Oracle Solaris Third Party Bulletin - July 2016
Description
The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities fixed in third party software that is included in Oracle Solaris distributions. Starting January 20, 2015, Third Party Bulletins are released on the same day when Oracle Critical Patch Updates are released. These bulletins will also be updated on the Tuesday closest to the 17th of the following two months after their release (i.e. the two months between the normal quarterly Critical Patch Update publication dates). In addition, Third Party Bulletins may also be updated for vulnerability fixes deemed too critical to wait for the next monthly update.
Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply Third Party Bulletin fixes as soon as possible.
Patch Availability
Please see My Oracle Support Note 1448883.1
Third Party Bulletin Schedule
Third Party Bulletins are released on the Tuesday closest to the 17th day of January, April, July and October. The next four dates are:
- 18 October 2016
- 17 January 2017
- 18 April 2017
- 18 July 2017
References
- Oracle Critical Patch Updates and Security Alerts main page [ Oracle Technology Network ]
- Oracle Critical Patch Updates and Security Alerts - Frequently Asked Questions [ CPU FAQ ]
- Risk Matrix definitions [ Risk Matrix Definitions ]
- Use of Common Vulnerability Scoring System (CVSS) by Oracle [ Oracle CVSS Scoring ]
Modification History
| 2017-April-10 | Rev 6. Added CVE-2015-8959 |
| 2017-February-09 | Rev 5. Added CVE-2016-1762 |
| 2016-September-28 | Rev 4. Added all CVEs fixed in Solaris 11.3 SRU12.4 and OpenSSL CVEs |
| 2016-September-02 | Rev 3. Added new CVEs |
| 2016-August-24 | Rev 2. Added all CVEs fixed in Solaris 11.3 SRU11.6 |
| 2016-July-19 | Rev 1. Initial Release |
Oracle Solaris Executive Summary
This Third Party Bulletin contains 56 new security fixes for the Oracle Solaris. 45 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.
Oracle Solaris Risk Matrix
Revision 4: Published on 2016-09-28
| CVE# | Product | Protocol | Third Partycomponent | Remote Exploit without Auth.? | CVSS VERSION 2.0 RISK (see Risk Matrix Definitions) | Supported Versions Affected | Notes | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Base Score | Access Vector | Access Complexity | Authentication | Confidentiality | Integrity | Availability | |||||||
| CVE-2016-6304 | Solaris | SSL/TLS | OpenSSL | Yes | 7.8 | Network | Low | None | None | None | Complete | 11.3, 10 | |
| CVE-2013-1511 | Solaris | Multiple | MySQL | No | 7.5 | Network | Medium | Single | Partial | Partial | Complete | 11.3 | See Note 15 |
| CVE-2015-4752 | Solaris | Multiple | MySQL | No | 7.5 | Network | Medium | Single | Partial | Partial | Complete | 11.3 | See Note 17 |
| CVE-2016-2182 | Solaris | SSL/TLS | OpenSSL | Yes | 7.5 | Network | Low | None | Partial | Partial | Partial | 11.3, 10 | |
| CVE-2015-4756 | Solaris | None | MySQL | No | 7.2 | Local | Low | None | Complete | Complete | Complete | 11.3 | See Note 14 |
| CVE-2014-9655 | Solaris | Multiple | LibTIFF | Yes | 5.8 | Network | Medium | None | Partial | None | Partial | 11.3, 10 | See Note 16 |
| CVE-2014-9330 | Solaris | Multiple | LibTIFF | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.3, 10 | |
| CVE-2016-6261 | Solaris | Multiple | Libidn | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.3 | See Note 12 |
| CVE-2016-2180 | Solaris | SSL/TLS | OpenSSL | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.3, 10 | |
| CVE-2016-2179 | Solaris | SSL/TLS | OpenSSL | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.3, 10 | |
| CVE-2016-2181 | Solaris | SSL/TLS | OpenSSL | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.3, 10 | |
| CVE-2016-6185 | Solaris | None | Perl | No | 4.6 | Local | Low | None | Partial | Partial | Partial | 11.3, 10 | |
| CVE-2016-2775 | Solaris | DNS | Bind | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.3, 10 | |
| CVE-2016-6503 | Solaris | Multiple | Wireshark | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.3 | See Note 13 |
| CVE-2016-6306 | Solaris | SSL/TLS | OpenSSL | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.3, 10 | |
| CVE-2016-4428 | Solaris | Multiple | OpenStack Horizon | No | 3.5 | Network | Medium | Single | None | Partial | None | 11.3 | |
Revision 3: Published on 2016-09-02
| CVE# | Product | Protocol | Third Partycomponent | Remote Exploit without Auth.? | CVSS VERSION 2.0 RISK (see Risk Matrix Definitions) | Supported Versions Affected | Notes | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Base Score | Access Vector | Access Complexity | Authentication | Confidentiality | Integrity | Availability | |||||||
| CVE-2016-2521 | Solaris | None | Wireshark | No | 7.2 | Local | Low | None | Complete | Complete | Complete | 11.3 | See Note 11 |
| CVE-2016-3717 | Solaris | Multiple | ImageMagick | Yes | 7.1 | Network | Medium | None | Complete | None | None | 11.3, 10 | |
| CVE-2016-4562 | Solaris | Multiple | ImageMagick | Yes | 6.8 | Network | Medium | None | Partial | Partial | Partial | 11.3, 10 | See Note 10 |
| CVE-2016-3715 | Solaris | Multiple | ImageMagick | Yes | 5.8 | Network | Medium | None | None | Partial | Partial | 11.3, 10 | |
| CVE-2016-2381 | Solaris | Multiple | Perl | Yes | 5.0 | Network | Low | None | None | Partial | None | 11.3 | |
| CVE-2016-4006 | Solaris | Multiple | Wireshark | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.3 | See Note 9 |
| CVE-2016-3716 | Solaris | Multiple | ImageMagick | Yes | 4.3 | Network | Medium | None | None | Partial | None | 11.3, 10 | |
| CVE-2016-3718 | Solaris | Multiple | ImageMagick | Yes | 4.3 | Network | Medium | None | None | Partial | None | 11.3, 10 | |
Revision 2: Published on 2016-08-24
| CVE# | Product | Protocol | Third Partycomponent | Remote Exploit without Auth.? | CVSS VERSION 2.0 RISK (see Risk Matrix Definitions) | Supported Versions Affected | Notes | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Base Score | Access Vector | Access Complexity | Authentication | Confidentiality | Integrity | Availability | |||||||
| CVE-2016-3092 | Solaris | Multiple | Apache Tomcat | Yes | 7.8 | Network | Low | None | None | None | Complete | 11.3 | |
| CVE-2016-0718 | Solaris | Multiple | libexpat | Yes | 7.5 | Network | Low | None | Partial | Partial | Partial | 11.3, 10 | |
| CVE-2015-3228 | Solaris | Multiple | Ghostscript | Yes | 6.8 | Network | Medium | None | Partial | Partial | Partial | 11.3, 10 | |
| CVE-2015-1283 | Solaris | Multiple | libexpat | Yes | 6.8 | Network | Medium | None | Partial | Partial | Partial | 11.3, 10 | |
| CVE-2016-1833 | Solaris | Multiple | libxml2 | Yes | 6.8 | Network | Medium | None | Partial | Partial | Partial | 11.3, 10 | See Note 7 |
| CVE-2016-5841 | Solaris | Multiple | ImageMagick | Yes | 6.8 | Network | Medium | None | Partial | Partial | Partial | 11.3, 10 | See Note 6 |
| CVE-2013-2561 | Solaris | None | OpenFabrics ibutils | No | 6.3 | Local | Medium | None | None | Complete | Complete | 11.3 | |
| CVE-2016-6491 | Solaris | Multiple | ImageMagick | Yes | 5.8 | Network | Medium | None | Partial | None | Partial | 11.3, 10 | |
| CVE-2016-3627 | Solaris | Multiple | libxml2 | Yes | 5.0 | Network | Low | None | None | None | Partial | 11.3 | |
| CVE-2016-6185 | Solaris | None | Perl | No | 4.6 | Local | Low | None | Partial | Partial | Partial | 11.3 | |
| CVE-2016-4483 | Solaris | Multiple | libxml2 | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.3 | |
| CVE-2016-5355 | Solaris | Multiple | Wireshark | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.3 | See Note 8 |
| CVE-2012-0876 | Solaris | Multiple | libexpat | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.3 | See Note 3 |
| CVE-2016-4971 | Solaris | Multiple | Wget | Yes | 4.3 | Network | Medium | None | None | Partial | None | 11.3, 10 | |
| CVE-2016-2177 | Solaris | SSL/TLS | WanBoot | Yes | 4.3 | Network | Medium | None | None | None | Partial | 10 | See Note 2 |
| CVE-2015-8934 | Solaris | Multiple | Libarchive | No | 3.5 | Network | Medium | Single | Partial | None | None | 11.3 | See Note 5 |
| CVE-2015-7987 | Solaris | DNS | DNS Service | Yes | 2.6 | Network | High | None | None | None | Partial | 11.3 | See Note 4 |
Revision 1: Published on 2016-07-19
| CVE# | Product | Protocol | Third Partycomponent | Remote Exploit without Auth.? | CVSS VERSION 2.0 RISK (see Risk Matrix Definitions) | Supported Versions Affected | Notes | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Base Score | Access Vector | Access Complexity | Authentication | Confidentiality | Integrity | Availability | |||||||
| CVE-2015-8540 | Solaris | Multiple | LibPNG | Yes | 9.3 | Network | Medium | None | Complete | Complete | Complete | 11.3, 10 | |
| CVE-2015-8126 | Solaris | Multiple | LibPNG | Yes | 7.5 | Network | Low | None | Partial | Partial | Partial | 11.3 | |
| CVE-2015-7501 | Solaris | Multiple | Apache Commons Collections | Yes | 7.5 | Network | Low | None | Partial | Partial | Partial | 11.3 | |
| CVE-2016-2774 | Solaris | DHCP | DHCP Server | Yes | 7.1 | Network | Medium | None | None | None | Complete | 11.3 | |
| CVE-2016-1541 | Solaris | Multiple | Libarchive | Yes | 6.8 | Network | Medium | None | Partial | Partial | Partial | 11.3 | |
| CVE-2016-5691 | Solaris | Multiple | ImageMagick | Yes | 5.8 | Network | Medium | None | None | Partial | Partial | 11.3 | See Note 1 |
| CVE-2016-0772 | Solaris | Multiple | Python | Yes | 5.8 | Network | Medium | None | Partial | Partial | None | 11.3 | |
| CVE-2015-7981 | Solaris | Multiple | LibPNG | Yes | 5.0 | Network | Low | None | Partial | None | None | 11.3 | |
| CVE-2015-8853 | Solaris | Multiple | Perl | Yes | 5.0 | Network | Low | None | None | None | Partial | 10 | |
| CVE-2016-5699 | Solaris | Multiple | Python | Yes | 5.0 | Network | Low | None | None | Partial | None | 11.3 | |
| CVE-2016-5636 | Solaris | None | Python | No | 4.4 | Local | Medium | None | Partial | Partial | Partial | 11.3 | |
| CVE-2014-3566 | Solaris | Multiple | Open Source Web Services Manager (OpenWSMan) | Yes | 4.3 | Network | Medium | None | Partial | None | None | 11.3 | |
| CVE-2013-7447 | Solaris | Multiple | GTK+ Toolkit | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.3, 10 | |
| CVE-2016-3189 | Solaris | Multiple | BZip | Yes | 4.3 | Network | Medium | None | None | None | Partial | 11.3, 10 | |
| CVE-2015-8025 | Solaris | None | XScreenSaver | No | 2.1 | Local | Low | None | None | Partial | None | 11.3, 10 | |
Notes:
- This fix also addresses CVE-2016-5687 CVE-2016-5688 CVE-2016-5689 CVE-2016-5690.
- This fix also addresses CVE-2016-2178.
- This fix also addresses CVE-2016-5300.
- This fix also addresses CVE-2015-7988.
- This fix also addresses CVE-2016-4300 CVE-2016-4301 CVE-2016-4302 CVE-2016-5844.
- This fix also addresses CVE-2016-5842.
- This fix also addresses CVE-2015-8806 CVE-2016-1762 CVE-2016-1835 CVE-2016-1836 CVE-2016-1837 CVE-2016-1838 CVE-2016-1839 CVE-2016-1840 CVE-2016-2073 CVE-2016-3705 CVE-2016-4447 CVE-2016-4448 CVE-2016-4449.
- This fix also addresses CVE-2016-5350 CVE-2016-5351 CVE-2016-5352 CVE-2016-5353 CVE-2016-5354 CVE-2016-5356 CVE-2016-5357 CVE-2016-5358.
- This fix also addresses CVE-2016-4078 CVE-2016-4079 CVE-2016-4080 CVE-2016-4081 CVE-2016-4082.
- This fix also addresses CVE-2015-8959 CVE-2016-3714 CVE-2016-3715 CVE-2016-3716 CVE-2016-3717 CVE-2016-3718 CVE-2016-4563 CVE-2016-4564 CVE-2016-5118.
- This fix also addresses CVE-2016-2530 CVE-2016-2531 CVE-2016-2532 CVE-2016-4417 CVE-2016-4418 CVE-2016-4421.
- This fix also addresses CVE-2015-8948 CVE-2016-6262 CVE-2016-6263.
- This fix also addresses CVE-2016-6504 CVE-2016-6505 CVE-2016-6506 CVE-2016-6507 CVE-2016-6508 CVE-2016-6509 CVE-2016-6510 CVE-2016-6511 CVE-2016-6512 CVE-2016-6513.
- This fix also addresses CVE-2014-3569 CVE-2015-0385 CVE-2015-0405 CVE-2015-0423 CVE-2015-0438 CVE-2015-0439 CVE-2015-0498 CVE-2015-0500 CVE-2015-0503 CVE-2015-0506 CVE-2015-0507 CVE-2015-0508 CVE-2015-0511 CVE-2015-2566 CVE-2015-2567 CVE-2015-2611 CVE-2015-2617 CVE-2015-2639 CVE-2015-2641 CVE-2015-2661 CVE-2015-4737 CVE-2015-4761 CVE-2015-4767 CVE-2015-4769 CVE-2015-4771 CVE-2015-4772.
- This fix also addresses CVE-2014-2432 CVE-2014-2440 CVE-2014-2494 CVE-2014-3569 CVE-2014-4243 CVE-2014-4260 CVE-2014-4287 CVE-2014-6464 CVE-2014-6484 CVE-2014-6494 CVE-2014-6496 CVE-2014-6505 CVE-2014-6507 CVE-2014-6520 CVE-2014-6530 CVE-2014-6555 CVE-2014-6559 CVE-2014-6568 CVE-2015-0385 CVE-2015-0391 CVE-2015-0405 CVE-2015-0423 CVE-2015-0432 CVE-2015-0433 CVE-2015-0438 CVE-2015-0439 CVE-2015-0498 CVE-2015-0499 CVE-2015-0500 CVE-2015-0503 CVE-2015-0505 CVE-2015-0506 CVE-2015-0507 CVE-2015-0508 CVE-2015-0511 CVE-2015-2566 CVE-2015-2567 CVE-2015-2611 CVE-2015-2617 CVE-2015-2639 CVE-2015-2641 CVE-2015-2661 CVE-2015-4737 CVE-2015-4756 CVE-2015-4761 CVE-2015-4767 CVE-2015-4769 CVE-2015-4771 CVE-2015-4772.
- This fix also addresses CVE-2015-1547.
- This fix also addresses CVE-2014-6464 CVE-2014-6469 CVE-2014-6491 CVE-2014-6494 CVE-2014-6496 CVE-2014-6500 CVE-2014-6507 CVE-2014-6555 CVE-2014-6559 CVE-2014-6568 CVE-2015-0374 CVE-2015-0381 CVE-2015-0382 CVE-2015-0411 CVE-2015-0432 CVE-2015-0433 CVE-2015-0441 CVE-2015-0499 CVE-2015-0505 CVE-2015-2568 CVE-2015-2571 CVE-2015-2573 CVE-2015-2643 CVE-2015-2648.