Oracle Linux Bulletin - October 2016 - Oracle CVRF Oracle Linux Bulletin Advisory OLBulletinOct2016 Final 3.0 1.0 2016-10-18T13:00:00-07:00 Initial Distribution 2.0 2016-11-18T13:00:00-07:00 New CVEs added. 3.0 2016-12-19T13:00:00-07:00 New CVEs added. This document contains descriptions of Oracle Linux security vulnerabilities which have had fixes released for all supported versions and platforms. http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html URL to html version of Advisory Oracle Linux 5 Oracle Linux 6 Oracle Linux 7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Use-after-free vulnerability in mm/percpu.c in the Linux kernelthrough 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls. CVSS Base Score: 7.2 CVSS V2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4794 P-1309V-6 P-1309V-7 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3644.html P-1309V-6 P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockoptimplementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement. CVSS Base Score: 7.2 CVSS V2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4997 P-1309V-6 P-1309V-7 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3619.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. Use-after-free vulnerability in mm/percpu.c in the Linux kernelthrough 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls. CVSS Base Score: 7.2 CVSS V2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4794 P-1309V-7 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockoptimplementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement. CVSS Base Score: 7.2 CVSS V2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4997 P-1309V-5 P-1309V-6 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3618.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-7039 P-1309V-6 P-1309V-7 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3626.html P-1309V-6 P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linuxkernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-9555 P-1309V-6 P-1309V-7 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3648.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-7039 P-1309V-7 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2047.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1, 5.6.x before 5.6.32-78.0, and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C. Fix has been released CVE-2016-6662 P-1309V-7 7.1 AV:N/AC:H/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2595.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The sctp_sf_ootb function in net/sctp/sm_statefuns.c in the Linuxkernel before 4.8.8 lacks chunk-length checking for the first chunk, which allows remote attackers to cause a denial of service (out-of-bounds slab access) or possibly have unspecified other impact via crafted SCTP data. CVSS Base Score: 7.1 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-9555 P-1309V-5 P-1309V-6 7.1 AV:N/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3652.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Multiple heap-based buffer overflows in the hiddev_ioctl_usagefunction in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5829 P-1309V-6 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3625.html P-1309V-6 P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in theLinux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-1583 P-1309V-6 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3635.html P-1309V-6 P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in theLinux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-1583 P-1309V-6 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3644.html P-1309V-6 P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5195 P-1309V-6 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3632.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in theLinux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-1583 P-1309V-5 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2124-1.html P-1309V-5 This is a vulnerability in kernel in Oracle Linux. The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in theLinux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-1583 P-1309V-5 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2124.html P-1309V-5 This is a vulnerability in kernel in Oracle Linux. The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in theLinux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-1583 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2766.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. The key_reject_and_link function in security/keys/key.c in the Linuxkernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-4470 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2006.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5195 P-1309V-5 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2124-1.html P-1309V-5 This is a vulnerability in kernel in Oracle Linux. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5195 P-1309V-5 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2124.html P-1309V-5 This is a vulnerability in kernel in Oracle Linux. Multiple heap-based buffer overflows in the hiddev_ioctl_usagefunction in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5829 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2006.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5195 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2098.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5195 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2105.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2015-8812 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The IPv6 stack in the Linux kernel before 4.3.3 mishandles optionsdata, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-3841 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. Multiple heap-based buffer overflows in the hiddev_ioctl_usagefunction in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5829 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5425 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2046.html P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-6325 P-1309V-7 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2046.html P-1309V-7 This is a vulnerability in tomcat6 in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-6325 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2045.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Multiple heap-based buffer overflows in the hiddev_ioctl_usagefunction in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5829 P-1309V-5 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3624.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in theLinux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling. CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-1583 P-1309V-5 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3646.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka Dirty CVSS Base Score: 6.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-5195 P-1309V-5 P-1309V-6 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3634.html P-1309V-5 P-1309V-6 This is a vulnerability in expat in Oracle Linux. Expat allows context-dependent attackers to cause a denial of service(crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0718 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2824.html P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Multiple unspecified vulnerabilities in the browser engine in MozillaFirefox before 49.0 and Firefox ESR 45.x before 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5257 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5278 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5290 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2780.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5296 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2780.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-9079 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2843.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-9893 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2946.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-9899 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2946.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; andJava SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5573. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5582 P-1309V-5 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2658.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; andJava SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5573. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5582 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2079.html P-1309V-6 P-1309V-7 This is a vulnerability in memcached in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-8704 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2819.html P-1309V-7 This is a vulnerability in memcached in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-8704 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2820.html P-1309V-6 This is a vulnerability in memcached in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-8705 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2819.html P-1309V-7 This is a vulnerability in memcached in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-8705 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2820.html P-1309V-6 This is a vulnerability in memcached in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-8706 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2819.html P-1309V-7 This is a vulnerability in policycoreutils in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-7545 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2702.html P-1309V-6 P-1309V-7 This is a vulnerability in resteasy-base in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-7050 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2604.html P-1309V-7 This is a vulnerability in thunderbird in Oracle Linux. Multiple unspecified vulnerabilities in the browser engine in MozillaFirefox before 49.0 and Firefox ESR 45.x before 45.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5257 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1985.html P-1309V-6 P-1309V-7 This is a vulnerability in thunderbird in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5290 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2825.html P-1309V-6 P-1309V-7 This is a vulnerability in thunderbird in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-9079 P-1309V-6 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2850.html P-1309V-6 P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.xbefore 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-5346 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2046.html P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. The session-persistence implementation in Apache Tomcat 6.x before6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0714 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2599.html P-1309V-7 This is a vulnerability in tomcat6 in Oracle Linux. The session-persistence implementation in Apache Tomcat 6.x before6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-0714 P-1309V-6 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2045.html P-1309V-6 This is a vulnerability in wget in Oracle Linux. GNU wget before 1.18 allows remote servers to write to arbitrary filesby redirecting a request from HTTP to a crafted FTP resource. CVSS Base Score: 6.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-4971 P-1309V-7 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2587.html P-1309V-7 This is a vulnerability in sudo in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.6 CVSS V2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C. Fix has been released CVE-2016-7032 P-1309V-6 P-1309V-7 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2872.html P-1309V-6 P-1309V-7 This is a vulnerability in sudo in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.6 CVSS V2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C. Fix has been released CVE-2016-7076 P-1309V-6 P-1309V-7 6.6 AV:L/AC:M/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2872.html P-1309V-6 P-1309V-7 This is a vulnerability in kvm in Oracle Linux. The VGA module in QEMU improperly performs bounds checking on bankedaccess to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the Dark CVSS Base Score: 6.5 CVSS V2 Vector: AV:A/AC:H/Au:S/C:C/I:C/A:C. Fix has been released CVE-2016-3710 P-1309V-5 6.5 AV:A/AC:H/Au:S/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1943.html P-1309V-5 This is a vulnerability in postgresql in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.5 CVSS V2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P. Fix has been released CVE-2016-5423 P-1309V-7 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2606.html P-1309V-7 This is a vulnerability in ipsilon in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6.4 CVSS V2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P. Fix has been released CVE-2016-8638 P-1309V-7 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2809.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The netfilter subsystem in the Linux kernel through 4.5.2 does notvalidate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call. CVSS Base Score: 6.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-3134 P-1309V-6 P-1309V-7 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3625.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The fork implementation in the Linux kernel before 4.5 on s390platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h. CVSS Base Score: 6.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-2143 P-1309V-6 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2766.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. Double free vulnerability in the snd_usbmidi_create function insound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor. CVSS Base Score: 6.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-2384 P-1309V-7 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in openssh in Oracle Linux. The do_setup_env function in session.c in sshd in OpenSSH through7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable. CVSS Base Score: 6.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2015-8325 P-1309V-7 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2588.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The netfilter subsystem in the Linux kernel through 4.5.2 does notvalidate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call. CVSS Base Score: 6.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C. Fix has been released CVE-2016-3134 P-1309V-5 P-1309V-6 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3624.html P-1309V-5 P-1309V-6 This is a vulnerability in postgresql in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 6 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P. Fix has been released CVE-2016-5424 P-1309V-7 6 AV:N/AC:M/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2606.html P-1309V-7 This is a vulnerability in curl in Oracle Linux. curl and libcurl before 7.50.1 do not prevent TLS session resumptionwhen the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-5419 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2575.html P-1309V-7 This is a vulnerability in nettle in Oracle Linux. The ecc_256_modp function in ecc-256.c in Nettle before 3.2 does notproperly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8805. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2015-8803 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2582.html P-1309V-7 This is a vulnerability in nettle in Oracle Linux. x86_64/ecc-384-modp.asm in Nettle before 3.2 does not properly handlecarry propagation and produces incorrect output in its implementation of the P-384 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2015-8804 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2582.html P-1309V-7 This is a vulnerability in nettle in Oracle Linux. The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does notproperly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2015-8805 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2582.html P-1309V-7 This is a vulnerability in nettle in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-6489 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2582.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2015-7979 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. The Expression Language (EL) implementation in Apache Tomcat 6.xbefore 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation. CVSS Base Score: 5.8 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2014-7810 P-1309V-7 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2046.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The IPT_SO_SET_REPLACE setsockopt implementation in the netfiltersubsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary. CVSS Base Score: 5.6 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:C. Fix has been released CVE-2016-4998 P-1309V-6 P-1309V-7 5.6 AV:L/AC:L/Au:N/C:P/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3619.html P-1309V-6 P-1309V-7 This is a vulnerability in systemd in Oracle Linux. The manager_invoke_notify_message function in systemd 231 and earlierallows local users to cause a denial of service (assertion failure and PID 1 hang) via a zero-length message received over a notify socket. CVSS Base Score: 5.6 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:C. Fix has been released CVE-2016-7795 P-1309V-7 5.6 AV:L/AC:L/Au:N/C:N/I:P/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2610.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The IPT_SO_SET_REPLACE setsockopt implementation in the netfiltersubsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary. CVSS Base Score: 5.6 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:C. Fix has been released CVE-2016-4998 P-1309V-5 P-1309V-6 5.6 AV:L/AC:L/Au:N/C:P/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3618.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in theLinux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket. CVSS Base Score: 5.4 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:C. Fix has been released CVE-2015-8956 P-1309V-6 P-1309V-7 5.4 AV:L/AC:M/Au:N/C:P/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3644.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in theLinux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket. CVSS Base Score: 5.4 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:C. Fix has been released CVE-2015-8956 P-1309V-7 5.4 AV:L/AC:M/Au:N/C:P/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in theLinux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket. CVSS Base Score: 5.4 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:C. Fix has been released CVE-2015-8956 P-1309V-5 P-1309V-6 5.4 AV:L/AC:M/Au:N/C:P/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3646.html P-1309V-5 P-1309V-6 This is a vulnerability in firefox in Oracle Linux. Integer overflow in the WebSocketChannel class in the WebSocketssubsystem in Mozilla Firefox before 48.0 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted packets that trigger incorrect buffer-resize operations during buffering. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5261 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5270 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5272 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5274 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5276 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5277 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5280 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5281 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5284 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5297 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2780.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-9066 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2780.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-9897 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2946.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-9898 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2946.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-9905 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2946.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; andJava SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5582. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5573 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2658.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; andJava SE Embedded 8u101 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot, a different vulnerability than CVE-2016-5582. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5573 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2079.html P-1309V-6 P-1309V-7 This is a vulnerability in libvirt in Oracle Linux. libvirt before 2.0.0 improperly disables password checking when thepassword on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5008 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2577.html P-1309V-7 This is a vulnerability in nss and nss-util in Oracle Linux. Mozilla Network Security Services (NSS) before 3.23, as used inMozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2834 P-1309V-5 P-1309V-6 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2779.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in php in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5399 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2598.html P-1309V-7 This is a vulnerability in php in Oracle Linux. Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GDGraphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5766 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2598.html P-1309V-7 This is a vulnerability in php in Oracle Linux. Integer overflow in the gdImageCreate function in gd.c in the GDGraphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5767 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2598.html P-1309V-7 This is a vulnerability in poppler in Oracle Linux. Heap-based buffer overflow in theExponentialFunction::ExponentialFunction function in Poppler before 0.40.0 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via an invalid blend mode in the ExtGState dictionary in a crafted PDF document. CVSS Base Score: 5.1 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-8868 P-1309V-7 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2580.html P-1309V-7 This is a vulnerability in 389-ds-base in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-5416 P-1309V-7 5 AV:N/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2594.html P-1309V-7 This is a vulnerability in 389-ds-base in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-5416 P-1309V-6 5 AV:N/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2765.html P-1309V-6 This is a vulnerability in bind in Oracle Linux. buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2776 P-1309V-5 P-1309V-6 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1944.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in bind in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2848 P-1309V-5 P-1309V-6 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2093.html P-1309V-5 P-1309V-6 This is a vulnerability in bind in Oracle Linux. named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-8864 P-1309V-5 P-1309V-6 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2141.html P-1309V-5 P-1309V-6 This is a vulnerability in bind in Oracle Linux. named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-8864 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2615.html P-1309V-7 This is a vulnerability in bind97 in Oracle Linux. buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2776 P-1309V-5 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1945.html P-1309V-5 This is a vulnerability in bind97 in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2848 P-1309V-5 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2094.html P-1309V-5 This is a vulnerability in bind97 in Oracle Linux. named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-8864 P-1309V-5 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2142.html P-1309V-5 This is a vulnerability in libreswan in Oracle Linux. programs/pluto/ikev1.c in libreswan before 3.17 retransmits ininitial-responder states, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed UDP packet. NOTE: the original behavior complies with the IKEv1 protocol, but has a required security update from the libreswan vendor; as of 2016-06-10, it is expected that several other IKEv1 implementations will have vendor-required security updates, with separate CVE IDs assigned to each. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-5361 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2603.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The DTLS implementation in OpenSSL before 1.1.0 does not properlyrestrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2179 P-1309V-6 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1940.html P-1309V-6 P-1309V-7 This is a vulnerability in openssl in Oracle Linux. Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-6304 P-1309V-6 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1940.html P-1309V-6 P-1309V-7 This is a vulnerability in python-twisted-web in Oracle Linux. ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:N/Au:N/C:N/I:N/A:N. Fix has been released CVE-2016-1000111 P-1309V-6 5 AV:N/AC:N/Au:N/C:N/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1978.html P-1309V-6 This is a vulnerability in squid in Oracle Linux. Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly appenddata to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2569 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2600.html P-1309V-7 This is a vulnerability in squid in Oracle Linux. The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.xbefore 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2570 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2600.html P-1309V-7 This is a vulnerability in squid in Oracle Linux. http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds withthe storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2571 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2600.html P-1309V-7 This is a vulnerability in squid in Oracle Linux. http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code aftera response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2572 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2600.html P-1309V-7 This is a vulnerability in squid in Oracle Linux. Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform boundschecking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to Vary headers. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-3948 P-1309V-7 5 AV:N/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2600.html P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2015-5345 P-1309V-7 5 AV:N/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2599.html P-1309V-7 This is a vulnerability in tomcat6 in Oracle Linux. The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. CVSS Base Score: 5 CVSS V2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2015-5345 P-1309V-6 5 AV:N/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2045.html P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an add_key system call for an RSA key with a zero exponent. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-8650 P-1309V-6 P-1309V-7 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3648.html P-1309V-6 P-1309V-7 This is a vulnerability in curl in Oracle Linux. curl and libcurl before 7.50.1 do not check the client certificatewhen choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N. Fix has been released CVE-2016-5420 P-1309V-7 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2575.html P-1309V-7 This is a vulnerability in curl in Oracle Linux. curl and libcurl before 7.50.2, when built with NSS and thelibnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N. Fix has been released CVE-2016-7141 P-1309V-7 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2575.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The Linux kernel before 4.4.1 allows local users to bypassfile-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2013-4312 P-1309V-7 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. fs/pipe.c in the Linux kernel before 4.5 does not limit the amount ofunread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-2847 P-1309V-7 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in libvirt in Oracle Linux. Directory traversal vulnerability in thevirStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name. CVSS Base Score: 4.9 CVSS V2 Vector: AV:N/AC:H/Au:S/C:N/I:C/A:N. Fix has been released CVE-2015-5313 P-1309V-7 4.9 AV:N/AC:H/Au:S/C:N/I:C/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2577.html P-1309V-7 This is a vulnerability in util-linux in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.9 CVSS V2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-5011 P-1309V-7 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2605.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The trace_writeback_dirty_page implementation ininclude/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move. CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-3070 P-1309V-6 P-1309V-7 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3644.html P-1309V-6 P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Race condition in the ioctl_send_fib function indrivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a double CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-6480 P-1309V-6 P-1309V-7 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3644.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The trace_writeback_dirty_page implementation ininclude/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move. CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-3070 P-1309V-7 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. fs/pnode.c in the Linux kernel before 4.5.4 does not properly traversea mount propagation tree in a certain case involving a slave mount, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted series of mount system calls. CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-4581 P-1309V-7 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The filesystem layer in the Linux kernel before 4.5.5 proceeds withpost-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c. CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-6198 P-1309V-7 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before 4.5.1allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an ABORT_TASK command to abort a device write operation. CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-6327 P-1309V-7 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. Race condition in the ioctl_send_fib function indrivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a double CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-6480 P-1309V-7 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The trace_writeback_dirty_page implementation ininclude/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move. CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-3070 P-1309V-5 P-1309V-6 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3646.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Race condition in the ioctl_send_fib function indrivers/scsi/aacraid/commctrl.c in the Linux kernel through 4.7 allows local users to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value, aka a double CVSS Base Score: 4.7 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-6480 P-1309V-5 P-1309V-6 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3646.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The asn1_ber_decoder function in lib/asn1_decoder.c in the Linuxkernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c. CVSS Base Score: 4.6 CVSS V2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C. Fix has been released CVE-2016-2053 P-1309V-6 P-1309V-7 4.6 AV:L/AC:L/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3644.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The networking implementation in the Linux kernel through 4.3.3, asused in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application. CVSS Base Score: 4.6 CVSS V2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C. Fix has been released CVE-2015-8543 P-1309V-7 4.6 AV:L/AC:L/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The asn1_ber_decoder function in lib/asn1_decoder.c in the Linuxkernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c. CVSS Base Score: 4.6 CVSS V2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C. Fix has been released CVE-2016-2053 P-1309V-7 4.6 AV:L/AC:L/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in firewalld in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.4 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5410 P-1309V-7 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2597.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The signal implementation in the Linux kernel before 4.3.5 on powerpcplatforms does not check for an MSR with both the S and T bits set, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application. CVSS Base Score: 4.4 CVSS V2 Vector: AV:L/AC:M/Au:S/C:N/I:N/A:C. Fix has been released CVE-2015-8844 P-1309V-7 4.4 AV:L/AC:M/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The tm_reclaim_thread function in arch/powerpc/kernel/process.c in theLinux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application. CVSS Base Score: 4.4 CVSS V2 Vector: AV:L/AC:M/Au:S/C:N/I:N/A:C. Fix has been released CVE-2015-8845 P-1309V-7 4.4 AV:L/AC:M/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in libguestfs and virt-p2v in Oracle Linux. OCaml before 4.03.0 does not properly handle sign extensions, whichallows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function. CVSS Base Score: 4.4 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-8869 P-1309V-7 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2576.html P-1309V-7 This is a vulnerability in python in Oracle Linux. Integer overflow in the get_data function in zipimport.c in CPython(aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow. CVSS Base Score: 4.4 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5636 P-1309V-7 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2586.html P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.xbefore 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token. CVSS Base Score: 4.4 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P. Fix has been released CVE-2015-5351 P-1309V-7 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2599.html P-1309V-7 This is a vulnerability in firefox in Oracle Linux. Mozilla Firefox before 48.0 allows remote attackers to obtainsensitive information about the previously retrieved page via Resource Timing API calls. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-5250 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1912.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5291 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2780.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-9064 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2780.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-9895 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2946.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-9900 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2946.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-9901 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2946.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-9902 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2946.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in firefox in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-9904 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2946.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; andJava SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to JMX. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5554 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2658.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; andJava SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to JMX. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5554 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2079.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite loop) by making a H_CEDE hypercall during the existence of a suspended transaction. CVSS Base Score: 4.3 CVSS V2 Vector: AV:A/AC:H/Au:S/C:N/I:N/A:C. Fix has been released CVE-2016-5412 P-1309V-7 4.3 AV:A/AC:H/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in nss and nss-util in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-5285 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2779.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in nss and nss-util in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-8635 P-1309V-5 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2779.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-7701 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-7852 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-7977 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-7978 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-8158 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The Anti-Replay feature in the DTLS implementation in OpenSSL before1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2181 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1940.html P-1309V-6 P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2182 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1940.html P-1309V-6 P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2182 P-1309V-5 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3627.html P-1309V-5 This is a vulnerability in openssl in Oracle Linux. The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSecprotocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a Sweet32 attack. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2183 P-1309V-5 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3627.html P-1309V-5 This is a vulnerability in openssl in Oracle Linux. The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-6302 P-1309V-6 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1940.html P-1309V-6 P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. The setGlobalContext method inorg/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context. CVSS Base Score: 4.3 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-0763 P-1309V-7 4.3 AV:A/AC:M/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2599.html P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. The MultipartStream class in Apache Commons Fileupload before 1.3.2,as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string. CVSS Base Score: 4.3 CVSS V2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-3092 P-1309V-7 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2599.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The start_thread function in arch/powerpc/kernel/process.c in theLinux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by starting and suspending a transaction before an exec system call. CVSS Base Score: 4 CVSS V2 Vector: AV:L/AC:H/Au:N/C:N/I:N/A:C. Fix has been released CVE-2016-5828 P-1309V-7 4 AV:L/AC:H/Au:N/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in libgcrypt in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-6313 P-1309V-6 P-1309V-7 4 AV:N/AC:H/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2674.html P-1309V-6 P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-3492 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2595.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31and earlier, and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5612 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2595.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allowsremote authenticated users to affect availability via vectors related to DML. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5624 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2595.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to GIS. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5626 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2595.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32and earlier, and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Federated. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5629 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2595.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-8283 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2595.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N. Fix has been released CVE-2015-5194 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N. Fix has been released CVE-2015-5195 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2015-7703. Reason: This candidate is a reservation duplicate of CVE-2015-7703. Notes: All CVE users should reference CVE-2015-7703 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N. Fix has been released CVE-2015-5196 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:P. Fix has been released CVE-2015-7691 P-1309V-7 4 AV:N/AC:H/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:P. Fix has been released CVE-2015-7692 P-1309V-7 4 AV:N/AC:H/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:P. Fix has been released CVE-2015-7702 P-1309V-7 4 AV:N/AC:H/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N. Fix has been released CVE-2015-7703 P-1309V-7 4 AV:N/AC:L/Au:S/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. Directory traversal vulnerability in RequestUtil.java in Apache Tomcat6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the /webapps directory. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-5174 P-1309V-7 4 AV:N/AC:L/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2599.html P-1309V-7 This is a vulnerability in tomcat6 in Oracle Linux. Directory traversal vulnerability in RequestUtil.java in Apache Tomcat6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the /webapps directory. CVSS Base Score: 4 CVSS V2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-5174 P-1309V-6 4 AV:N/AC:L/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2045.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic. CVSS Base Score: 3.8 CVSS V2 Vector: AV:L/AC:H/Au:S/C:N/I:N/A:C. Fix has been released CVE-2015-8746 P-1309V-7 3.8 AV:L/AC:H/Au:S/C:N/I:N/A:C Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in qemu-kvm in Oracle Linux. Integer overflow in the VGA module in QEMU allows local guest OS usersto cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode. CVSS Base Score: 3.8 CVSS V2 Vector: AV:A/AC:M/Au:S/C:P/I:N/A:P. Fix has been released CVE-2016-3712 P-1309V-7 3.8 AV:A/AC:M/Au:S/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2585.html P-1309V-7 This is a vulnerability in fontconfig in Oracle Linux. fontconfig before 2.12.1 does not validate offsets, which allows localusers to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file. CVSS Base Score: 3.7 CVSS V2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-5384 P-1309V-7 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2601.html P-1309V-7 This is a vulnerability in glibc in Oracle Linux. Stack-based buffer overflow in the nss_dns implementation of thegetnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name. CVSS Base Score: 3.7 CVSS V2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-3075 P-1309V-7 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2573.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1allows local users to gain privileges by triggering access to a paging structure by a different CPU. CVSS Base Score: 3.7 CVSS V2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P. Fix has been released CVE-2016-2069 P-1309V-7 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peerassociations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a skeleton CVSS Base Score: 3.6 CVSS V2 Vector: AV:N/AC:H/Au:S/C:N/I:P/A:P. Fix has been released CVE-2015-7974 P-1309V-7 3.6 AV:N/AC:H/Au:S/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in sudo in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.6 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N. Fix has been released CVE-2016-7091 P-1309V-7 3.6 AV:L/AC:L/Au:N/C:P/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2593.html P-1309V-7 This is a vulnerability in 389-ds-base in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2016-4992 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2594.html P-1309V-7 This is a vulnerability in 389-ds-base in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2016-4992 P-1309V-6 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2765.html P-1309V-6 This is a vulnerability in kernel in Oracle Linux. fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandlescompressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8374 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in krb5 in Oracle Linux. The validate_as_request function in kdc_util.c in the Key DistributionCenter (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-3120 P-1309V-7 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2591.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32and earlier, and 5.7.14 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: MyISAM. CVSS Base Score: 3.5 CVSS V2 Vector: AV:L/AC:H/Au:S/C:P/I:P/A:P. Fix has been released CVE-2016-5616 P-1309V-7 3.5 AV:L/AC:H/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2595.html P-1309V-7 This is a vulnerability in mariadb in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.5 CVSS V2 Vector: AV:L/AC:H/Au:S/C:P/I:P/A:P. Fix has been released CVE-2016-6663 P-1309V-7 3.5 AV:L/AC:H/Au:S/C:P/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2595.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. fs/btrfs/inode.c in the Linux kernel before 4.3.3 mishandlescompressed inline extents, which allows local users to obtain sensitive pre-truncation information from a file via a clone action. CVSS Base Score: 3.5 CVSS V2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. Fix has been released CVE-2015-8374 P-1309V-5 P-1309V-6 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3618.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red HatEnterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd. CVSS Base Score: 3.3 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-3699 P-1309V-6 P-1309V-7 3.3 AV:L/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3644.html P-1309V-6 P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Race condition in the audit_log_single_execve_arg function inkernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a double CVSS Base Score: 3.3 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:P. Fix has been released CVE-2016-6136 P-1309V-6 P-1309V-7 3.3 AV:L/AC:M/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3644.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red HatEnterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd. CVSS Base Score: 3.3 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P. Fix has been released CVE-2016-3699 P-1309V-7 3.3 AV:L/AC:M/Au:N/C:N/I:P/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. Race condition in the audit_log_single_execve_arg function inkernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a double CVSS Base Score: 3.3 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:P. Fix has been released CVE-2016-6136 P-1309V-7 3.3 AV:L/AC:M/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in ntp in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 3.3 CVSS V2 Vector: AV:A/AC:L/Au:N/C:N/I:N/A:P. Fix has been released CVE-2015-5219 P-1309V-7 3.3 AV:A/AC:L/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2583.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. Race condition in the audit_log_single_execve_arg function inkernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a double CVSS Base Score: 3.3 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:P. Fix has been released CVE-2016-6136 P-1309V-5 P-1309V-6 3.3 AV:L/AC:M/Au:N/C:P/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3646.html P-1309V-5 P-1309V-6 This is a vulnerability in tomcat in Oracle Linux. Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31,and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. CVSS Base Score: 2.9 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-0706 P-1309V-7 2.9 AV:A/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2599.html P-1309V-7 This is a vulnerability in tomcat6 in Oracle Linux. Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31,and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. CVSS Base Score: 2.9 CVSS V2 Vector: AV:A/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-0706 P-1309V-6 2.9 AV:A/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2045.html P-1309V-6 This is a vulnerability in 389-ds-base in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-5405 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2594.html P-1309V-7 This is a vulnerability in 389-ds-base in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-5405 P-1309V-6 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2765.html P-1309V-6 This is a vulnerability in dhcp in Oracle Linux. ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4does not restrict the number of concurrent TCP sessions, which allows remote attackers to cause a denial of service (INSIST assertion failure or request-processing outage) by establishing many sessions. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2774 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2590.html P-1309V-7 This is a vulnerability in gimp in Oracle Linux. Use-after-free vulnerability in the xcf_load_image function inapp/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of service (program crash) or possibly execute arbitrary code via a crafted XCF file. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-4994 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2589.html P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; andJava SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5542 P-1309V-5 P-1309V-6 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2658.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.7.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; andJava SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors related to Networking. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-5597 P-1309V-5 P-1309V-6 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2658.html P-1309V-5 P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; andJava SE Embedded 8u101 allows remote attackers to affect integrity via vectors related to Libraries. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5542 P-1309V-6 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2079.html P-1309V-6 P-1309V-7 This is a vulnerability in java-1.8.0-openjdk in Oracle Linux. Unspecified vulnerability in Oracle Java SE 6u121, 7u111, 8u102; andJava SE Embedded 8u101 allows remote attackers to affect confidentiality via vectors related to Networking. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-5597 P-1309V-6 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2079.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c inthe Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2117 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. OpenSSL through 1.0.2h incorrectly uses pointer arithmetic forheap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2177 P-1309V-6 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1940.html P-1309V-6 P-1309V-7 This is a vulnerability in openssl in Oracle Linux. OpenSSL through 1.0.2h incorrectly uses pointer arithmetic forheap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2177 P-1309V-5 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3627.html P-1309V-5 This is a vulnerability in php in Oracle Linux. Double free vulnerability in the _php_mb_regex_ereg_replace_execfunction in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception. CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-5768 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2598.html P-1309V-7 This is a vulnerability in tomcat in Oracle Linux. Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, followsRFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an httpoxy issue. NOTE: the vendor states A CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5388 P-1309V-7 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2046.html P-1309V-7 This is a vulnerability in tomcat6 in Oracle Linux. Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, followsRFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an httpoxy issue. NOTE: the vendor states A CVSS Base Score: 2.6 CVSS V2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-5388 P-1309V-6 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2045.html P-1309V-6 This is a vulnerability in kvm in Oracle Linux. The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows localguest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion. CVSS Base Score: 2.3 CVSS V2 Vector: AV:A/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-5403 P-1309V-5 2.3 AV:A/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1943.html P-1309V-5 This is a vulnerability in qemu-kvm in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.3 CVSS V2 Vector: AV:A/AC:M/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-1981 P-1309V-7 2.3 AV:A/AC:M/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2585.html P-1309V-7 This is a vulnerability in NetworkManager in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-0764 P-1309V-7 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2581.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The snd_timer_user_params function in sound/core/timer.c in the Linuxkernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-4569 P-1309V-6 P-1309V-7 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3644.html P-1309V-6 P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. sound/core/timer.c in the Linux kernel through 4.6 does not initializecertain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-4578 P-1309V-6 P-1309V-7 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3644.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The snd_timer_user_params function in sound/core/timer.c in the Linuxkernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-4569 P-1309V-7 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in kernel in Oracle Linux. sound/core/timer.c in the Linux kernel through 4.6 does not initializecertain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-4578 P-1309V-7 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in krb5 in Oracle Linux. The process_db_args function inplugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal. CVSS Base Score: 2.1 CVSS V2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-3119 P-1309V-7 2.1 AV:N/AC:H/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2591.html P-1309V-7 This is a vulnerability in libvirt in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2015-5160 P-1309V-7 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2577.html P-1309V-7 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. The snd_timer_user_params function in sound/core/timer.c in the Linuxkernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-4569 P-1309V-5 P-1309V-6 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3646.html P-1309V-5 P-1309V-6 This is a vulnerability in Unbreakable Enterprise kernel in Oracle Linux. sound/core/timer.c in the Linux kernel through 4.6 does not initializecertain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions. CVSS Base Score: 2.1 CVSS V2 Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-4578 P-1309V-5 P-1309V-6 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3646.html P-1309V-5 P-1309V-6 This is a vulnerability in mod_nss in Oracle Linux. ** RESERVED **This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:N. Fix has been released CVE-2016-3099 P-1309V-7 1.9 AV:L/AC:M/Au:N/C:N/I:P/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2602.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSLthrough 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack. CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2178 P-1309V-6 P-1309V-7 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1940.html P-1309V-6 P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSLthrough 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack. CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N. Fix has been released CVE-2016-2178 P-1309V-5 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3627.html P-1309V-5 This is a vulnerability in openssl in Oracle Linux. The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the openssl CVSS Base Score: 1.9 CVSS V2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-2180 P-1309V-6 P-1309V-7 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1940.html P-1309V-6 P-1309V-7 This is a vulnerability in kernel in Oracle Linux. The IPv4 implementation in the Linux kernel before 4.5.2 mishandlesdestruction of device objects, which allows guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses. CVSS Base Score: 1.7 CVSS V2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P. Fix has been released CVE-2016-3156 P-1309V-7 1.7 AV:L/AC:L/Au:S/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-2574.html P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c. CVSS Base Score: 1.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-6306 P-1309V-6 P-1309V-7 1.2 AV:L/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-1940.html P-1309V-6 P-1309V-7 This is a vulnerability in openssl in Oracle Linux. The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c. CVSS Base Score: 1.2 CVSS V2 Vector: AV:L/AC:H/Au:N/C:N/I:N/A:P. Fix has been released CVE-2016-6306 P-1309V-5 1.2 AV:L/AC:H/Au:N/C:N/I:N/A:P Oracle Linux Security Advisory Oracle Linux customers http://linux.oracle.com/errata/ELSA-2016-3627.html P-1309V-5