Oracle Linux Bulletin - April 2016 - Oracle CVRF Oracle Linux Bulletin Advisory OLBulletinApr2016 Final 3.0 1.0 2016-04-19T13:00:00-07:00 Initial Distribution 2.0 2016-05-19T13:00:00-07:00 New CVEs added. 3.0 2016-06-20T13:00:00-07:00 New CVEs added. This document contains descriptions of Oracle Linux security vulnerabilities which have had fixes released for all supported versions and platforms. http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html URL to html version of Advisory Oracle Linux 5 Oracle Linux 6 Oracle Linux 7 This is a vulnerability in samba and samba4 in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 8.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C. Fix has been released CVE-2015-5370 P-1309V-6 P-1309V-7 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0612.html P-1309V-6 P-1309V-7 This is a vulnerability in samba in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 8.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C. Fix has been released CVE-2015-5370 P-1309V-6 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0611.html P-1309V-6 This is a vulnerability in samba3x in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 8.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C. Fix has been released CVE-2015-5370 P-1309V-5 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0613.html P-1309V-5 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 7.2 CVSS V2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-0758 P-1309V-6 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3559.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 7.2 CVSS V2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-0758 P-1309V-7 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1033.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 7.2 CVSS V2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-0758 P-1309V-7 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3565.html P-1309V-7 This is a vulnerability in ImageMagick in Oracle Linux. The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1allows remote attackers to read arbitrary files via a crafted image. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:C/I:N/A:N. Fix has been released CVE-2016-3717 P-1309V-6 P-1309V-7 7.1 AV:N/AC:M/Au:N/C:C/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0726.html P-1309V-6 P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does notproperly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2015-8767 P-1309V-6 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3554.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does notproperly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2015-8767 P-1309V-6 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0715.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does notproperly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2015-8767 P-1309V-7 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3551.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does notproperly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2015-8767 P-1309V-5 P-1309V-6 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3552.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does notproperly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2015-8767 P-1309V-5 P-1309V-6 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3553.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4565 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3570.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4565 P-1309V-5 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3572.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4565 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3573.html P-1309V-7 This is a vulnerability in ImageMagick in Oracle Linux. The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW,(7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code via shell metacharacters in a crafted image, aka ImageTragick. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3714 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0726.html P-1309V-6 P-1309V-7 This is a vulnerability in ImageMagick in Oracle Linux. The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 andImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5118 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1237.html P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Unspecified vulnerability in the browser engine in Mozilla Firefox ESR38.x before 38.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2805 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0695.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2806 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0695.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Multiple unspecified vulnerabilities in the browser engine in MozillaFirefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2807 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0695.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2818 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1217.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2819 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1217.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in foomatic in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2010-5325 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0491.html P-1309V-6 This is a vulnerability in git in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2315 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0496.html P-1309V-6 P-1309V-7 This is a vulnerability in git in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2324 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0496.html P-1309V-6 P-1309V-7 This is a vulnerability in graphite2 in Oracle Linux. The directrun function in directmachine.cpp in Libgraphite in Graphite2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not validate a certain skip operation, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1521 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0594.html P-1309V-7 This is a vulnerability in graphite2 in Oracle Linux. Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in MozillaFirefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not consider recursive load calls during a size check, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly execute arbitrary code via a crafted Graphite smart font. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1522 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0594.html P-1309V-7 This is a vulnerability in graphite2 in Oracle Linux. The SillMap::readFace function in FeatureMap.cpp in Libgraphite inGraphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, mishandles a return value, which allows remote attackers to cause a denial of service (missing initialization, NULL pointer dereference, and application crash) via a crafted Graphite smart font. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1523 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0594.html P-1309V-7 This is a vulnerability in java-1.6.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 andJava SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0686 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0723.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.6.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 andJava SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0687 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0723.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.6.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3427 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0723.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0636 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0511.html P-1309V-6 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0636 P-1309V-5 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0512.html P-1309V-5 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 andJava SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0686 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0675.html P-1309V-6 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 andJava SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0686 P-1309V-5 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0676.html P-1309V-5 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 andJava SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0687 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0675.html P-1309V-6 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 andJava SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0687 P-1309V-5 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0676.html P-1309V-5 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3427 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0675.html P-1309V-6 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3427 P-1309V-5 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0676.html P-1309V-5 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0636 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0513.html P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0636 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0514.html P-1309V-6 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 andJava SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0686 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0650.html P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 andJava SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0686 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0651.html P-1309V-6 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 andJava SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0687 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0650.html P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 andJava SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0687 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0651.html P-1309V-6 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3427 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0650.html P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3427 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0651.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. The virtnet_probe function in drivers/net/virtio_net.c in the Linuxkernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets. CVSS Base Score: 6.8 CVSS V2 Vector: AV:A/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2015-5156 P-1309V-6 6.8 AV:A/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0855.html P-1309V-6 This is a vulnerability in mercurial in Oracle Linux. Mercurial before 3.7.3 allows remote attackers to execute arbitrarycode via a crafted git ext:: URL when cloning a subrepository. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3068 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0706.html P-1309V-7 This is a vulnerability in pcre in Oracle Linux. PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern andrelated patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-8385 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1025.html P-1309V-7 This is a vulnerability in pcre in Oracle Linux. The compile_branch function in pcre_compile.c in PCRE 8.x before 8.39and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring in conjunction with nested parentheses, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3191 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1025.html P-1309V-7 This is a vulnerability in samba and samba4 in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2118 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0612.html P-1309V-6 P-1309V-7 This is a vulnerability in samba in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2118 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0611.html P-1309V-6 This is a vulnerability in samba in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2118 P-1309V-5 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0621.html P-1309V-5 This is a vulnerability in samba3x in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2118 P-1309V-5 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0613.html P-1309V-5 This is a vulnerability in spice in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0749 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1205.html P-1309V-7 This is a vulnerability in spice-server in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0749 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1204.html P-1309V-6 This is a vulnerability in thunderbird in Oracle Linux. Unspecified vulnerability in the browser engine in Mozilla Firefox ESR38.x before 38.8 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2805 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1041.html P-1309V-6 P-1309V-7 This is a vulnerability in thunderbird in Oracle Linux. Multiple unspecified vulnerabilities in the browser engine in MozillaFirefox before 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2807 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1041.html P-1309V-6 P-1309V-7 This is a vulnerability in qemu-kvm in Oracle Linux. The VGA module in QEMU improperly performs bounds checking on bankedaccess to video memory, which allows local guest OS users to execute arbitrary code on the host by changing access modes after setting the bank register, aka the Dark CVSS Base Score: 6.5 CVSS V2 Vector: AV:A/AC:H/Au:S/C:C/I:C/A:C. Fix has been released CVE-2016-3710 P-1309V-7 6.5 AV:A/AC:H/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0724.html P-1309V-7 This is a vulnerability in qemu-kvm in Oracle Linux. The VGA module in QEMU improperly performs bounds checking on bankedaccess to video memory, which allows local guest OS users to execute arbitrary code on the host by changing access modes after setting the bank register, aka the Dark CVSS Base Score: 6.5 CVSS V2 Vector: AV:A/AC:H/Au:S/C:C/I:C/A:C. Fix has been released CVE-2016-3710 P-1309V-6 6.5 AV:A/AC:H/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0997.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.4 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-1548 P-1309V-6 P-1309V-7 6.4 AV:N/AC:L/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1141.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on thex86_64 platform mishandles IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI. CVSS Base Score: 6.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2015-5157 P-1309V-6 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0715.html P-1309V-6 This is a vulnerability in openssh in Oracle Linux. The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSDplatforms accepts extraneous username data in MONITOR_REQ_PAM_INIT_CTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafted MONITOR_REQ_PWNAM request, related to monitor.c and monitor_wrap.c. CVSS Base Score: 6.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2015-6563 P-1309V-6 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0741.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. fs/ext4/namei.c in the Linux kernel before 3.7 allows physicallyproximate attackers to cause a denial of service (system crash) via a crafted no-journal filesystem, a related issue to CVE-2013-2015. CVSS Base Score: 6 CVSS V2 Vector: AV:L/AC:H/Au:S/C:C/I:C/A:C. Fix has been released CVE-2015-7509 P-1309V-6 6 AV:L/AC:H/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0855.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. fs/ext4/namei.c in the Linux kernel before 3.7 allows physicallyproximate attackers to cause a denial of service (system crash) via a crafted no-journal filesystem, a related issue to CVE-2013-2015. CVSS Base Score: 6 CVSS V2 Vector: AV:L/AC:H/Au:S/C:C/I:C/A:C. Fix has been released CVE-2015-7509 P-1309V-5 P-1309V-6 6 AV:L/AC:H/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3566.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. fs/ext4/namei.c in the Linux kernel before 3.7 allows physicallyproximate attackers to cause a denial of service (system crash) via a crafted no-journal filesystem, a related issue to CVE-2013-2015. CVSS Base Score: 6 CVSS V2 Vector: AV:L/AC:H/Au:S/C:C/I:C/A:C. Fix has been released CVE-2015-7509 P-1309V-5 P-1309V-6 6 AV:L/AC:H/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3567.html P-1309V-5 P-1309V-6 This is a vulnerability in graphite2 in Oracle Linux. The TtfUtil:LocaLookup function in TtfUtil.cpp in Libgraphite inGraphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, incorrectly validates a size value, which allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted Graphite smart font. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P. Fix has been released CVE-2016-1526 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0594.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2015-7979 P-1309V-6 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1141.html P-1309V-6 P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-2842 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0722.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-2842 P-1309V-6 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0996.html P-1309V-6 This is a vulnerability in samba and samba4 in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2112 P-1309V-6 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0612.html P-1309V-6 P-1309V-7 This is a vulnerability in samba and samba4 in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2114 P-1309V-6 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0612.html P-1309V-6 P-1309V-7 This is a vulnerability in samba and samba4 in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2115 P-1309V-6 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0612.html P-1309V-6 P-1309V-7 This is a vulnerability in samba in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2112 P-1309V-6 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0611.html P-1309V-6 This is a vulnerability in samba in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2112 P-1309V-5 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0621.html P-1309V-5 This is a vulnerability in samba in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2115 P-1309V-6 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0611.html P-1309V-6 This is a vulnerability in samba in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2115 P-1309V-5 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0621.html P-1309V-5 This is a vulnerability in samba3x in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2112 P-1309V-5 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0613.html P-1309V-5 This is a vulnerability in samba3x in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2115 P-1309V-5 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0613.html P-1309V-5 This is a vulnerability in tomcat6 in Oracle Linux. The Expression Language (EL) implementation in Apache Tomcat 6.xbefore 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2014-7810 P-1309V-6 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0492.html P-1309V-6 This is a vulnerability in ImageMagick in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.5 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:P. Fix has been released CVE-2015-8895 P-1309V-6 P-1309V-7 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1237.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.4 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:C. Fix has been released CVE-2016-0774 P-1309V-6 5.4 AV:L/AC:M/Au:N/C:P/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0494.html P-1309V-6 This is a vulnerability in libndp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.4 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3698 P-1309V-7 5.4 AV:A/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1086.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.4 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:C. Fix has been released CVE-2016-0774 P-1309V-7 5.4 AV:L/AC:M/Au:N/C:P/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3528.html P-1309V-7 This is a vulnerability in ImageMagick in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5239 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1237.html P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2808 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0695.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2814 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0695.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2821 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1217.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2828 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1217.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in foomatic in Oracle Linux. Incomplete blacklist vulnerability in util.c in foomatic-rip incups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via (backtick) characters in a print job. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-8327 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0491.html P-1309V-6 This is a vulnerability in foomatic in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-8560 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0491.html P-1309V-6 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0546 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mercurial in Oracle Linux. Mercurial before 3.7.3 allows remote attackers to execute arbitrarycode via a crafted name when converting a Git repository. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3069 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0706.html P-1309V-7 This is a vulnerability in nss and nspr in Oracle Linux. Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchangefunction in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1978 P-1309V-5 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0684.html P-1309V-5 This is a vulnerability in nss and nspr in Oracle Linux. Use-after-free vulnerability in thePK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1979 P-1309V-5 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0684.html P-1309V-5 This is a vulnerability in nss, nspr, nss-softokn, and nss-util in Oracle Linux. Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchangefunction in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1978 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0685.html P-1309V-7 This is a vulnerability in nss, nspr, nss-softokn, and nss-util in Oracle Linux. Use-after-free vulnerability in thePK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1979 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0685.html P-1309V-7 This is a vulnerability in nss, nss-util, and nspr in Oracle Linux. Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchangefunction in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1978 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0591.html P-1309V-6 This is a vulnerability in nss, nss-util, and nspr in Oracle Linux. Use-after-free vulnerability in thePK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1979 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0591.html P-1309V-6 This is a vulnerability in openssl in Oracle Linux. Integer overflow in the EVP_EncodeUpdate function incrypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2105 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0722.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. Integer overflow in the EVP_EncodeUpdate function incrypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2105 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0996.html P-1309V-6 This is a vulnerability in openssl in Oracle Linux. Integer overflow in the EVP_EncryptUpdate function incrypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2106 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0722.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. Integer overflow in the EVP_EncryptUpdate function incrypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2106 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0996.html P-1309V-6 This is a vulnerability in openssl in Oracle Linux. The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the negative CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2108 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0722.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the negative CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2108 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0996.html P-1309V-6 This is a vulnerability in openssl in Oracle Linux. The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the negative CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2108 P-1309V-5 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1137.html P-1309V-5 This is a vulnerability in squid in Oracle Linux. Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4051 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1138.html P-1309V-6 This is a vulnerability in squid in Oracle Linux. Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4051 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1139.html P-1309V-7 This is a vulnerability in squid in Oracle Linux. Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4052 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1138.html P-1309V-6 This is a vulnerability in squid in Oracle Linux. Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4052 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1139.html P-1309V-7 This is a vulnerability in squid in Oracle Linux. Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers toobtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4053 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1138.html P-1309V-6 This is a vulnerability in squid in Oracle Linux. Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers toobtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4053 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1139.html P-1309V-7 This is a vulnerability in squid in Oracle Linux. Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allowsremote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4054 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1138.html P-1309V-6 This is a vulnerability in squid in Oracle Linux. Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allowsremote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4054 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1139.html P-1309V-7 This is a vulnerability in squid34 in Oracle Linux. Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4051 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1140.html P-1309V-6 This is a vulnerability in squid34 in Oracle Linux. Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4052 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1140.html P-1309V-6 This is a vulnerability in squid34 in Oracle Linux. Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers toobtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4053 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1140.html P-1309V-6 This is a vulnerability in squid34 in Oracle Linux. Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allowsremote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4054 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1140.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8215 P-1309V-6 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0855.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8215 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3565.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8215 P-1309V-5 P-1309V-6 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3566.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8215 P-1309V-5 P-1309V-6 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3567.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The Linux kernel before 4.4.1 allows local users to bypassfile-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2013-4312 P-1309V-6 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3559.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. The Linux kernel before 4.4.1 allows local users to bypassfile-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2013-4312 P-1309V-6 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0855.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. The ext4 implementation in the Linux kernel before 2.6.34 does notproperly track the initialization of certain data structures, which allows physically proximate attackers to cause a denial of service (NULL pointer dereference and panic) via a crafted USB device, related to the ext4_fill_super function. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2015-8324 P-1309V-6 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0855.html P-1309V-6 This is a vulnerability in mariadb in Oracle Linux. The ssl_verify_server_cert function in sql-common/client.c in MariaDBbefore 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10, Oracle MySQL, and Percona Server do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a /CN= string in a field in a certificate, as demonstrated by /OU=/CN=bar.com/CN=foo.com. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N. Fix has been released CVE-2016-2047 P-1309V-7 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in openssh in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N. Fix has been released CVE-2016-1908 P-1309V-7 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0465.html P-1309V-7 This is a vulnerability in openssh in Oracle Linux. Multiple CRLF injection vulnerabilities in session.c in sshd inOpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N. Fix has been released CVE-2016-3115 P-1309V-7 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0465.html P-1309V-7 This is a vulnerability in openssh in Oracle Linux. Multiple CRLF injection vulnerabilities in session.c in sshd inOpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N. Fix has been released CVE-2016-3115 P-1309V-6 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0466.html P-1309V-6 This is a vulnerability in openssh in Oracle Linux. Multiple CRLF injection vulnerabilities in session.c in sshd inOpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell-command restrictions via crafted X11 forwarding data, related to the (1) do_authenticated1 and (2) session_x11_req functions. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N. Fix has been released CVE-2016-3115 P-1309V-5 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3531.html P-1309V-5 This is a vulnerability in openssh in Oracle Linux. The x11_open_helper function in channels.c in ssh in OpenSSH before6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:P. Fix has been released CVE-2015-5352 P-1309V-6 4.9 AV:N/AC:M/Au:S/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0741.html P-1309V-6 This is a vulnerability in openssh in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N. Fix has been released CVE-2016-1908 P-1309V-6 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0741.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The Linux kernel before 4.4.1 allows local users to bypassfile-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2013-4312 P-1309V-7 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3565.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The Linux kernel before 4.4.1 allows local users to bypassfile-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2013-4312 P-1309V-5 P-1309V-6 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3566.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The Linux kernel before 4.4.1 allows local users to bypassfile-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2013-4312 P-1309V-5 P-1309V-6 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3567.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The ext4 implementation in the Linux kernel before 2.6.34 does notproperly track the initialization of certain data structures, which allows physically proximate attackers to cause a denial of service (NULL pointer dereference and panic) via a crafted USB device, related to the ext4_fill_super function. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2015-8324 P-1309V-5 P-1309V-6 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3567.html P-1309V-5 P-1309V-6 This is a vulnerability in ImageMagick in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.6 CVSS V2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P. Fix has been released CVE-2015-8896 P-1309V-6 P-1309V-7 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1237.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The networking implementation in the Linux kernel through 4.3.3, asused in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application. CVSS Base Score: 4.6 CVSS V2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C. Fix has been released CVE-2015-8543 P-1309V-6 4.6 AV:L/AC:L/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0855.html P-1309V-6 This is a vulnerability in kernel-uek in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.6 CVSS V2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C. Fix has been released CVE-2016-0617 P-1309V-6 4.6 AV:L/AC:L/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3529.html P-1309V-6 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier,and 5.6.25 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML. CVSS Base Score: 4.6 CVSS V2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P. Fix has been released CVE-2015-4879 P-1309V-7 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The networking implementation in the Linux kernel through 4.3.3, asused in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application. CVSS Base Score: 4.6 CVSS V2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C. Fix has been released CVE-2015-8543 P-1309V-7 4.6 AV:L/AC:L/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3565.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The networking implementation in the Linux kernel through 4.3.3, asused in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application. CVSS Base Score: 4.6 CVSS V2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C. Fix has been released CVE-2015-8543 P-1309V-5 P-1309V-6 4.6 AV:L/AC:L/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3566.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The networking implementation in the Linux kernel through 4.3.3, asused in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application. CVSS Base Score: 4.6 CVSS V2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C. Fix has been released CVE-2015-8543 P-1309V-5 P-1309V-6 4.6 AV:L/AC:L/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3567.html P-1309V-5 P-1309V-6 This is a vulnerability in ImageMagick in Oracle Linux. The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-3715 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0726.html P-1309V-6 P-1309V-7 This is a vulnerability in ImageMagick in Oracle Linux. The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1allows remote attackers to move arbitrary files via a crafted image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-3716 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0726.html P-1309V-6 P-1309V-7 This is a vulnerability in ImageMagick in Oracle Linux. The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.xbefore 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-3718 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0726.html P-1309V-6 P-1309V-7 This is a vulnerability in ImageMagick in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-5240 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1237.html P-1309V-6 P-1309V-7 This is a vulnerability in file in Oracle Linux. file before 5.19 does not properly restrict the amount of data readduring a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2014-3538 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0760.html P-1309V-6 This is a vulnerability in file in Oracle Linux. Integer overflow in the cdf_read_property_info function in cdf.c infile through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE:\ this vulnerability exists because of an incomplete fix for CVE-2012-1571. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2014-3587 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0760.html P-1309V-6 This is a vulnerability in file in Oracle Linux. The donote function in readelf.c in file through 5.20, as used in theFileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2014-3710 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0760.html P-1309V-6 This is a vulnerability in file in Oracle Linux. The ELF parser (readelf.c) in file before 5.21 allows remote attackersto cause a denial of service (CPU consumption or crash) via a large number of (1) program or (2) section headers or (3) invalid capabilities. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2014-8116 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0760.html P-1309V-6 This is a vulnerability in file in Oracle Linux. softmagic.c in file before 5.21 does not properly limit recursion,which allows remote attackers to cause a denial of service (CPU consumption or crash) via unspecified vectors. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2014-8117 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0760.html P-1309V-6 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2822 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1217.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2831 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1217.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in icedtea-web in Oracle Linux. IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properlysanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2015-5234 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0778.html P-1309V-6 This is a vulnerability in icedtea-web in Oracle Linux. IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properlydetermine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2015-5235 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0778.html P-1309V-6 This is a vulnerability in java-1.6.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3425 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0723.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3425 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0675.html P-1309V-6 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3425 P-1309V-5 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0676.html P-1309V-5 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3425 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0650.html P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect availability via vectors related to JAXP. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3425 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0651.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-7701 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-7852 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-7977 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-7978 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-1547 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1141.html P-1309V-6 P-1309V-7 This is a vulnerability in openssh in Oracle Linux. The kbdint_next_device function in auth2-chall.c in sshd in OpenSSHthrough 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2015-5600 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0466.html P-1309V-6 This is a vulnerability in openssh in Oracle Linux. The kbdint_next_device function in auth2-chall.c in sshd in OpenSSHthrough 6.9 does not properly restrict the processing of keyboard-interactive devices within a single connection, which makes it easier for remote attackers to conduct brute-force attacks or cause a denial of service (CPU consumption) via a long and duplicative list in the ssh -oKbdInteractiveDevices option, as demonstrated by a modified client that provides a different password for each pam element on this list. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2015-5600 P-1309V-5 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3531.html P-1309V-5 This is a vulnerability in pcre in Oracle Linux. PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and relatedpatterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-2328 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1025.html P-1309V-7 This is a vulnerability in pcre in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-3217 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1025.html P-1309V-7 This is a vulnerability in pcre in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-5073 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1025.html P-1309V-7 This is a vulnerability in pcre in Oracle Linux. PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern andrelated patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8388 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1025.html P-1309V-7 This is a vulnerability in pcre in Oracle Linux. The pcre_compile function in pcre_compile.c in PCRE before 8.38mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8391 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1025.html P-1309V-7 This is a vulnerability in samba and samba4 in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2110 P-1309V-6 P-1309V-7 4.3 AV:A/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0612.html P-1309V-6 P-1309V-7 This is a vulnerability in samba and samba4 in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2111 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0612.html P-1309V-6 P-1309V-7 This is a vulnerability in samba and samba4 in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2113 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0612.html P-1309V-6 P-1309V-7 This is a vulnerability in samba in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2110 P-1309V-5 4.3 AV:A/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0621.html P-1309V-5 This is a vulnerability in samba in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2111 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0611.html P-1309V-6 This is a vulnerability in samba in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2111 P-1309V-5 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0621.html P-1309V-5 This is a vulnerability in samba3x in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2110 P-1309V-5 4.3 AV:A/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0613.html P-1309V-5 This is a vulnerability in samba3x in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2111 P-1309V-5 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0613.html P-1309V-5 This is a vulnerability in spice in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:N/A:P. Fix has been released CVE-2016-2150 P-1309V-7 4.3 AV:A/AC:M/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1205.html P-1309V-7 This is a vulnerability in spice-server in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:N/A:P. Fix has been released CVE-2016-2150 P-1309V-6 4.3 AV:A/AC:M/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1204.html P-1309V-6 This is a vulnerability in squid in Oracle Linux. client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does notproperly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-4553 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1139.html P-1309V-7 This is a vulnerability in squid in Oracle Linux. client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-4555 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1139.html P-1309V-7 This is a vulnerability in squid in Oracle Linux. Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.xbefore 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-4556 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1138.html P-1309V-6 This is a vulnerability in squid in Oracle Linux. Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.xbefore 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-4556 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1139.html P-1309V-7 This is a vulnerability in squid34 in Oracle Linux. client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does notproperly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-4553 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1140.html P-1309V-6 This is a vulnerability in squid34 in Oracle Linux. client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-4555 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1140.html P-1309V-6 This is a vulnerability in squid34 in Oracle Linux. Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.xbefore 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-4556 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1140.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842. CVSS Base Score: 4 CVSS V2 Vector: AV:L/AC:H/Au:N/C:N/I:N/A:C. Fix has been released CVE-2010-5313 P-1309V-6 4 AV:L/AC:H/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0855.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313. CVSS Base Score: 4 CVSS V2 Vector: AV:L/AC:H/Au:N/C:N/I:N/A:C. Fix has been released CVE-2014-7842 P-1309V-6 4 AV:L/AC:H/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0855.html P-1309V-6 This is a vulnerability in krb5 in Oracle Linux. Multiple memory leaks in kadmin/server/server_stubs.c in kadmind inMIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8631 P-1309V-6 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0493.html P-1309V-6 This is a vulnerability in krb5 in Oracle Linux. Multiple memory leaks in kadmin/server/server_stubs.c in kadmind inMIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8631 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0532.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlierand 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4802. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4792 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlierand 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4802 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlierand 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4815 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlierallows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4816 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlierand 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4826 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlierand 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security :\ Privileges. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4830 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : SP. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4836 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,and 5.6.26 and earlier, allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4858 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4861 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier,and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4870 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlierand 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-4913 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Options. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0505 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and5.6.27 and earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0596 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0597 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier andMariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Optimizer. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0616 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N. Fix has been released CVE-2015-5194 P-1309V-6 4 AV:N/AC:L/Au:S/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N. Fix has been released CVE-2015-5195 P-1309V-6 4 AV:N/AC:L/Au:S/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:P. Fix has been released CVE-2015-7691 P-1309V-6 4 AV:N/AC:H/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:P. Fix has been released CVE-2015-7692 P-1309V-6 4 AV:N/AC:H/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:P. Fix has been released CVE-2015-7702 P-1309V-6 4 AV:N/AC:H/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N. Fix has been released CVE-2015-7703 P-1309V-6 4 AV:N/AC:L/Au:S/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in openssh in Oracle Linux. Use-after-free vulnerability in the mm_answer_pam_free_ctx function inmonitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms might allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ_PAM_FREE_CTX request. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N. Fix has been released CVE-2015-6564 P-1309V-6 4 AV:N/AC:H/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0741.html P-1309V-6 This is a vulnerability in openssl in Oracle Linux. The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session, NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2107 P-1309V-7 4 AV:N/AC:H/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0722.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session, NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-2107 P-1309V-6 4 AV:N/AC:H/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0996.html P-1309V-6 This is a vulnerability in squid in Oracle Linux. mime_header.cc in Squid before 3.5.18 allows remote attackers tobypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crated HTTP Host header, aka a header CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-4554 P-1309V-6 4 AV:N/AC:H/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1138.html P-1309V-6 This is a vulnerability in squid in Oracle Linux. mime_header.cc in Squid before 3.5.18 allows remote attackers tobypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crated HTTP Host header, aka a header CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-4554 P-1309V-7 4 AV:N/AC:H/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1139.html P-1309V-7 This is a vulnerability in squid34 in Oracle Linux. mime_header.cc in Squid before 3.5.18 allows remote attackers tobypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crated HTTP Host header, aka a header CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-4554 P-1309V-6 4 AV:N/AC:H/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1140.html P-1309V-6 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to DML. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0598 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to InnoDB. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0600 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect integrity via unknown vectors related to encryption. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N. Fix has been released CVE-2016-0606 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via vectors related to UDF. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0608 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in ImageMagick in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.3 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:P. Fix has been released CVE-2015-8897 P-1309V-6 P-1309V-7 3.3 AV:L/AC:M/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1237.html P-1309V-6 P-1309V-7 This is a vulnerability in file in Oracle Linux. readelf.c in file before 5.22, as used in the Fileinfo component inPHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file. CVSS Base Score: 3.3 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:P. Fix has been released CVE-2014-9653 P-1309V-6 3.3 AV:L/AC:M/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0760.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.3 CVSS V2 Vector: AV:A/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-5219 P-1309V-6 3.3 AV:A/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0780.html P-1309V-6 This is a vulnerability in java-1.6.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-0695 P-1309V-5 P-1309V-6 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0723.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-0695 P-1309V-6 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0675.html P-1309V-6 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-0695 P-1309V-5 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0676.html P-1309V-5 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-0695 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0650.html P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77;Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related to Security. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-0695 P-1309V-6 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0651.html P-1309V-6 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3426 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0650.html P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3426 P-1309V-6 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0651.html P-1309V-6 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.6 CVSS V2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-1550 P-1309V-6 P-1309V-7 2.6 AV:L/AC:H/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1141.html P-1309V-6 P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-0799 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0722.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-0799 P-1309V-6 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0996.html P-1309V-6 This is a vulnerability in pcre in Oracle Linux. PCRE before 8.38 mishandles the interaction of lookbehind assertionsand mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8386 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1025.html P-1309V-7 This is a vulnerability in krb5 in Oracle Linux. The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind inMIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string. CVSS Base Score: 2.1 CVSS V2 Vector: AV:N/AC:H/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8629 P-1309V-6 2.1 AV:N/AC:H/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0493.html P-1309V-6 This is a vulnerability in krb5 in Oracle Linux. The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind inMIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string. CVSS Base Score: 2.1 CVSS V2 Vector: AV:N/AC:H/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8629 P-1309V-7 2.1 AV:N/AC:H/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0532.html P-1309V-7 This is a vulnerability in krb5 in Oracle Linux. The (1) kadm5_create_principal_3 and (2) kadm5_modify_principalfunctions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by specifying KADM5_POLICY with a NULL policy name. CVSS Base Score: 2.1 CVSS V2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8630 P-1309V-7 2.1 AV:N/AC:H/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0532.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.1 CVSS V2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-2518 P-1309V-6 P-1309V-7 2.1 AV:N/AC:H/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1141.html P-1309V-6 P-1309V-7 This is a vulnerability in ImageMagick in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8898 P-1309V-6 P-1309V-7 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1237.html P-1309V-6 P-1309V-7 This is a vulnerability in file in Oracle Linux. The ELF parser in file 5.08 through 5.21 allows remote attackers tocause a denial of service via a large number of notes. CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2014-9620 P-1309V-6 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0760.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linuxkernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value. CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2014-8134 P-1309V-6 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0855.html P-1309V-6 This is a vulnerability in openssl in Oracle Linux. The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding. CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2109 P-1309V-7 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0722.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding. CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2109 P-1309V-6 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0996.html P-1309V-6 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to privileges. CVSS Base Score: 1.7 CVSS V2 Vector: AV:N/AC:H/Au:M/C:N/I:N/A:P. Fix has been released CVE-2016-0609 P-1309V-7 1.7 AV:N/AC:H/Au:M/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7 This is a vulnerability in kernel-uek in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 0 CVSS V2 Vector: AV:N/AC:N/Au:N/C:N/I:N/A:N. Fix has been released CVE-2016-3157 P-1309V-6 0 AV:N/AC:N/Au:N/C:N/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3529.html P-1309V-6 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier,and 5.6.25 and earlier, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs. CVSS Base Score: 0 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:N. Fix has been released CVE-2015-4819 P-1309V-7 0 AV:L/AC:L/Au:N/C:N/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-0534.html P-1309V-7