Oracle Solaris Third Party Bulletin - April 2015
Description
The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities fixed in third party software that is included in Oracle Solaris distributions. Starting January 20, 2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Updates are released. These bulletins will also be updated on the Tuesday closest to the 17th of the following two months after their release (i.e. the two months between the normal quarterly Critical Patch Update publication dates). In addition, Third Party Bulletins may also be updated for vulnerability fixes deemed too critical to wait for the next monthly update.
Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Third Party Bulletin fixes as soon as possible.
Patch Availability
Please see My Oracle Support Note 1448883.1
Third Party Bulletin Schedule
Third Party Bulletins are released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:
- 14 July 2015
- 20 October 2015
- 19 January 2016
- 19 April 2016
References
- Oracle Critical Patch Updates and Security Alerts main page [ Oracle Technology Network ]
- Oracle Critical Patch Updates and Security Alerts - Frequently Asked Questions [ CPU FAQ ]
- Risk Matrix definitions [ Risk Matrix Definitions ]
- Use of Common Vulnerability Scoring System (CVSS) by Oracle [ Oracle CVSS Scoring ]
Modification History
| 2015-April-14 | Rev 1. Initial Release |
| 2015-May-15 | Rev 2. Added Multiple CVEs |
| 2015-June-15 | Rev 3. Added Multiple CVEs |
Oracle Solaris Executive Summary
This Third Party Bulletin contains 44 new security fixes for the Oracle Solaris. 30 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.
Oracle Solaris Risk Matrix
Revision 3: Published on 2015-06-15
| CVE# | Product | Protocol | Third Party component |
Remote Exploit without Auth.? | CVSS VERSION 2.0 RISK (see Risk Matrix Definitions) | Supported Versions Affected | Notes | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Base Score | Access Vector | Access Complexity | Authentication | Confidentiality | Integrity | Availability | |||||||
| CVE-2015-0801 | Solaris | Multiple | Firefox | Yes | 7.5 | Network | Low | None | Partial | Partial | Partial | 11.2 | See Note 11 |
| CVE-2014-4617 | Solaris | Multiple | GnuPG | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.2 | |
| CVE-2011-4091 | Solaris | Multiple | Net6: C++ networking library | Yes | 5.0 | Network | Low | None | Partial | None | None | 11.2 | See Note 6 |
| CVE-2014-3695 | Solaris | Multiple | vino | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.2 | |
| CVE-2014-3696 | Solaris | Multiple | vino | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.2 | |
| CVE-2014-3698 | Solaris | Multiple | vino | Yes | 5.0 | Network | Low | None | Partial | None | None | 11.2 | |
| CVE-2014-9709 | Solaris | Multiple | GD2 Graphics Draw Library | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.2 | |
| CVE-2015-3811 | Solaris | Multiple | Wireshark | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.2 | See Note 12 |
| CVE-2014-3694 | Solaris | Multiple | vino | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.2 | |
| CVE-2013-0308 | Solaris | Multiple | Git | Yes | 4.3 | Network | Medium | None | None | Partial | None | 11.2 | |
| CVE-2015-2774 | Solaris | Multiple | Erlang | Yes | 4.3 | Network | Medium | None | Partial | None | None | 11.2 | |
| CVE-2014-8092 | Solaris | Multiple | X.Org | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.2, 10 | See Note 10 |
| CVE-2015-3646 | Solaris | Multiple | OpenStack Identity (Keystone) | No | 3.5 | Network | Medium | Single | Partial | None | None | 11.2 | |
| CVE-2013-1569 | Solaris | None | Localization (L10N) | No | 1.5 | Local | Medium | Single | None | None | Partial | 11.2 | See Note 7 |
| CVE-2015-1205 | Solaris | None | Localization (L10N) | No | 1.0 | Local | High | Single | None | None | Partial | 11.2 | See Note 9 |
| CVE-2014-7926 | Solaris | None | Localization (L10N) | No | 1.0 | Local | High | Single | None | None | Partial | 11.2 | |
| CVE-2014-7923 | Solaris | None | Localization (L10N) | No | 1.0 | Local | High | Single | None | None | Partial | 11.2 | |
| CVE-2014-7940 | Solaris | None | Localization (L10N) | No | 1.0 | Local | High | Single | None | None | Partial | 11.2 | |
| CVE-2014-6591 | Solaris | None | Localization (L10N) | No | 1.0 | Local | High | Single | Partial | None | None | 11.2 | See Note 8 |
Revision 2: Published on 2015-05-15
| CVE# | Product | Protocol | Third Party component |
Remote Exploit without Auth.? | CVSS VERSION 2.0 RISK (see Risk Matrix Definitions) | Supported Versions Affected | Notes | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Base Score | Access Vector | Access Complexity | Authentication | Confidentiality | Integrity | Availability | |||||||
| CVE-2014-3158 | Solaris | Multiple | Point-to-Point Protocol service | Yes | 7.5 | Network | Low | None | Partial | Partial | Partial | 11.2 | |
| CVE-2014-9663 | Solaris | Multiple | FreeType | Yes | 7.5 | Network | Low | None | Partial | Partial | Partial | 11.2, 10 | See Note 5 |
| CVE-2015-1195 | Solaris | Multiple | OpenStack Glance | No | 6.5 | Network | Low | Single | Partial | Partial | Partial | 11.2 | |
| CVE-2015-1856 | Solaris | Multiple | OpenStack Object Storage (Swift) | No | 5.5 | Network | Low | Single | None | Partial | Partial | 11.2 | |
| CVE-2015-1799 | Solaris | NTP | NTP | No | 5.4 | Adjacent Network | Medium | None | Partial | Partial | Partial | 11.2, 10 | |
| CVE-2014-0227 | Solaris | Multiple | Apache Tomcat | Yes | 5.1 | Network | High | None | Partial | Partial | Partial | 11.2 | |
| CVE-2014-3566 | Solaris | Multiple | Apache Tomcat | Yes | 5.0 | Network | Low | None | Partial | None | None | 11.2 | |
| CVE-2014-9636 | Solaris | Multiple | Unzip | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.2, 10 | |
| CVE-2015-3405 | Solaris | NTP | NTP | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.2, 10 | |
| CVE-2015-2316 | Solaris | Multiple | Django Python web framework | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.2 | |
| CVE-2015-1852 | Solaris | Multiple | Middleware for OpenStack Identity | Yes | 4.3 | Network | Medium | None | None | Partial | None | 11.2 | |
| CVE-2015-1852 | Solaris | Multiple | OpenStack Identity (Keystone) | Yes | 4.3 | Network | Medium | None | None | Partial | None | 11.2 | |
| CVE-2014-9390 | Solaris | Multiple | Mercurial source code management | Yes | 4.0 | Network | High | None | Partial | Partial | None | 11.2 | |
| CVE-2015-2317 | Solaris | Multiple | Django Python web framework | Yes | 2.6 | Network | High | None | None | Partial | None | 11.2 | |
| CVE-2015-1798 | Solaris | NTP | NTP | Yes | 2.6 | Network | High | None | None | None | Partial | 11.2, 10 | |
Revision 1: Published on 2015-04-14
| CVE# | Product | Protocol | Third Party component |
Remote Exploit without Auth.? | CVSS VERSION 2.0 RISK (see Risk Matrix Definitions) | Supported Versions Affected | Notes | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Base Score | Access Vector | Access Complexity | Authentication | Confidentiality | Integrity | Availability | |||||||
| CVE-2015-1802 | Solaris | TCP | X.Org | No | 8.5 | Network | Medium | Single | Complete | Complete | Complete | 11.2, 10 | See Note 1 |
| CVE-2015-0292 | Solaris | SSL/TLS | WAN Boot | Yes | 7.5 | Network | Low | None | Partial | Partial | Partial | 11.2 | See Note 3 |
| CVE-2014-3566 | Solaris | SSL | Java Web Console | Yes | 5.0 | Network | Low | None | Partial | None | None | 11.2 | |
| CVE-2015-2188 | Solaris | Multiple | Wireshark | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.2 | See Note 2 |
| CVE-2014-0339 | Solaris | HTTP | Java Web Console | Yes | 4.3 | Network | Medium | None | None | Partial | None | 11.2 | |
| CVE-2014-3924 | Solaris | HTTP | Java Web Console | Yes | 4.3 | Network | Medium | None | None | Partial | None | 11.2 | See Note 4 |
| CVE-2014-9623 | Solaris | Multiple | OpenStack Glance | No | 4.0 | Network | Low | Single | None | None | Partial | 11.2 | |
| CVE-2014-5353 | Solaris | Multiple | Kerberos | No | 3.5 | Network | Medium | Single | None | None | Partial | 11.2, 10 | |
| CVE-2015-0255 | Solaris | None | X.Org | No | 3.2 | Local | Low | Single | Partial | None | Partial | 11.2, 10 | |
| CVE-2014-9297 | Solaris | NTP | NTP | Yes | 2.6 | Network | High | None | Partial | None | None | 11.2, 10 | |
Notes:
- This fix also addresses CVE-2015-1803 CVE-2015-1804.
- This fix also addresses CVE-2015-2189 CVE-2015-2190.
- This fix also addresses CVE-2015-0290 CVE-2015-0291 CVE-2015-0288 CVE-2015-1787 CVE-2015-0207 CVE-2015-0293 CVE-2015-0208 CVE-2015-0285 CVE-2015-0286 CVE-2015-0209 CVE-2015-0287 CVE-2015-0204 CVE-2015-0289.
- This fix also addresses CVE-2014-3884 CVE-2014-3886.
- This fix also addresses CVE-2014-9656 CVE-2014-9657 CVE-2014-9658 CVE-2014-9659 CVE-2014-9660 CVE-2014-9661 CVE-2014-9664 CVE-2014-9666 CVE-2014-9667 CVE-2014-9669 CVE-2014-9670 CVE-2014-9671 CVE-2014-9672 CVE-2014-9673 CVE-2014-9674 CVE-2014-9675.
- This fix also addresses CVE-2011-4093.
- This fix also addresses CVE-2013-2383 CVE-2013-2384 CVE-2013-2419.
- This fix also addresses CVE-2014-6511 CVE-2014-6585.
- This fix also addresses CVE-2014-9654.
- This fix also addresses CVE-2015-3418.
- This fix also addresses CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1583 CVE-2014-1585 CVE-2014-1586 CVE-2014-1587 CVE-2014-1590 CVE-2014-1592 CVE-2014-1593 CVE-2014-1594 CVE-2014-8634 CVE-2014-8638 CVE-2014-8639 CVE-2014-8641 CVE-2015-0807 CVE-2015-0813 CVE-2015-0815 CVE-2015-0816 CVE-2015-0817 CVE-2015-0818 CVE-2015-0822 CVE-2015-0827 CVE-2015-0831 CVE-2015-0836.
- This fix also addresses CVE-2015-3812 CVE-2015-3814.