maryam Mehrnezhad, Ehsan Toreini, Siamak F. Shahandashti, and Feng Hao of the School of Computing Science, Newcastle University, UK WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may reveal a user's current location Description: An issue existed in the parsing of geolocation requests. CVE-ID CVE-2016-1779 : xisigr of Tencent's Xuanwu Lab (http://www.tencent.com) WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious website may be able to access restricted ports on arbitrary servers Description: A port redirection issue was addressed through additional port validation. CVE-ID CVE-2016-1782 : Muneaki Nishimura (nishimunea) of Recruit Technologies Co.,Ltd. CVE-ID CVE-2016-1784 : Moony Li and Jack Tang of TrendMicro and 李普君 of 无声信息技术PKAV Team (PKAV.net) WebKit Page Loading Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a malicious website may lead to user interface spoofing Description: Redirect responses may have allowed a malicious website to display an arbitrary URL and read cached contents of the destination origin. CVE-ID CVE-2016-1786 : ma.la of LINE Corporation WebKit Page Loading Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious website may exfiltrate data cross-origin Description: A caching issue existed with character encoding. CVE-ID CVE-2016-0801 : an anonymous researcher CVE-2016-0802 : an anonymous researcher Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. ============================================================================ Ubuntu Security Notice USN-2834-1 December 14, 2015 libxml2 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.10 - Ubuntu 15.04 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: libxml2 could be made to crash if it opened a specially crafted file. Software Description: - libxml2: GNOME XML library Details: Kostya Serebryany discovered that libxml2 incorrectly handled certain malformed documents. (CVE-2015-5312, CVE-2015-7497, CVE-2015-7498, CVE-2015-7499,CVE-2015-7500) Hugh Davenport discovered that libxml2 incorrectly handled certain malformed documents. (CVE-2015-8241, CVE-2015-8242) Hanno Boeck discovered that libxml2 incorrectly handled certain malformed documents. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-8317) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.10: libxml2 2.9.2+zdfsg1-4ubuntu0.2 Ubuntu 15.04: libxml2 2.9.2+dfsg1-3ubuntu0.2 Ubuntu 14.04 LTS: libxml2 2.9.1+dfsg1-3ubuntu4.6 Ubuntu 12.04 LTS: libxml2 2.7.8.dfsg-5.1ubuntu4.13 After a standard system update you need to reboot your computer to make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002 OS X El Capitan 10.11.4 and Security Update 2016-002 is now available and addresses the following: apache_mod_php Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by updating libpng to version 1.6.20. CVE-ID CVE-2015-8126 : Adam Mariš CVE-2015-8472 : Adam Mariš AppleRAID Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1733 : Proteas of Qihoo 360 Nirvan Team AppleRAID Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-ID CVE-2016-1732 : Proteas of Qihoo 360 Nirvan Team AppleUSBNetworking Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue existed in the parsing of data from USB devices. This issue was addressed through improved input validation. CVE-ID CVE-2016-1734 : Andrea Barisani and Andrej Rosano of Inverse Path Bluetooth Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1735 : Jeonghoon Shin@A.D.D CVE-2016-1736 : beist and ABH of BoB Carbon Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .dfont file may lead to arbitrary code execution Description: Multiple memory corruption issues existed in the handling of font files. These issues were addressed through improved bounds checking. CVE-ID CVE-2016-1737 : an anonymous researcher dyld Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker may tamper with code-signed applications to execute arbitrary code in the application's context Description: A code signing verification issue existed in dyld. This issue was addressed with improved validation. CVE-ID CVE-2016-1738 : beist and ABH of BoB FontParser Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1740 : HappilyCoded (ant4g0nist and r3dsm0k3) working with Trend Micro's Zero Day Initiative (ZDI) HTTPProtocol Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A remote attacker may be able to execute arbitrary code Description: Multiple vulnerabilities existed in nghttp2 versions prior to 1.6.0, the most serious of which may have led to remote code execution. These were addressed by updating nghttp2 to version 1.6.0. CVE-ID CVE-2015-8659 Intel Graphics Driver Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1743 : Piotr Bania of Cisco Talos CVE-2016-1744 : Ian Beer of Google Project Zero IOFireWireFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to cause a denial of service Description: A null pointer dereference was addressed through improved validation. CVE-ID CVE-2016-1745 : sweetchip of Grayhash IOGraphics Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-ID CVE-2016-1746 : Peter Pi of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) CVE-2016-1747 : Juwei Lin of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) IOHIDFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to determine kernel memory layout Description: A memory corruption issue was addressed through improved memory handling. CVE-ID CVE-2016-1748 : Brandon Azad IOUSBFamily Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1749 : Ian Beer of Google Project Zero and Juwei Lin of Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. CVE-ID CVE-2016-1750 : CESG Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A race condition existed during the creation of new processes. This was addressed through improved state handling. CVE-ID CVE-2016-1757 : Ian Beer of Google Project Zero and Pedro Vilaca Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A null pointer dereference was addressed through improved input validation. CVE-ID CVE-2016-1756 : Lufeng Li of Qihoo 360 Vulcan Team Kernel Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1754 : Lufeng Li of Qihoo 360 Vulcan Team CVE-2016-1755 : Ian Beer of Google Project Zero CVE-2016-1759 : lokihardt Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to determine kernel memory layout Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation. CVE-ID CVE-2016-1758 : Brandon Azad Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple integer overflows were addressed through improved input validation. CVE-ID CVE-2016-1753 : Juwei Lin Trend Micro working with Trend Micro's Zero Day Initiative (ZDI) Kernel Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to cause a denial of service Description: A denial of service issue was addressed through improved validation. CVE-ID CVE-2016-1752 : CESG libxml2 Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing maliciously crafted XML may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2015-1819 CVE-2015-5312 : David Drysdale of Google CVE-2015-7499 CVE-2015-7500 : Kostya Serebryany of Google CVE-2015-7942 : Kostya Serebryany of Google CVE-2015-8035 : gustavo.grieco CVE-2015-8242 : Hugh Davenport CVE-2016-1761 : wol0xff working with Trend Micro's Zero Day Initiative (ZDI) CVE-2016-1762 Messages Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker who is able to bypass Apple's certificate pinning, intercept TLS connections, inject messages, and record encrypted attachment-type messages may be able to read attachments Description: A cryptographic issue was addressed by rejecting duplicate messages on the client. CVE-ID CVE-2016-1788 : Christina Garman, Matthew Green, Gabriel Kaptchuk, Ian Miers, and Michael Rushanan of Johns Hopkins University Messages Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Clicking a JavaScript link can reveal sensitive user information Description: An issue existed in the processing of JavaScript links. This issue was addressed through improved content security policy checks. CVE-ID CVE-2016-1764 : Matthew Bryan of the Uber Security Team (formerly of Bishop Fox), Joe DeMesy and Shubham Shah of Bishop Fox NVIDIA Graphics Drivers Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1741 : Ian Beer of Google Project Zero OpenSSH Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Connecting to a server may leak sensitive user information, such as a client's private keys Description: Roaming, which was on by default in the OpenSSH client, exposed an information leak and a buffer overflow. These issues were addressed by disabling roaming in the client. CVE-ID CVE-2016-0777 : Qualys CVE-2016-0778 : Qualys OpenSSH Available for: OS X Mavericks v10.9.5 and OS X Yosemite v10.10.5 Impact: Multiple vulnerabilities in LibreSSL Description: Multiple vulnerabilities existed in LibreSSL versions prior to 2.1.8. These were addressed by updating LibreSSL to version 2.1.8. CVE-ID CVE-2015-5333 : Qualys CVE-2015-5334 : Qualys OpenSSL Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A remote attacker may be able to cause a denial of service Description: A memory leak existed in OpenSSL versions prior to 0.9.8zh. This issue was addressed by updating OpenSSL to version 0.9.8zh. CVE-ID CVE-2015-3195 Python Available for: OS X Mavericks v10.9.5, OS X Yosemite v10.10.5, and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by updating libpng to version 1.6.20. CVE-ID CVE-2014-9495 CVE-2015-0973 CVE-2015-8126 : Adam Mariš CVE-2015-8472 : Adam Mariš QuickTime Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted FlashPix Bitmap Image may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1767 : Francis Provencher from COSIG CVE-2016-1768 : Francis Provencher from COSIG QuickTime Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted Photoshop document may lead to unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1769 : Francis Provencher from COSIG Reminders Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Clicking a tel link can make a call without prompting the user Description: A user was not prompted before invoking a call. This was addressed through improved entitlement checks. CVE-ID CVE-2016-1770 : Guillaume Ross of Rapid7 and Laurent Chouinard of Laurent.ca Ruby Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local attacker may be able to cause unexpected application termination or arbitrary code execution Description: An unsafe tainted string usage vulnerability existed in versions prior to 2.0.0-p648. This issue was addressed by updating to version 2.0.0-p648. CVE-ID CVE-2015-7551 Security Available for: OS X El Capitan v10.11 to v10.11.3 Impact: A local user may be able to check for the existence of arbitrary files Description: A permissions issue existed in code signing tools. This was addressed though additional ownership checks. CVE-ID CVE-2016-1773 : Mark Mentovai of Google Inc. Security Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted certificate may lead to arbitrary code execution Description: A memory corruption issue existed in the ASN.1 decoder. This issue was addressed through improved input validation. CVE-ID CVE-2016-1950 : Francis Gabriel of Quarkslab Tcl Available for: OS X Yosemite v10.10.5 and OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted .png file may lead to arbitrary code execution Description: Multiple vulnerabilities existed in libpng versions prior to 1.6.20. These were addressed by removing libpng. CVE-ID CVE-2015-8126 : Adam Mariš TrueTypeScaler Available for: OS X El Capitan v10.11 to v10.11.3 Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation. CVE-ID CVE-2016-1775 : 0x1byte working with Trend Micro's Zero Day Initiative (ZDI) Wi-Fi Available for: OS X El Capitan v10.11 to v10.11.3 Impact: An attacker with a privileged network position may be able to execute arbitrary code Description: A frame validation and memory corruption issue existed for a given ethertype. This issue was addressed through additional ethertype validation and improved memory handling. CVE-ID CVE-2016-0801 : an anonymous researcher CVE-2016-0802 : an anonymous researcher OS X El Capitan 10.11.4 includes the security content of Safari 9.1. https://support.apple.com/kb/HT206171 OS X El Capitan v10.11.4 and Security Update 2016-002 may be obtained from the Mac App Store or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJW8JQFAAoJEBcWfLTuOo7tZSYP/1bHFA1qemkD37uu7nYpk/q6 ARVsPgME1I1+5tOxX0TQJgzMBmdQsKYdsTiLpDk5HTuv+dAMsFfasaUItGk8Sz1w HiYjSfVsxL+Pjz3vK8/4/fsi2lX6472MElRw8gudITOhXtniGcKo/vuA5dB+vM3l Jy1NLHHhZ6BD2t0bBmlz41mZMG3AMxal2wfqE+5LkjUwASzcvC/3B1sh7Fntwyau /71vIgMQ5AaETdgQJAuQivxPyTlFduBRgLjqvPiB9eSK4Ctu5t/hErFIrP2NiDCi UhfZC48XbiRjJfkUsUD/5TIKnI+jkZxOnch9ny32dw2kUIkbIAbqufTkzsMXOpng O+rI93Ni7nfzgI3EkI2bq+C+arOoRiveWuJvc3SMPD5RQHo4NCQVs0ekQJKNHF78 juPnY29n8WMjwLS6Zfm+bH+n8ELIXrmmEscRztK2efa9S7vJe+AgIxx7JE/f8OHF i9K7UQBXFXcpMjXi1aTby/IUnpL5Ny4NVwYwIhctj0Mf6wTH7uf/FMWYIQOXcIfP Izo+GXxNeLd4H2ypZ+UpkZg/Sn2mtCd88wLc96+owlZPBlSqWl3X1wTlp8i5FP2X qlQ7RcTHJDv8jPT/MOfzxEK1n/azp45ahHA0o6nohUdxlA7PLci9vPiJxqKPo/0q VZmOKa8qMxB1L/JmdCqy =mZR+ -----END PGP SIGNATURE-----

Trust: 2.61

sources: NVD: CVE-2015-8242 // JVNDB: JVNDB-2015-006437 // BID: 77681 // VULHUB: VHN-86203 // VULMON: CVE-2015-8242 // PACKETSTORM: 137101 // PACKETSTORM: 135395 // PACKETSTORM: 136343 // PACKETSTORM: 136342 // PACKETSTORM: 134787 // PACKETSTORM: 136346

AFFECTED PRODUCTS

vendor:redhatmodel:enterprise linux workstationscope:eqversion:6.0

Trust: 1.6

vendor:redhatmodel:enterprise linux hpc nodescope:eqversion:6.0

Trust: 1.6

vendor:redhatmodel:enterprise linux desktopscope:eqversion:6.0

Trust: 1.6

vendor:redhatmodel:enterprise linux serverscope:eqversion:6.0

Trust: 1.6

vendor:hpmodel:icewall federation agentscope:eqversion:3.0

Trust: 1.3

vendor:hpmodel:icewall file managerscope:eqversion:3.0

Trust: 1.3

vendor:canonicalmodel:ubuntu linuxscope:eqversion:15.04

Trust: 1.0

vendor:applemodel:iphone osscope:lteversion:9.2.1

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:12.04

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:14.04

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:15.10

Trust: 1.0

vendor:applemodel:mac os xscope:lteversion:10.11.3

Trust: 1.0

vendor:applemodel:watchosscope:lteversion:2.1

Trust: 1.0

vendor:applemodel:tvosscope:lteversion:9.1

Trust: 1.0

vendor:xmlsoftmodel:libxml2scope:lteversion:2.9.2

Trust: 1.0

vendor:canonicalmodel:ubuntuscope:eqversion:12.04 lts

Trust: 0.8

vendor:canonicalmodel:ubuntuscope:eqversion:14.04 lts

Trust: 0.8

vendor:canonicalmodel:ubuntuscope:eqversion:15.04

Trust: 0.8

vendor:canonicalmodel:ubuntuscope:eqversion:15.10

Trust: 0.8

vendor:xmlsoftmodel:libxml2scope:ltversion:2.9.3

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.10.5

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.11 to 10.11.3

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.9.5

Trust: 0.8

vendor:applemodel:iosscope:ltversion:9.3 (ipad 2 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:9.3 (iphone 4s or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:9.3 (ipod touch first 5 after generation )

Trust: 0.8

vendor:applemodel:tvosscope:ltversion:9.2 (apple tv first 4 generation )

Trust: 0.8

vendor:applemodel:watchosscope:ltversion:2.2 (apple watch edition)

Trust: 0.8

vendor:applemodel:watchosscope:ltversion:2.2 (apple watch hermes)

Trust: 0.8

vendor:applemodel:watchosscope:ltversion:2.2 (apple watch sport)

Trust: 0.8

vendor:applemodel:watchosscope:ltversion:2.2 (apple watch)

Trust: 0.8

vendor:red hatmodel:enterprise linux desktopscope:eqversion:(v. 6)

Trust: 0.8

vendor:red hatmodel:enterprise linux desktopscope:eqversion:(v. 7)

Trust: 0.8

vendor:red hatmodel:enterprise linux hpc nodescope:eqversion:(v. 6)

Trust: 0.8

vendor:red hatmodel:enterprise linux hpc nodescope:eqversion:(v. 7)

Trust: 0.8

vendor:red hatmodel:enterprise linux serverscope:eqversion:(v. 6)

Trust: 0.8

vendor:red hatmodel:enterprise linux serverscope:eqversion:(v. 7)

Trust: 0.8

vendor:red hatmodel:enterprise linux serverscope:eqversion:eus (v. 6.7.z)

Trust: 0.8

vendor:red hatmodel:enterprise linux workstationscope:eqversion:(v. 6)

Trust: 0.8

vendor:red hatmodel:enterprise linux workstationscope:eqversion:(v. 7)

Trust: 0.8

vendor:ibmmodel:infosphere streamsscope:eqversion:3.0.0.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:30

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7

Trust: 0.3

vendor:ibmmodel:informix generoscope:eqversion:2.32

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.2.0.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:watchscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.2.09

Trust: 0.3

vendor:debianmodel:linux armscope:eqversion:6.0

Trust: 0.3

vendor:ibmmodel:streamsscope:eqversion:4.1.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.211

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.11.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:debianmodel:linux ia-64scope:eqversion:6.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.1

Trust: 0.3

vendor:ibmmodel:powerkvmscope:eqversion:2.1

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:2.3.0

Trust: 0.3

vendor:ibmmodel:connections docs ifixscope:neversion:1.0.5002

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11

Trust: 0.3

vendor:ibmmodel:streamsscope:eqversion:4.1

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:neversion:3.2.1.5

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.2.08

Trust: 0.3

vendor:ibmmodel:informix generoscope:eqversion:2.41

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:2.0

Trust: 0.3

vendor:ibmmodel:rational systems testerscope:eqversion:3.3.0.4

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.2.1.4

Trust: 0.3

vendor:ibmmodel:connections docsscope:eqversion:1.0.2

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.214

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fpscope:eqversion:2.4.0.4

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.1.0.4

Trust: 0.3

vendor:xmlsoftmodel:libxml2scope:neversion:2.9.3

Trust: 0.3

vendor:ibmmodel:connections docsscope:eqversion:1.0.5.1

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.2.0.1

Trust: 0.3

vendor:ibmmodel:security network protectionscope:eqversion:5.3.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry fpscope:eqversion:3.19

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.0.0.4

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fpscope:eqversion:3.1.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:ibmmodel:powerkvmscope:eqversion:3.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.1.0.410

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.1.08

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.2.1.3

Trust: 0.3

vendor:ibmmodel:rational systems testerscope:eqversion:3.3.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.2

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:neversion:3.0.0.6

Trust: 0.3

vendor:applemodel:ios betascope:eqversion:8.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fix packscope:eqversion:2.24

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fpscope:eqversion:2.4.0.3

Trust: 0.3

vendor:ibmmodel:rational systems testerscope:eqversion:3.3.0.7

Trust: 0.3

vendor:ibmmodel:rational systems testerscope:eqversion:3.3.0.5

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fixpacscope:eqversion:3.2

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.213

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.1.0.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.3

Trust: 0.3

vendor:applemodel:ios betascope:eqversion:64

Trust: 0.3

vendor:ibmmodel:cognos business intelligencescope:eqversion:10.1.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.219

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:2.0.1

Trust: 0.3

vendor:ibmmodel:powerkvm sp3scope:eqversion:2.1.1

Trust: 0.3

vendor:ibmmodel:powerkvm buildscope:eqversion:2.1.165.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.113

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fiscope:eqversion:2.2.0.4

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fpscope:eqversion:2.3.0.4

Trust: 0.3

vendor:applemodel:tvosscope:eqversion:9.1.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fix packscope:eqversion:3.11

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.1.0.2

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:4.0.1.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:ibmmodel:powerkvm buildscope:neversion:2.1.165.6

Trust: 0.3

vendor:debianmodel:linux sparcscope:eqversion:6.0

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.9.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:40

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:ibmmodel:rational systems tester interim fixscope:neversion:3.3.0.7

Trust: 0.3

vendor:ibmmodel:cognos business intelligencescope:eqversion:10.2.2

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.2.010

Trust: 0.3

vendor:ibmmodel:informix generoscope:eqversion:2.40

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:2.22

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.3.4.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.3

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.110

Trust: 0.3

vendor:ibmmodel:smartcloud entry fixpackscope:eqversion:3.2.0.413

Trust: 0.3

vendor:applemodel:iosscope:neversion:9.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fixpacscope:eqversion:3.1

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.1.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.1

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.2.0.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:ibmmodel:powerkvm buildscope:eqversion:2.1.165.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1

Trust: 0.3

vendor:ibmmodel:connections docs ifixscope:neversion:1.0.7006

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.0.0.0

Trust: 0.3

vendor:ibmmodel:smartcloud entry fpscope:eqversion:3.110

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.1.0.3

Trust: 0.3

vendor:oraclemodel:solarisscope:eqversion:11.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.2

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fix packscope:eqversion:3.21

Trust: 0.3

vendor:ibmmodel:connections docsscope:eqversion:1.0.6

Trust: 0.3

vendor:ibmmodel:informix generoscope:eqversion:2.50

Trust: 0.3

vendor:ibmmodel:powerkvm buildscope:eqversion:2.1.157

Trust: 0.3

vendor:ibmmodel:connections docsscope:eqversion:1.0.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.1

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.2.0.4

Trust: 0.3

vendor:ibmmodel:rational systems tester interim fixscope:eqversion:3.3.0.7

Trust: 0.3

vendor:applemodel:tvscope:eqversion:0

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:1.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.3.1

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:neversion:3.1.0.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:50

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.2

Trust: 0.3

vendor:ibmmodel:powerkvm buildscope:eqversion:3.12

Trust: 0.3

vendor:ibmmodel:connections docsscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.4

Trust: 0.3

vendor:ibmmodel:cognos business intelligencescope:eqversion:10.2.1

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.1.0.6

Trust: 0.3

vendor:applemodel:mac os security updatescope:neversion:x2016-0020

Trust: 0.3

vendor:ibmmodel:powerkvm buildscope:eqversion:2.1.165.5

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.0.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2.1

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:neversion:7.2.0.6

Trust: 0.3

vendor:debianmodel:linux amd64scope:eqversion:6.0

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:4.0.1.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:2.32

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:2.0

Trust: 0.3

vendor:ibmmodel:bigfix security compliance analyticsscope:eqversion:1.7

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.2.1.2

Trust: 0.3

vendor:applemodel:ios betascope:eqversion:4.2

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fix packscope:eqversion:2.44

Trust: 0.3

vendor:ibmmodel:connections docsscope:eqversion:1.0.3

Trust: 0.3

vendor:applemodel:tvosscope:eqversion:9.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fpscope:eqversion:2.3.0.3

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.1.0.5

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.1

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.1.0.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.4

Trust: 0.3

vendor:xmlsoftmodel:libxml2scope:eqversion:2.9.2

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:watchosscope:neversion:2.2

Trust: 0.3

vendor:ibmmodel:smartcloud entry fixpackscope:eqversion:3.2.0.415

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:2.4.0

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fix packscope:eqversion:2.34

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fpscope:eqversion:2.2.0.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:ibmmodel:smartcloud entry fixpackscope:eqversion:3.1.0.415

Trust: 0.3

vendor:ibmmodel:cognos business intelligencescope:eqversion:8.4.1

Trust: 0.3

vendor:debianmodel:linux ia-32scope:eqversion:6.0

Trust: 0.3

vendor:oraclemodel:solaris sruscope:neversion:11.35.6

Trust: 0.3

vendor:debianmodel:linux mipsscope:eqversion:6.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.1

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.2.0.0

Trust: 0.3

vendor:ibmmodel:smartcloud entry fixpackscope:eqversion:3.1.0.412

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.0.0.5

Trust: 0.3

vendor:ibmmodel:informix generoscope:eqversion:2.30

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.1.0.3

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.0

Trust: 0.3

vendor:ibmmodel:cognos business intelligencescope:eqversion:10.2.1.1

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:1.0

Trust: 0.3

vendor:applemodel:tvosscope:neversion:9.2

Trust: 0.3

vendor:ibmmodel:cognos business intelligencescope:eqversion:10.1

Trust: 0.3

vendor:applemodel:ios for developerscope:eqversion:6

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fiscope:eqversion:2.4.0.4

Trust: 0.3

vendor:oraclemodel:linuxscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.2.1.1

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.3.3.0

Trust: 0.3

vendor:ibmmodel:cognos business intelligencescope:eqversion:10.2

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:2.2

Trust: 0.3

vendor:ibmmodel:powerkvm buildscope:neversion:3.13

Trust: 0.3

vendor:ibmmodel:connections docsscope:eqversion:1.0.5

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:2.21

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.1.09

Trust: 0.3

vendor:debianmodel:linux s/390scope:eqversion:6.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:ibmmodel:datapower gatewaysscope:eqversion:7.2.0.2

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fpscope:eqversion:3.2.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2

Trust: 0.3

vendor:ibmmodel:connections docsscope:eqversion:1.0.4

Trust: 0.3

vendor:debianmodel:linux powerpcscope:eqversion:6.0

Trust: 0.3

vendor:applemodel:watchosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:ibmmodel:security network protectionscope:eqversion:5.3.2

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:2.31

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.0.0.1

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.218

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.1.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:neversion:4.0.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1

Trust: 0.3

vendor:ibmmodel:connections docs ifixscope:neversion:1.0.6003

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:2.42

Trust: 0.3

vendor:ibmmodel:rational systems testerscope:eqversion:3.3.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:ibmmodel:flex system managerscope:eqversion:1.3.20

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:ibmmodel:connections docs ifixscope:neversion:2.0002

Trust: 0.3

vendor:ibmmodel:smartcloud entryscope:eqversion:3.1

Trust: 0.3

vendor:ibmmodel:rational systems testerscope:eqversion:3.3.0.3

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fiscope:eqversion:2.3.0.4

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:2.0.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:3.2.0.411

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.1.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:3.2.1

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:1.2.1.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.3

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fpscope:eqversion:2.2.0.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:4.0.1

Trust: 0.3

vendor:ibmmodel:powerkvm buildscope:eqversion:2.1.158

Trust: 0.3

vendor:ibmmodel:smartcloud entry appliance fpscope:eqversion:2.4.0.5

Trust: 0.3

vendor:ibmmodel:smartcloud entry fix packscope:eqversion:2.4.01

Trust: 0.3

vendor:applemodel:tvosscope:eqversion:9.0

Trust: 0.3

vendor:ibmmodel:infosphere streamsscope:eqversion:1.2.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.10.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.1

Trust: 0.3

sources: BID: 77681 // JVNDB: JVNDB-2015-006437 // CNNVD: CNNVD-201512-325 // NVD: CVE-2015-8242

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-8242
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-8242
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201512-325
value: MEDIUM

Trust: 0.6

VULHUB: VHN-86203
value: MEDIUM

Trust: 0.1

VULMON: CVE-2015-8242
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-8242
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-86203
severity: MEDIUM
baseScore: 5.8
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-86203 // VULMON: CVE-2015-8242 // JVNDB: JVNDB-2015-006437 // CNNVD: CNNVD-201512-325 // NVD: CVE-2015-8242

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-86203 // JVNDB: JVNDB-2015-006437 // NVD: CVE-2015-8242

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201512-325

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201512-325

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-006437

PATCH

title:APPLE-SA-2016-03-21-1 iOS 9.3url:http://lists.apple.com/archives/security-announce/2016/Mar/msg00000.html

Trust: 0.8

title:APPLE-SA-2016-03-21-2 watchOS 2.2url:http://lists.apple.com/archives/security-announce/2016/Mar/msg00001.html

Trust: 0.8

title:APPLE-SA-2016-03-21-3 tvOS 9.2url:http://lists.apple.com/archives/security-announce/2016/Mar/msg00002.html

Trust: 0.8

title:APPLE-SA-2016-03-21-5 OS X El Capitan 10.11.4 and Security Update 2016-002url:http://lists.apple.com/archives/security-announce/2016/Mar/msg00004.html

Trust: 0.8

title:HT206168url:https://support.apple.com/en-us/HT206168

Trust: 0.8

title:HT206169url:https://support.apple.com/en-us/HT206169

Trust: 0.8

title:HT206166url:https://support.apple.com/en-us/HT206166

Trust: 0.8

title:HT206167url:https://support.apple.com/en-us/HT206167

Trust: 0.8

title:HT206166url:https://support.apple.com/ja-jp/HT206166

Trust: 0.8

title:HT206167url:https://support.apple.com/ja-jp/HT206167

Trust: 0.8

title:HT206168url:https://support.apple.com/ja-jp/HT206168

Trust: 0.8

title:HT206169url:https://support.apple.com/ja-jp/HT206169

Trust: 0.8

title:Bug 756372url:https://bugzilla.gnome.org/show_bug.cgi?id=756372

Trust: 0.8

title:CVE-2015-8242 Buffer overead with HTML parser in push modeurl:https://git.gnome.org/browse/libxml2/commit/?id=8fb4a770075628d6441fb17a1e435100e2f3b1a2

Trust: 0.8

title:Bug 1281950url:https://bugzilla.redhat.com/show_bug.cgi?id=1281950

Trust: 0.8

title:RHSA-2015:2550url:https://rhn.redhat.com/errata/RHSA-2015-2550.html

Trust: 0.8

title:RHSA-2015:2549url:https://rhn.redhat.com/errata/RHSA-2015-2549.html

Trust: 0.8

title:TLSA-2016-3url:http://www.turbolinux.co.jp/security/2016/TLSA-2016-3j.html

Trust: 0.8

title:USN-2834-1url:http://www.ubuntu.com/usn/USN-2834-1

Trust: 0.8

title:v2.9.3: Nov 20 2015url:http://xmlsoft.org/news.html

Trust: 0.8

title:libxml2 Repair measures for information disclosure vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=59143

Trust: 0.6

title:Debian CVElist Bug Report Logs: libxml2: CVE-2015-8242: Buffer overead with HTML parser in push mode in xmlSAX2TextNode, causes segfault when compiled with ASANurl:https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=e9d573f68f13e3e7b1fd6aef1a83d902

Trust: 0.1

title:Red Hat: Moderate: libxml2 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20152549 - Security Advisory

Trust: 0.1

title:Red Hat: Moderate: libxml2 security updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20152550 - Security Advisory

Trust: 0.1

title:Red Hat: CVE-2015-8242url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2015-8242

Trust: 0.1

title:Ubuntu Security Notice: libxml2 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-2834-1

Trust: 0.1

title:Apple: tvOS 9.2url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=ce338ecd7a3c82e55bcf20e44e532eea

Trust: 0.1

title:Apple: watchOS 2.2url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=0cbe3084baf2e465ecd2cc68ad686a9a

Trust: 0.1

title:Apple: iOS 9.3url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=3ae8bd7fcbbf51e9c7fe356687ecd0cf

Trust: 0.1

title:Amazon Linux AMI: ALAS-2015-628url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2015-628

Trust: 0.1

title:Apple: OS X El Capitan v10.11.4 and Security Update 2016-002url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=ef054ba76412200e34091eb91c38c281

Trust: 0.1

title:Amazon Linux 2: ALAS2-2019-1220url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2-2019-1220

Trust: 0.1

title:Oracle Linux Bulletins: Oracle Linux Bulletin - October 2015url:https://vulmon.com/vendoradvisory?qidtp=oracle_linux_bulletins&qid=435ed9abc2fb1e74ce2a69605a01e326

Trust: 0.1

title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - January 2016url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=eb439566c9130adc92d21bc093204cf8

Trust: 0.1

title:afl-cveurl:https://github.com/mrash/afl-cve

Trust: 0.1

sources: VULMON: CVE-2015-8242 // JVNDB: JVNDB-2015-006437 // CNNVD: CNNVD-201512-325

EXTERNAL IDS

db:NVDid:CVE-2015-8242

Trust: 3.5

db:BIDid:77681

Trust: 2.1

db:OPENWALLid:OSS-SECURITY/2015/11/17/5

Trust: 1.8

db:OPENWALLid:OSS-SECURITY/2015/11/18/23

Trust: 1.8

db:SECTRACKid:1034243

Trust: 1.8

db:JVNid:JVNVU97668313

Trust: 0.8

db:JVNDBid:JVNDB-2015-006437

Trust: 0.8

db:CNNVDid:CNNVD-201512-325

Trust: 0.7

db:AUSCERTid:ESB-2023.3732

Trust: 0.6

db:VULHUBid:VHN-86203

Trust: 0.1

db:VULMONid:CVE-2015-8242

Trust: 0.1

db:PACKETSTORMid:137101

Trust: 0.1

db:PACKETSTORMid:135395

Trust: 0.1

db:PACKETSTORMid:136343

Trust: 0.1

db:PACKETSTORMid:136342

Trust: 0.1

db:PACKETSTORMid:134787

Trust: 0.1

db:PACKETSTORMid:136346

Trust: 0.1

sources: VULHUB: VHN-86203 // VULMON: CVE-2015-8242 // BID: 77681 // JVNDB: JVNDB-2015-006437 // PACKETSTORM: 137101 // PACKETSTORM: 135395 // PACKETSTORM: 136343 // PACKETSTORM: 136342 // PACKETSTORM: 134787 // PACKETSTORM: 136346 // CNNVD: CNNVD-201512-325 // NVD: CVE-2015-8242

REFERENCES

url:http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Trust: 2.1

url:http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Trust: 2.1

url:https://bugzilla.gnome.org/show_bug.cgi?id=756372

Trust: 2.1

url:https://bugzilla.redhat.com/show_bug.cgi?id=1281950

Trust: 2.1

url:https://git.gnome.org/browse/libxml2/commit/?id=8fb4a770075628d6441fb17a1e435100e2f3b1a2

Trust: 2.1

url:http://www.securityfocus.com/bid/77681

Trust: 1.9

url:http://rhn.redhat.com/errata/rhsa-2016-1089.html

Trust: 1.9

url:http://www.ubuntu.com/usn/usn-2834-1

Trust: 1.9

url:http://lists.apple.com/archives/security-announce/2016/mar/msg00000.html

Trust: 1.8

url:http://lists.apple.com/archives/security-announce/2016/mar/msg00001.html

Trust: 1.8

url:http://lists.apple.com/archives/security-announce/2016/mar/msg00002.html

Trust: 1.8

url:http://lists.apple.com/archives/security-announce/2016/mar/msg00004.html

Trust: 1.8

url:http://xmlsoft.org/news.html

Trust: 1.8

url:https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c04944172

Trust: 1.8

url:https://support.apple.com/ht206166

Trust: 1.8

url:https://support.apple.com/ht206167

Trust: 1.8

url:https://support.apple.com/ht206168

Trust: 1.8

url:https://support.apple.com/ht206169

Trust: 1.8

url:https://security.gentoo.org/glsa/201701-37

Trust: 1.8

url:http://www.openwall.com/lists/oss-security/2015/11/17/5

Trust: 1.8

url:http://www.openwall.com/lists/oss-security/2015/11/18/23

Trust: 1.8

url:http://rhn.redhat.com/errata/rhsa-2015-2549.html

Trust: 1.8

url:http://rhn.redhat.com/errata/rhsa-2015-2550.html

Trust: 1.8

url:http://www.securitytracker.com/id/1034243

Trust: 1.8

url:http://lists.opensuse.org/opensuse-updates/2015-12/msg00120.html

Trust: 1.8

url:http://lists.opensuse.org/opensuse-updates/2016-01/msg00031.html

Trust: 1.8

url:http://marc.info/?l=bugtraq&m=145382616617563&w=2

Trust: 1.7

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-8242

Trust: 0.8

url:http://jvn.jp/vu/jvnvu97668313/index.html

Trust: 0.8

url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-8242

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2015-7499

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2015-8242

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2015-5312

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2015-7500

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2023.3732

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2015-7942

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2015-8035

Trust: 0.4

url:https://bugzilla.gnome.org/show_bug.cgi?id=751603

Trust: 0.3

url:https://bugzilla.gnome.org/show_bug.cgi?id=751631

Trust: 0.3

url:https://bugzilla.gnome.org/show_bug.cgi?id=752191

Trust: 0.3

url:https://git.gnome.org/browse/libxml2/commit/?id=9aa37588ee78a06ca1379a9d9356eab16686099c

Trust: 0.3

url:https://git.gnome.org/browse/libxml2/commit/?id=709a952110e98621c9b78c4f26462a9d8333102e

Trust: 0.3

url:https://blog.fuzzing-project.org/28-libxml2-several-out-of-bounds-reads.html

Trust: 0.3

url:https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c04944172

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=isg3t1023350

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=isg3t1023873

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=isg3t1023983

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21972720

Trust: 0.3

url:https://www-304.ibm.com/support/docview.wss?rs=630&uid=swg21973201

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21975225

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21975975

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21979515

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21979767

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21982607

Trust: 0.3

url:http://www-01.ibm.com/support/docview.wss?uid=swg21983370

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-7498

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-8241

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-7497

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-8317

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-8659

Trust: 0.3

url:https://gpgtools.org

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2015-1819

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-0801

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-1740

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2016-0802

Trust: 0.3

url:https://access.redhat.com/security/cve/cve-2015-8242

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2015-7941

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-1751

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-1753

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-1750

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-1752

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-1754

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-1748

Trust: 0.2

url:https://support.apple.com/kb/ht201222

Trust: 0.2

url:https://www.apple.com/support/security/pgp/

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2016-1734

Trust: 0.2

url:http://marc.info/?l=bugtraq&amp;m=145382616617563&amp;w=2

Trust: 0.1

url:https://cwe.mitre.org/data/definitions/119.html

Trust: 0.1

url:https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=805146

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://usn.ubuntu.com/2834-1/

Trust: 0.1

url:https://issues.jboss.org/):

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-0763

Trust: 0.1

url:https://access.redhat.com/documentation/en-us/red_hat_jboss_web_server/3/html-single/3.0.3_release_notes/index.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-0706

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-5345

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-0714

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-7941

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-8241

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-0209

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-7942

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-5346

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-5312

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2016-0714

Trust: 0.1

url:https://access.redhat.com/security/team/contact/

Trust: 0.1

url:https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-7500

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-0209

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-8710

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-7499

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-5351

Trust: 0.1

url:https://bugzilla.redhat.com/):

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2016-0706

Trust: 0.1

url:https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product=webserver&version=3.0.3

Trust: 0.1

url:https://access.redhat.com/security/updates/classification/#moderate

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-7497

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-8317

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-7498

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-8035

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-8710

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-5346

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-5351

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2015-5345

Trust: 0.1

url:https://access.redhat.com/security/cve/cve-2016-0763

Trust: 0.1

url:https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_n

Trust: 0.1

url:http://www.hpe.com/support/security_bulletin_archive

Trust: 0.1

url:http://www.hpe.com/support/subscriber_choice

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-7995

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1725

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1727

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1720

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1726

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1724

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1721

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1723

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1722

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1717

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1719

Trust: 0.1

url:https://www.apple.com/itunes/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1755

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1756

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1757

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1760

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1766

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1761

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1758

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1763

Trust: 0.1

url:http://www.tencent.com)

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1762

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1775

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/libxml2/2.9.2+dfsg1-3ubuntu0.2

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/libxml2/2.9.1+dfsg1-3ubuntu4.6

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/libxml2/2.7.8.dfsg-5.1ubuntu4.13

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/libxml2/2.9.2+zdfsg1-4ubuntu0.2

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-7551

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-0777

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-8472

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-3195

Trust: 0.1

url:http://www.apple.com/support/downloads/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-8126

Trust: 0.1

url:https://support.apple.com/kb/ht206171

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1732

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-9495

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-5334

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1733

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1736

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1735

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-0778

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-5333

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1738

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2016-1737

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-0973

Trust: 0.1

sources: VULHUB: VHN-86203 // VULMON: CVE-2015-8242 // BID: 77681 // JVNDB: JVNDB-2015-006437 // PACKETSTORM: 137101 // PACKETSTORM: 135395 // PACKETSTORM: 136343 // PACKETSTORM: 136342 // PACKETSTORM: 134787 // PACKETSTORM: 136346 // CNNVD: CNNVD-201512-325 // NVD: CVE-2015-8242

CREDITS

Hanno B?ck

Trust: 0.6

sources: CNNVD: CNNVD-201512-325

SOURCES

db:VULHUBid:VHN-86203
db:VULMONid:CVE-2015-8242
db:BIDid:77681
db:JVNDBid:JVNDB-2015-006437
db:PACKETSTORMid:137101
db:PACKETSTORMid:135395
db:PACKETSTORMid:136343
db:PACKETSTORMid:136342
db:PACKETSTORMid:134787
db:PACKETSTORMid:136346
db:CNNVDid:CNNVD-201512-325
db:NVDid:CVE-2015-8242

LAST UPDATE DATE

2024-11-20T20:11:01.150000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-86203date:2019-03-08T00:00:00
db:VULMONid:CVE-2015-8242date:2019-03-08T00:00:00
db:BIDid:77681date:2016-07-22T20:00:00
db:JVNDBid:JVNDB-2015-006437date:2016-03-29T00:00:00
db:CNNVDid:CNNVD-201512-325date:2023-06-30T00:00:00
db:NVDid:CVE-2015-8242date:2019-03-08T16:06:36.980

SOURCES RELEASE DATE

db:VULHUBid:VHN-86203date:2015-12-15T00:00:00
db:VULMONid:CVE-2015-8242date:2015-12-15T00:00:00
db:BIDid:77681date:2015-11-22T00:00:00
db:JVNDBid:JVNDB-2015-006437date:2015-12-18T00:00:00
db:PACKETSTORMid:137101date:2016-05-17T23:47:44
db:PACKETSTORMid:135395date:2016-01-26T17:27:00
db:PACKETSTORMid:136343date:2016-03-22T15:09:54
db:PACKETSTORMid:136342date:2016-03-22T15:05:15
db:PACKETSTORMid:134787date:2015-12-14T16:40:43
db:PACKETSTORMid:136346date:2016-03-22T15:18:02
db:CNNVDid:CNNVD-201512-325date:2015-11-22T00:00:00
db:NVDid:CVE-2015-8242date:2015-12-15T21:59:07.387