Oracle Linux Bulletin - July 2016 - Oracle CVRF Oracle Linux Bulletin Advisory OLBulletinJul2016 Final 3.0 1.0 2016-07-19T13:00:00-07:00 Initial Distribution 2.0 2016-08-19T13:00:00-07:00 New CVEs added. 3.0 2016-09-19T13:00:00-07:00 New CVEs added. This document contains descriptions of Oracle Linux security vulnerabilities which have had fixes released for all supported versions and platforms. http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html URL to html version of Advisory Oracle Linux 5 Oracle Linux 6 Oracle Linux 7 This is a vulnerability in kernel in Oracle Linux. The compat IPT_SO_SET_REPLACE setsockopt implementation in thenetfilter subsystem in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement. CVSS Base Score: 7.2 CVSS V2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4997 P-1309V-7 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1847.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. net/sctp/sm_sideeffect.c in the Linux kernel before 4.3 does notproperly manage the relationship between a lock and a socket, which allows local users to cause a denial of service (deadlock) via a crafted sctp_accept call. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2015-8767 P-1309V-7 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1277.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The key_reject_and_link function in security/keys/key.c in the Linuxkernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4470 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3593.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. The key_reject_and_link function in security/keys/key.c in the Linuxkernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4470 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1539.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4565 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1277.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4565 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1406.html P-1309V-6 This is a vulnerability in setroubleshoot and setroubleshoot-plugins in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4444 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1267.html P-1309V-6 This is a vulnerability in setroubleshoot and setroubleshoot-plugins in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4444 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1293.html P-1309V-7 This is a vulnerability in setroubleshoot and setroubleshoot-plugins in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4446 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1267.html P-1309V-6 This is a vulnerability in setroubleshoot and setroubleshoot-plugins in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4446 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1293.html P-1309V-7 This is a vulnerability in setroubleshoot and setroubleshoot-plugins in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4989 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1267.html P-1309V-6 This is a vulnerability in setroubleshoot and setroubleshoot-plugins in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4989 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1293.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The key_reject_and_link function in security/keys/key.c in the Linuxkernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4470 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3591.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The key_reject_and_link function in security/keys/key.c in the Linuxkernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4470 P-1309V-5 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3592.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4565 P-1309V-5 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3579.html P-1309V-5 P-1309V-6 This is a vulnerability in firefox in Oracle Linux. Multiple unspecified vulnerabilities in the browser engine in MozillaFirefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2836 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Use-after-free vulnerability in the WebRTC socket thread in MozillaFirefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5258 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Use-after-free vulnerability in the CanonicalizeXPCOMParticipantfunction in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5259 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.6.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SEEmbedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3606 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1776.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3598 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1504.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SEEmbedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3606 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1504.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3598. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3610 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1504.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3587 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1458.html P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3598 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1458.html P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SEEmbedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3606 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1458.html P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3598. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3610 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1458.html P-1309V-6 P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allowsattackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-7554 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. The _TIFFVGetField function in tif_dir.c in libtiff 4.0.6 allowsattackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via crafted field data in an extension tag in a TIFF image. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-7554 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. The NeXTDecode function in tif_next.c in LibTIFF allows remoteattackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image, as demonstrated by libtiff5.tif. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-8784 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. The NeXTDecode function in tif_next.c in LibTIFF allows remoteattackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image, as demonstrated by libtiff5.tif. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-8784 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3632 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3632 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3945 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3945 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3990 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3990 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3991 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3991 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5320 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5320 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libxml2 in Oracle Linux. libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOSbefore 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1834 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in thunderbird in Oracle Linux. Multiple unspecified vulnerabilities in the browser engine in MozillaFirefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2818 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1392.html P-1309V-6 P-1309V-7 This is a vulnerability in thunderbird in Oracle Linux. Multiple unspecified vulnerabilities in the browser engine in MozillaFirefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to Http2Session::Shutdown and SpdySession31::Shutdown, and other vectors. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2836 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1809.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The fork implementation in the Linux kernel before 4.5 on s390platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h. CVSS Base Score: 6.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-2143 P-1309V-7 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1539.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The netfilter subsystem in the Linux kernel through 4.5.2 does notvalidate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call. CVSS Base Score: 6.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-3134 P-1309V-7 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1847.html P-1309V-7 This is a vulnerability in setroubleshoot and setroubleshoot-plugins in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4445 P-1309V-6 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1267.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernelthrough 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application. CVSS Base Score: 6 CVSS V2 Vector: AV:L/AC:H/Au:S/C:C/I:C/A:C. Fix has been released CVE-2015-8660 P-1309V-6 6 AV:L/AC:H/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3593.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernelthrough 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application. CVSS Base Score: 6 CVSS V2 Vector: AV:L/AC:H/Au:S/C:C/I:C/A:C. Fix has been released CVE-2015-8660 P-1309V-7 6 AV:L/AC:H/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1539.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. Heap-based buffer overflow in the zip_read_mac_metadata function inarchive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive. CVSS Base Score: 6 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P. Fix has been released CVE-2016-1541 P-1309V-7 6 AV:N/AC:M/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P. Fix has been released CVE-2016-4300 P-1309V-7 6 AV:N/AC:M/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P. Fix has been released CVE-2016-4302 P-1309V-7 6 AV:N/AC:M/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser. CVSS Base Score: 6 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P. Fix has been released CVE-2016-3477 P-1309V-7 6 AV:N/AC:M/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properlydetermine the rate of challenge ACK segments, which makes it easier for man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-5696 P-1309V-6 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3594.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properlydetermine the rate of challenge ACK segments, which makes it easier for man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-5696 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1633.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properlydetermine the rate of challenge ACK segments, which makes it easier for man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-5696 P-1309V-6 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1664.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2)NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and libtiff-cvs-2.tif. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P. Fix has been released CVE-2014-9655 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2)NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff-cvs-1.tif and libtiff-cvs-2.tif. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:P. Fix has been released CVE-2014-9655 P-1309V-6 5.8 AV:N/AC:M/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. The NeXTDecode function in tif_next.c in LibTIFF allows remoteattackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2015-1547 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. The NeXTDecode function in tif_next.c in LibTIFF allows remoteattackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2015-1547 P-1309V-6 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properlydetermine the rate of challenge ACK segments, which makes it easier for man-in-the-middle attackers to hijack TCP sessions via a blind in-window attack. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-5696 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3595.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Race condition in the tty_ioctl function in drivers/tty/tty_io.c inthe Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call. CVSS Base Score: 5.6 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:C. Fix has been released CVE-2016-0723 P-1309V-6 5.6 AV:L/AC:L/Au:N/C:P/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. The IPT_SO_SET_REPLACE setsockopt implementation in the netfiltersubsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary. CVSS Base Score: 5.6 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:C. Fix has been released CVE-2016-4998 P-1309V-7 5.6 AV:L/AC:L/Au:N/C:P/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1847.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The nf_nat_redirect_ipv4 function in net/netfilter/nf_nat_redirect.cin the Linux kernel before 4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured interface, a related issue to CVE-2003-1604. CVSS Base Score: 5.4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:C. Fix has been released CVE-2015-8787 P-1309V-6 5.4 AV:N/AC:H/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6 This is a vulnerability in samba in Oracle Linux. libcli/smb/smbXcli_base.c in Samba 4.x before 4.2.14, 4.3.x before4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2) SMB2_SESSION_FLAG_IS_NULL flag. CVSS Base Score: 5.4 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2119 P-1309V-7 5.4 AV:A/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1486.html P-1309V-7 This is a vulnerability in samba4 in Oracle Linux. libcli/smb/smbXcli_base.c in Samba 4.x before 4.2.14, 4.3.x before4.3.11, and 4.4.x before 4.4.5 allows man-in-the-middle attackers to bypass a client-signing protection mechanism, and consequently spoof SMB2 and SMB3 servers, via the (1) SMB2_SESSION_FLAG_IS_GUEST or (2) SMB2_SESSION_FLAG_IS_NULL flag. CVSS Base Score: 5.4 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2119 P-1309V-6 5.4 AV:A/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1487.html P-1309V-6 This is a vulnerability in firefox in Oracle Linux. Heap-based buffer overflow in the ClearKey Content Decryption Module(CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2837 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Heap-based buffer overflow in the nsBidi::BracketData::AddOpeningfunction in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via directional content in an SVG document. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2838 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Stack-based buffer underflow in the mozilla::gfx::BasePoint4d functionin Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5252 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Use-after-free vulnerability in the nsXULPopupManager::KeyDownfunction in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by leveraging keyboard access to use the Alt key during selection of top-level menu items. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5254 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 andFirefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages type CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5263 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Use-after-free vulnerability in thensNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5264 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOSbefore 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, and CVE-2016-1839. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-1840 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. Format string vulnerability in libxml2 before 2.9.4 allows attackersto have unspecified impact via format string specifiers in unknown vectors. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4448 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in openssl in Oracle Linux. Integer overflow in the EVP_EncodeUpdate function incrypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2105 P-1309V-5 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3576.html P-1309V-5 This is a vulnerability in openssl in Oracle Linux. Integer overflow in the EVP_EncryptUpdate function incrypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2106 P-1309V-5 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3576.html P-1309V-5 This is a vulnerability in squid in Oracle Linux. Stack-based buffer overflow in the munge_other_line function incachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-4051. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5408 P-1309V-6 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1573.html P-1309V-6 This is a vulnerability in golang in Oracle Linux. The net/http package in Go through 1.6 does not attempt to address RFC3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an httpoxy issue. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5386 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1538.html P-1309V-7 This is a vulnerability in httpd in Oracle Linux. The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an httpoxy issue. NOTE: the vendor states This CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5387 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1422.html P-1309V-7 This is a vulnerability in httpd in Oracle Linux. The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an httpoxy issue. NOTE: the vendor states This CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5387 P-1309V-5 P-1309V-6 5 AV:N/AC:L/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1421.html P-1309V-5 P-1309V-6 This is a vulnerability in php in Oracle Linux. PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an httpoxy issue. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5385 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1613.html P-1309V-7 This is a vulnerability in php in Oracle Linux. PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an httpoxy issue. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5385 P-1309V-6 5 AV:N/AC:L/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1609.html P-1309V-6 This is a vulnerability in python in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-1000110 P-1309V-6 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1626.html P-1309V-6 P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The hub_activate function in drivers/usb/core/hub.c in the Linuxkernel before 4.3.5 does not properly maintain a hub-interface data structure, which allows physically proximate attackers to cause a denial of service (invalid memory access and system crash) or possibly have unspecified other impact by unplugging a USB hub device. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2015-8816 P-1309V-6 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. fs/pipe.c in the Linux kernel before 4.5 does not limit the amount ofunread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-2847 P-1309V-6 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The tipc_nl_publ_dump function in net/tipc/socket.c in the Linuxkernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-4951 P-1309V-6 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect integrity and availability via vectors related to DML. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:P. Fix has been released CVE-2016-0640 P-1309V-7 4.9 AV:N/AC:M/Au:S/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect confidentiality and availability via vectors related to MyISAM. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:P. Fix has been released CVE-2016-0641 P-1309V-7 4.9 AV:N/AC:M/Au:S/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. fs/pnode.c in the Linux kernel before 4.5.4 does not properly traversea mount propagation tree in a certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted series of mount system calls. CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-4581 P-1309V-6 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6 This is a vulnerability in kernel-uek in Oracle Linux. fs/overlayfs/dir.c in the OverlayFS filesystem implementation in theLinux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink. CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-6197 P-1309V-6 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3587.html P-1309V-6 This is a vulnerability in kernel-uek in Oracle Linux. The filesystem layer in the Linux kernel before 4.5.5 proceeds withpost-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c. CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-6198 P-1309V-6 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3587.html P-1309V-6 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.6 CVSS V2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P. Fix has been released CVE-2016-5418 P-1309V-7 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.6 CVSS V2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P. Fix has been released CVE-2016-5418 P-1309V-6 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1850.html P-1309V-6 This is a vulnerability in ocaml in Oracle Linux. OCamel before 4.03.0 does not properly handle sign extensions, whichallows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function. CVSS Base Score: 4.4 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-8869 P-1309V-7 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1296.html P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preservethe network connection used for favicon resource retrieval after the associated browser window is closed, which makes it easier for remote web servers to track users by observing network traffic from multiple IP addresses. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2830 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 processJavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox=allow-scripts attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5262 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allowuser-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-5265 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1551.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.6.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-3458 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1776.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.6.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-3500 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1776.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.6.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-3508 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1776.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.6.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 andJava SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3550 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1776.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-3458 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1504.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-3500 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1504.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-3508 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1504.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 andJava SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3550 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1504.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-3458 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1458.html P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-3500 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1458.html P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92;Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-3508 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1458.html P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 andJava SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3550 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1458.html P-1309V-6 P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:H/Au:M/C:P/I:P/A:P. Fix has been released CVE-2016-6250 P-1309V-7 4.3 AV:N/AC:H/Au:M/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allowsremote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2014-9330 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. Integer overflow in tif_packbits.c in bmp2tif in libtiff 4.0.3 allowsremote attackers to cause a denial of service (crash) via crafted BMP image, related to dimensions, which triggers an out-of-bounds read. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2014-9330 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause adenial of service (out-of-bounds read) via the SamplesPerPixel tag in a TIFF image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8665 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause adenial of service (out-of-bounds read) via the SamplesPerPixel tag in a TIFF image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8665 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. Heap-based buffer overflow in the PackBitsPreEncode function intif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8668 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. Heap-based buffer overflow in the PackBitsPreEncode function intif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause a denial of service via a large width field in a BMP image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8668 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8683 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8683 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. tif_luv.c in libtiff allows attackers to cause a denial of service(out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image, a different vulnerability than CVE-2015-8782. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8781 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. tif_luv.c in libtiff allows attackers to cause a denial of service(out-of-bounds write) via an invalid number of samples per pixel in a LogL compressed TIFF image, a different vulnerability than CVE-2015-8782. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8781 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. tif_luv.c in libtiff allows attackers to cause a denial of service(out-of-bounds writes) via a crafted TIFF image, a different vulnerability than CVE-2015-8781. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8782 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. tif_luv.c in libtiff allows attackers to cause a denial of service(out-of-bounds writes) via a crafted TIFF image, a different vulnerability than CVE-2015-8781. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8782 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. tif_luv.c in libtiff allows attackers to cause a denial of service(out-of-bounds reads) via a crafted TIFF image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8783 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. tif_luv.c in libtiff allows attackers to cause a denial of service(out-of-bounds reads) via a crafted TIFF image. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8783 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libxml2 in Oracle Linux. libxml2 in Apple iOS before 9.3, OS X before 10.11.4, Safari before9.1, tvOS before 9.2, and watchOS before 2.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-1762 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOSbefore 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-1833 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. libxml2, as used in Apple iOS before 9.3.2 and OS X before 10.11.5,allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-1835 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOSbefore 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1837, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-1836 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOSbefore 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1838, CVE-2016-1839, and CVE-2016-1840. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-1837 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOSbefore 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1839, and CVE-2016-1840. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-1838 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. libxml2, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOSbefore 9.2.1, and watchOS before 2.2.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document, a different vulnerability than CVE-2016-1833, CVE-2016-1834, CVE-2016-1836, CVE-2016-1837, CVE-2016-1838, and CVE-2016-1840. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-1839 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 andearlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite recursion, stack consumption, and application crash) via a crafted XML document. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-3627 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functionsin parser.c in libxml2 2.9.3 do not properly keep track of the recursion depth, which allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a crafted XML document containing a large number of nested entity references. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-3705 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4allows context-dependent attackers to cause a denial of service (heap-based buffer underread and application crash) via a crafted file, involving xmlParseName. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-4447 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in libxml2 in Oracle Linux. XML external entity (XXE) vulnerability in thexmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validating mode, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via unspecified vectors. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-4449 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1292.html P-1309V-6 P-1309V-7 This is a vulnerability in ntp in Oracle Linux. The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2013-5211 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3612.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2013-5211 P-1309V-6 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3613.html P-1309V-6 This is a vulnerability in qemu-kvm in Oracle Linux. Heap-based buffer overflow in the iscsi_aio_ioctl function inblock/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call. CVSS Base Score: 4.3 CVSS V2 Vector: AV:A/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-5126 P-1309V-7 4.3 AV:A/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1606.html P-1309V-7 This is a vulnerability in ipa in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5404 P-1309V-6 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1797.html P-1309V-6 P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect confidentiality via vectors related to DML. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0643 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DDL. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0644 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to DML. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0646 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to FTS. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0647 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to PS. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0648 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to PS. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0649 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and 10.1.x before 10.1.12 allows local users to affect availability via vectors related to Replication. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0650 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated users to affect availability via vectors related to Server: Types. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-3521 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5440 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1allows local users to gain privileges by triggering access to a paging structure by a different CPU. CVSS Base Score: 3.7 CVSS V2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2069 P-1309V-6 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.6 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:P. Fix has been released CVE-2014-8127 P-1309V-7 3.6 AV:L/AC:L/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.6 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:P. Fix has been released CVE-2014-8127 P-1309V-6 3.6 AV:L/AC:L/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.6 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:P. Fix has been released CVE-2014-8129 P-1309V-7 3.6 AV:L/AC:L/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.6 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:P. Fix has been released CVE-2014-8129 P-1309V-6 3.6 AV:L/AC:L/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8916 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8917 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8919 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8920 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8920 P-1309V-6 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1850.html P-1309V-6 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8921 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8921 P-1309V-6 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1850.html P-1309V-6 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8922 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8923 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8924 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8925 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8926 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8928 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8930 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8931 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8932 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2015-8932 P-1309V-6 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1850.html P-1309V-6 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8934 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-4809 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-4809 P-1309V-6 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1850.html P-1309V-6 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5844 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5844 P-1309V-6 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1850.html P-1309V-6 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-7166 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1844.html P-1309V-7 This is a vulnerability in libarchive in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-7166 P-1309V-6 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1850.html P-1309V-6 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows local users to affect availability via vectors related to Security: Privileges. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-0666 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in kernel-uek in Oracle Linux. The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c inthe Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2117 P-1309V-6 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3587.html P-1309V-6 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Security:\ Encryption. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-3452 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Connection. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-5444 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The fmtstr function in crypto/bio/b_print.c in OpenSSL 1.0.1 before1.0.1s and 1.0.2 before 1.0.2g improperly calculates string lengths, which allows remote attackers to cause a denial of service (overflow and out-of-bounds read) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-2842. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-0799 P-1309V-5 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3576.html P-1309V-5 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c inthe Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2117 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3588.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c inthe Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2117 P-1309V-5 P-1309V-6 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3589.html P-1309V-5 P-1309V-6 This is a vulnerability in qemu-kvm in Oracle Linux. The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows localguest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion. CVSS Base Score: 2.3 CVSS V2 Vector: AV:A/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5403 P-1309V-6 2.3 AV:A/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1585.html P-1309V-6 This is a vulnerability in qemu-kvm in Oracle Linux. The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows localguest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion. CVSS Base Score: 2.3 CVSS V2 Vector: AV:A/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5403 P-1309V-7 2.3 AV:A/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1606.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The fuse_fill_write_pages function in fs/fuse/file.c in the Linuxkernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8785 P-1309V-6 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The get_rock_ridge_filename function in fs/isofs/rock.c in the Linuxkernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-4913 P-1309V-6 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2014-8130 P-1309V-7 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1546.html P-1309V-7 This is a vulnerability in libtiff in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2014-8130 P-1309V-6 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1547.html P-1309V-6 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated users to affect availability via vectors related to Server: DML. CVSS Base Score: 2.1 CVSS V2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-3615 P-1309V-7 2.1 AV:N/AC:H/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1602.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in theLinux kernel before 4.5.2 allows local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions. CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-4805 P-1309V-6 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6 This is a vulnerability in openssl in Oracle Linux. The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding. CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2109 P-1309V-5 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3576.html P-1309V-5 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The IPv4 implementation in the Linux kernel before 4.5.2 mishandlesdestruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses. CVSS Base Score: 1.7 CVSS V2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-3156 P-1309V-6 1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3596.html P-1309V-6