LanGuard reports



Supported OVAL Bulletins


More information on 2016 updates


ID:
CISEC:333		 Title:
oval:org.cisecurity:def:333: Internet Explorer Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:333
CVE-2015-6082 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability", a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, and CVE-2015-6080.
Applies to:
Internet Explorer 11		 Created:
2015-12-28		 Updated:
2016-02-08
ID:
CVE-2015-7755		 Title:
Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before...		 Type:
Hardware		 Bulletins:
CVE-2015-7755
SFBID79626 		Severity:
High
Description:
Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.
Applies to:
 Created:
2015-12-19		 Updated:
2017-08-09
ID:
CVE-2015-7756		 Title:
The encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18...		 Type:
Hardware		 Bulletins:
CVE-2015-7756 		Severity:
Medium
Description:
The encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 makes it easier for remote attackers to discover the plaintext content of VPN sessions by sniffing the network for ciphertext data and conducting an unspecified decryption attack.
Applies to:
 Created:
2015-12-19		 Updated:
2017-08-09
ID:
CISEC:311		 Title:
oval:org.cisecurity:def:311: Internet Explorer Memory Corruption Vulnerability		 Type:
Software		 Bulletins:
CISEC:311
CVE-2015-2427 		Severity:
Low
Description:
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 9		 Created:
2015-12-18		 Updated:
2016-02-08
ID:
CVE-2015-7037		 Title:
Directory traversal vulnerability in Mobile Backup in Photos in Apple iOS before 9.2 allows attackers to read arbitrary files via a crafted pathname.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7037 		Severity:
Medium
Description:
Directory traversal vulnerability in Mobile Backup in Photos in Apple iOS before 9.2 allows attackers to read arbitrary files via a crafted pathname.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-7050		 Title:
WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7050
SFBID78722 		Severity:
Medium
Description:
WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-7062		 Title:
Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-profile installation restrictions via unspecified vectors.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7062 		Severity:
Medium
Description:
Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-profile installation restrictions via unspecified vectors.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-7069		 Title:
Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7070.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7069 		Severity:
High
Description:
Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7070.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-7070		 Title:
Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7069.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7070 		Severity:
High
Description:
Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7069.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-7080		 Title:
Siri in Apple iOS before 9.2 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7080 		Severity:
Low
Description:
Siri in Apple iOS before 9.2 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-7081		 Title:
iBooks in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to read arbitrary files via an iBooks file containing an XML external entity declaration in conjunction with an entity reference, related to an XML...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7081 		Severity:
Medium
Description:
iBooks in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to read arbitrary files via an iBooks file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-7094		 Title:
CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7094 		Severity:
Low
Description:
CFNetwork HTTPProtocol in Apple iOS before 9.2 and OS X before 10.11.2 allows man-in-the-middle attackers to bypass the HSTS protection mechanism via a crafted URL.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-7107		 Title:
QuickLook in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted iWork file.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7107 		Severity:
Medium
Description:
QuickLook in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted iWork file.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-7109		 Title:
IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7109 		Severity:
High
Description:
IOAcceleratorFamily in Apple OS X before 10.11.2 and tvOS before 9.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-7110		 Title:
The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted disk image.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7110 		Severity:
Medium
Description:
The Disk Images component in Apple OS X before 10.11.2 and tvOS before 9.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted disk image.
Applies to:
 Created:
2015-12-11		 Updated:
2017-08-09
ID:
CVE-2015-6616		 Title:
mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 24630158 and...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6616 		Severity:
High
Description:
mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 24630158 and 23882800, a different vulnerability than CVE-2015-8505, CVE-2015-8506, and CVE-2015-8507.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6617		 Title:
Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23648740.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6617 		Severity:
High
Description:
Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23648740.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6618		 Title:
Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment, aka internal bug 24595992.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6618 		Severity:
Medium
Description:
Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment, aka internal bug 24595992.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6619		 Title:
The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6619 		Severity:
High
Description:
The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6620		 Title:
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 24123723 and...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6620 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 24123723 and 24445127.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6621		 Title:
SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23909438.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6621 		Severity:
High
Description:
SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23909438.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6622		 Title:
The Native Frameworks Library in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6622 		Severity:
Medium
Description:
The Native Frameworks Library in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23905002.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6623		 Title:
Wi-Fi in Android 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24872703.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6623 		Severity:
High
Description:
Wi-Fi in Android 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24872703.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6624		 Title:
System Server in Android 6.0 before 2015-12-01 allows attackers to obtain sensitive information via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23999740.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6624 		Severity:
Medium
Description:
System Server in Android 6.0 before 2015-12-01 allows attackers to obtain sensitive information via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23999740.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6625		 Title:
System Server in Android 6.0 before 2015-12-01 allows attackers to obtain sensitive information and consequently gain privileges via a crafted application, aka internal bug 23936840.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6625 		Severity:
Medium
Description:
System Server in Android 6.0 before 2015-12-01 allows attackers to obtain sensitive information and consequently gain privileges via a crafted application, aka internal bug 23936840.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6626		 Title:
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6626 		Severity:
Medium
Description:
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24310423.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6627		 Title:
The Audio component in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information via a crafted audio file, as demonstrated by obtaining Signature or SignatureOrSystem access, aka...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6627 		Severity:
Low
Description:
The Audio component in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information via a crafted audio file, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24211743.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6628		 Title:
Media Framework in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6628 		Severity:
Medium
Description:
Media Framework in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24074485.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6629		 Title:
Wi-Fi in Android 5.x before 5.1.1 LMY48Z allows attackers to obtain sensitive information via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 22667667.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6629 		Severity:
Medium
Description:
Wi-Fi in Android 5.x before 5.1.1 LMY48Z allows attackers to obtain sensitive information via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 22667667.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6630		 Title:
SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to read screenshots and consequently gain privileges via a crafted application, aka internal bug 19121797.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6630 		Severity:
Medium
Description:
SystemUI in Android 5.x before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to read screenshots and consequently gain privileges via a crafted application, aka internal bug 19121797.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6631		 Title:
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6631 		Severity:
Medium
Description:
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24623447.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6632		 Title:
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6632 		Severity:
Medium
Description:
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24346430.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6633		 Title:
The display drivers in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23987307.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6633 		Severity:
High
Description:
The display drivers in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23987307.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6634		 Title:
The display drivers in Android before 5.1.1 LMY48Z allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24163261.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6634 		Severity:
High
Description:
The display drivers in Android before 5.1.1 LMY48Z allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24163261.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-8505		 Title:
mediaserver in Android before 5.1.1 LMY48Z allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 17769851, a different vulnerability than...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-8505 		Severity:
High
Description:
mediaserver in Android before 5.1.1 LMY48Z allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 17769851, a different vulnerability than CVE-2015-6616, CVE-2015-8506, and CVE-2015-8507.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-8506		 Title:
mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24441553, a different...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-8506 		Severity:
High
Description:
mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24441553, a different vulnerability than CVE-2015-6616, CVE-2015-8505, and CVE-2015-8507.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-8507		 Title:
mediaserver in Android 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24157524, a different vulnerability than...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-8507 		Severity:
High
Description:
mediaserver in Android 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24157524, a different vulnerability than CVE-2015-6616, CVE-2015-8505, and CVE-2015-8506.
Applies to:
 Created:
2015-12-08		 Updated:
2017-08-09
ID:
CVE-2015-6783		 Title:
The FindStartOffsetOfFileInZipFile function in crazy_linker_zip.cpp in crazy_linker (aka Crazy Linker) in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6783
SFBID78416 		Severity:
Medium
Description:
The FindStartOffsetOfFileInZipFile function in crazy_linker_zip.cpp in crazy_linker (aka Crazy Linker) in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP archive.
Applies to:
 Created:
2015-12-05		 Updated:
2017-08-09
ID:
CVE-2015-5787		 Title:
The kernel in Apple iOS before 8.4.1 does not properly restrict debugging features, which allows attackers to bypass background-execution limitations via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5787 		Severity:
Medium
Description:
The kernel in Apple iOS before 8.4.1 does not properly restrict debugging features, which allows attackers to bypass background-execution limitations via a crafted app.
Applies to:
 Created:
2015-11-21		 Updated:
2017-08-09
ID:
CVE-2015-5859		 Title:
The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5859 		Severity:
Medium
Description:
The CFNetwork HTTPProtocol component in Apple iOS before 9 and OS X before 10.11 does not properly recognize the HSTS preload list during a Safari private-browsing session, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Applies to:
 Created:
2015-11-21		 Updated:
2017-08-09
ID:
CVE-2015-7036		 Title:
The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7036 		Severity:
High
Description:
The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument.
Applies to:
 Created:
2015-11-21		 Updated:
2017-08-09
ID:
CVE-2015-6608		 Title:
mediaserver in Android 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 19779574,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6608 		Severity:
High
Description:
mediaserver in Android 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 19779574, 23680780, 23876444, and 23658148, a different vulnerability than CVE-2015-8072 and CVE-2015-8073.
Applies to:
 Created:
2015-11-03		 Updated:
2017-08-09
ID:
CVE-2015-6609		 Title:
libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6609 		Severity:
High
Description:
libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.
Applies to:
 Created:
2015-11-03		 Updated:
2017-08-09
ID:
CVE-2015-6610		 Title:
libstagefright in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka internal bug 23707088.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6610 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka internal bug 23707088.
Applies to:
 Created:
2015-11-03		 Updated:
2017-08-09
ID:
CVE-2015-6611		 Title:
mediaserver in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6611 		Severity:
Medium
Description:
mediaserver in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23905951, 23912202, 23953967, 23696300, 23600291, 23756261, 23541506, 23284974, 23542351, and 23542352, a different vulnerability than CVE-2015-8074.
Applies to:
 Created:
2015-11-03		 Updated:
2017-08-09
ID:
CVE-2015-6612		 Title:
libmedia in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain privileges via a crafted application, aka internal bug 23540426.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6612 		Severity:
High
Description:
libmedia in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to gain privileges via a crafted application, aka internal bug 23540426.
Applies to:
 Created:
2015-11-03		 Updated:
2017-08-09
ID:
CVE-2015-6613		 Title:
Bluetooth in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to send commands to a debugging port, and consequently gain privileges, via a crafted application, as demonstrated by obtaining Signature or...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6613 		Severity:
Medium
Description:
Bluetooth in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows attackers to send commands to a debugging port, and consequently gain privileges, via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24371736.
Applies to:
 Created:
2015-11-03		 Updated:
2017-08-09
ID:
CVE-2015-6614		 Title:
Telephony in Android 5.x before 5.1.1 LMY48X allows attackers to gain privileges, and consequently bypass intended network-interface restrictions, perform expensive data transfers, or cause a denial of service (call-reception outage...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6614 		Severity:
Medium
Description:
Telephony in Android 5.x before 5.1.1 LMY48X allows attackers to gain privileges, and consequently bypass intended network-interface restrictions, perform expensive data transfers, or cause a denial of service (call-reception outage or mute manipulation), via a crafted application, aka internal bug 21900139.
Applies to:
 Created:
2015-11-03		 Updated:
2017-08-09
ID:
CVE-2015-8072		 Title:
mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-8072 		Severity:
High
Description:
mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23881715, a different vulnerability than CVE-2015-6608 and CVE-2015-8073.
Applies to:
 Created:
2015-11-03		 Updated:
2017-08-09
ID:
CVE-2015-8073		 Title:
mediaserver in Android 4.4 and 5.1 before 5.1.1 LMY48X allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 14388161, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-8073 		Severity:
High
Description:
mediaserver in Android 4.4 and 5.1 before 5.1.1 LMY48X allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 14388161, a different vulnerability than CVE-2015-6608 and CVE-2015-8072.
Applies to:
 Created:
2015-11-03		 Updated:
2017-08-09
ID:
CVE-2015-8074		 Title:
mediaserver in Android before 5.1.1 LMY48X allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23540907 and 23515142, a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-8074 		Severity:
Medium
Description:
mediaserver in Android before 5.1.1 LMY48X allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, aka internal bugs 23540907 and 23515142, a different vulnerability than CVE-2015-6611.
Applies to:
 Created:
2015-11-03		 Updated:
2017-08-09
ID:
CVE-2015-6995		 Title:
The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6995
SFBID77263 		Severity:
Medium
Description:
The Disk Images component in Apple iOS before 9.1 and OS X before 10.11.1 misparses images, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6999		 Title:
The OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows remote attackers to spoof a valid certificate by leveraging access to a revoked certificate.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6999
SFBID77268 		Severity:
Medium
Description:
The OCSP client in Apple iOS before 9.1 does not check for certificate expiry, which allows remote attackers to spoof a valid certificate by leveraging access to a revoked certificate.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7000		 Title:
Notification Center in Apple iOS before 9.1 mishandles changes to "Show on Lock Screen" settings, which allows physically proximate attackers to obtain sensitive information by looking for a (1) Phone or (2) Messages notification on...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7000
SFBID77268 		Severity:
Low
Description:
Notification Center in Apple iOS before 9.1 mishandles changes to "Show on Lock Screen" settings, which allows physically proximate attackers to obtain sensitive information by looking for a (1) Phone or (2) Messages notification on the lock screen soon after a setting was disabled.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7002		 Title:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7002
SFBID77267 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7004		 Title:
The kernel in Apple iOS before 9.1 allows attackers to cause a denial of service via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7004
SFBID77268 		Severity:
High
Description:
The kernel in Apple iOS before 9.1 allows attackers to cause a denial of service via a crafted app.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7005		 Title:
WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7005 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7008		 Title:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7008
SFBID77263 		Severity:
Medium
Description:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7009		 Title:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7009
SFBID77263 		Severity:
Medium
Description:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7010, and CVE-2015-7018.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7010		 Title:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7010
SFBID77263 		Severity:
Medium
Description:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7018.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7012		 Title:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7012
SFBID77267 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7013		 Title:
WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7013
SFBID77264 		Severity:
Medium
Description:
WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-3 and APPLE-SA-2015-10-21-5.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-5924		 Title:
The OpenGL implementation in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5924
SFBID77263 		Severity:
Medium
Description:
The OpenGL implementation in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-5928		 Title:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5928
SFBID77267 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-5929		 Title:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5929
SFBID77267 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-5930		 Title:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5930
SFBID77267 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-5940		 Title:
The Accelerate Framework component in Apple iOS before 9.1 and OS X before 10.11.1, when multi-threading is enabled, omits certain validation and locking steps, which allows remote attackers to execute arbitrary code or cause a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5940
SFBID77263 		Severity:
Medium
Description:
The Accelerate Framework component in Apple iOS before 9.1 and OS X before 10.11.1, when multi-threading is enabled, omits certain validation and locking steps, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6975		 Title:
CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6975 		Severity:
High
Description:
CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6992 and CVE-2015-7017.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6976		 Title:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6977,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6976
SFBID77263 		Severity:
Medium
Description:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6977		 Title:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6977
SFBID77263 		Severity:
Medium
Description:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6981		 Title:
WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6981 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6982		 Title:
WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6982 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6983		 Title:
Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptors.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6983
SFBID77263 		Severity:
High
Description:
Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptors.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6986		 Title:
com.apple.driver.AppleVXD393 in the Graphics Driver subsystem in Apple iOS before 9.1 allows attackers to execute arbitrary code via a crafted app that leverages an unspecified "type confusion."		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6986
SFBID77268 		Severity:
High
Description:
com.apple.driver.AppleVXD393 in the Graphics Driver subsystem in Apple iOS before 9.1 allows attackers to execute arbitrary code via a crafted app that leverages an unspecified "type confusion."
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6988		 Title:
The kernel in Apple iOS before 9.1 and OS X before 10.11.1 does not initialize an unspecified data structure, which allows remote attackers to execute arbitrary code via vectors involving an unknown network-connectivity requirement.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6988
SFBID77263 		Severity:
High
Description:
The kernel in Apple iOS before 9.1 and OS X before 10.11.1 does not initialize an unspecified data structure, which allows remote attackers to execute arbitrary code via vectors involving an unknown network-connectivity requirement.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6990		 Title:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6990
SFBID77263 		Severity:
Medium
Description:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6991		 Title:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6991
SFBID77263 		Severity:
Medium
Description:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6992		 Title:
CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6992 		Severity:
High
Description:
CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6975 and CVE-2015-7017.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6993		 Title:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6993
SFBID77263 		Severity:
Medium
Description:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-6994		 Title:
The kernel in Apple iOS before 9.1 and OS X before 10.11.1 mishandles reuse of virtual memory, which allows attackers to cause a denial of service via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6994
SFBID77263 		Severity:
High
Description:
The kernel in Apple iOS before 9.1 and OS X before 10.11.1 mishandles reuse of virtual memory, which allows attackers to cause a denial of service via a crafted app.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7014		 Title:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7014
SFBID77267 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7017		 Title:
CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7017 		Severity:
High
Description:
CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6975 and CVE-2015-6992.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7018		 Title:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7018
SFBID77263 		Severity:
Medium
Description:
FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7010.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7022		 Title:
The Telephony subsystem in Apple iOS before 9.1 allows attackers to obtain sensitive call-status information via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7022
SFBID77268 		Severity:
Medium
Description:
The Telephony subsystem in Apple iOS before 9.1 allows attackers to obtain sensitive call-status information via a crafted app.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7023		 Title:
CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cookie parsing, which allows remote web servers to overwrite cookies via unspecified vectors.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7023
SFBID77263 		Severity:
Medium
Description:
CFNetwork in Apple iOS before 9.1 and OS X before 10.11.1 does not properly consider the uppercase-versus-lowercase distinction during cookie parsing, which allows remote web servers to overwrite cookies via unspecified vectors.
Applies to:
 Created:
2015-10-23		 Updated:
2017-08-09
ID:
CVE-2015-7750		 Title:
The L2TP packet processing functionality in Juniper Netscreen and ScreenOS Firewall products with ScreenOS before 6.3.0r13-dnd1, 6.3.0r14 through 6.3.0r18 before 6.3.0r18-dnc1, and 6.3.0r19 allows remote attackers to cause a denial of service via a...		 Type:
Hardware		 Bulletins:
CVE-2015-7750 		Severity:
Medium
Description:
The L2TP packet processing functionality in Juniper Netscreen and ScreenOS Firewall products with ScreenOS before 6.3.0r13-dnd1, 6.3.0r14 through 6.3.0r18 before 6.3.0r18-dnc1, and 6.3.0r19 allows remote attackers to cause a denial of service via a crafted L2TP packet.
Applies to:
 Created:
2015-10-19		 Updated:
2017-08-09
ID:
CVE-2015-7752		 Title:
The SSH server in Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D10, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5,...		 Type:
Hardware		 Bulletins:
CVE-2015-7752 		Severity:
High
Description:
The SSH server in Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D10, 13.2 before 13.2R8, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X53 before 14.1X53-D25, 14.2 before 14.2R3, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D20 allows remote attackers to cause a denial of service (CPU consumption) via unspecified SSH traffic.
Applies to:
 Created:
2015-10-19		 Updated:
2017-08-09
ID:
CVE-2015-7751		 Title:
Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before...		 Type:
Hardware		 Bulletins:
CVE-2015-7751 		Severity:
Medium
Description:
Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D105, 14.1X51 before 14.1X51-D70, 14.1X53 before 14.1X53-D25, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R1, 15.1 before 15.1F2 or 15.1R1, and 15.1X49 before 15.1X49-D10 does not require a password for the root user when pam.conf is "corrupted," which allows local users to gain root privileges by modifying the file.
Applies to:
 Created:
2015-10-19		 Updated:
2017-08-09
ID:
CVE-2015-7748		 Title:
Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remote attackers to cause a denial of service (MPC line card crash) via a crafted uBFD packet.		 Type:
Hardware		 Bulletins:
CVE-2015-7748 		Severity:
Medium
Description:
Juniper chassis with Trio (Trinity) chipset line cards and Junos OS 13.3 before 13.3R8, 14.1 before 14.1R6, 14.2 before 14.2R5, and 15.1 before 15.1R2 allow remote attackers to cause a denial of service (MPC line card crash) via a crafted uBFD packet.
Applies to:
 Created:
2015-10-19		 Updated:
2017-08-09
ID:
CVE-2015-7749		 Title:
The PFE daemon in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service via an unspecified connection request to the "host-OS."		 Type:
Hardware		 Bulletins:
CVE-2015-7749 		Severity:
High
Description:
The PFE daemon in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service via an unspecified connection request to the "host-OS."
Applies to:
 Created:
2015-10-19		 Updated:
2017-08-09
ID:
CVE-2014-6449		 Title:
Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R8, 13.3 before 13.3R7, 14.1 before 14.1R5, and 14.2 before 14.2R1 do not properly handle...		 Type:
Hardware		 Bulletins:
CVE-2014-6449 		Severity:
Medium
Description:
Juniper Junos OS before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R8, 13.3 before 13.3R7, 14.1 before 14.1R5, and 14.2 before 14.2R1 do not properly handle TCP packet reassembly, which allows remote attackers to cause a denial of service (buffer consumption) via a crafted sequence of packets "destined to the device."
Applies to:
 Created:
2015-10-16		 Updated:
2017-08-09
ID:
CVE-2014-6450		 Title:
Juniper Junos OS before 11.4R12-S4, 12.1X44 before 12.1X44-D41, 12.1X46 before 12.1X46-D26, 12.1X47 before 12.1X47-D11/D15, 12.2 before 12.2R9, 12.2X50 before 12.2X50-D70, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 12.3X50 before 12.3X50-D42,...		 Type:
Hardware		 Bulletins:
CVE-2014-6450 		Severity:
High
Description:
Juniper Junos OS before 11.4R12-S4, 12.1X44 before 12.1X44-D41, 12.1X46 before 12.1X46-D26, 12.1X47 before 12.1X47-D11/D15, 12.2 before 12.2R9, 12.2X50 before 12.2X50-D70, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 12.3X50 before 12.3X50-D42, 13.1 before 13.1R4-S3, 13.1X49 before 13.1X49-D42, 13.1X50 before 13.1X50-D30, 13.2 before 13.2R6, 13.2X51 before 13.2X51-D26, 13.2X52 before 13.2X52-D15, 13.3 before 13.3R3-S3, 14.1 before 14.1R3, 14.2 before 14.2R1, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D10, when configured for IPv6, allow remote attackers to cause a denial of service (mbuf chain corruption and kernel panic) via crafted IPv6 packets.
Applies to:
 Created:
2015-10-16		 Updated:
2017-08-09
ID:
CVE-2014-6451		 Title:
J-Web in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service (system reboot) via unspecified vectors.		 Type:
Hardware		 Bulletins:
CVE-2014-6451 		Severity:
High
Description:
J-Web in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service (system reboot) via unspecified vectors.
Applies to:
 Created:
2015-10-16		 Updated:
2017-08-09
ID:
CVE-2015-5923		 Title:
Apple iOS before 9.0.2 does not properly restrict the options available on the lock screen, which allows physically proximate attackers to read contact data or view photos via unspecified vectors.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5923 		Severity:
Low
Description:
Apple iOS before 9.0.2 does not properly restrict the options available on the lock screen, which allows physically proximate attackers to read contact data or view photos via unspecified vectors.
Applies to:
 Created:
2015-10-09		 Updated:
2017-08-09
ID:
CVE-2015-3823		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3823 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3847		 Title:
Bluetooth in Android before 5.1.1 LMY48T allows attackers to remove stored SMS messages via a crafted application, aka internal bug 22343270.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3847 		Severity:
Medium
Description:
Bluetooth in Android before 5.1.1 LMY48T allows attackers to remove stored SMS messages via a crafted application, aka internal bug 22343270.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3862		 Title:
mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22954006.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3862 		Severity:
Medium
Description:
mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22954006.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3865		 Title:
The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3865 		Severity:
High
Description:
The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3867		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23213430.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3867 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23213430.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3868		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3868 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3869		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23036083.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3869 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23036083.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3870		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22771132.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3870 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22771132.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3871		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23031033.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3871 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23031033.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3872		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23346388.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3872 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23346388.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3873		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23016072, 23248776, 23247055, 22845824,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3873 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23016072, 23248776, 23247055, 22845824, 22008959, 21814993, 21048776, 20718524, 20674674, 22388975, 20674086, 21443020, and 22077698, a different vulnerability than CVE-2015-7716.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3874		 Title:
The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23335715, 23307276, and 23286323.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3874 		Severity:
High
Description:
The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23335715, 23307276, and 23286323.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3875		 Title:
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3875 		Severity:
High
Description:
libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3877		 Title:
Skia, as used in Android before 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20723696.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3877 		Severity:
High
Description:
Skia, as used in Android before 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20723696.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3878		 Title:
Media Projection in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to bypass an intended screen-recording warning feature and obtain sensitive screen-snapshot information via a crafted application that...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3878 		Severity:
Medium
Description:
Media Projection in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to bypass an intended screen-recording warning feature and obtain sensitive screen-snapshot information via a crafted application that references a long application name, aka internal bug 23345192.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3879		 Title:
Media Player Framework in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bug 23223325.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3879 		Severity:
High
Description:
Media Player Framework in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bug 23223325.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-6596		 Title:
mediaserver in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bugs 20731946 and 20719651, a different vulnerability than CVE-2015-7717.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6596 		Severity:
High
Description:
mediaserver in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, aka internal bugs 20731946 and 20719651, a different vulnerability than CVE-2015-7717.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-6598		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23306638.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6598 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23306638.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-6599		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6599 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-6600		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22882938.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6600 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22882938.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-6601		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22935234.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6601 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22935234.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-6603		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23227354.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6603 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23227354.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-6604		 Title:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23129786.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6604 		Severity:
High
Description:
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23129786.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-6605		 Title:
mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bugs 20915134 and 23142203, a different vulnerability than CVE-2015-7718.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6605 		Severity:
Medium
Description:
mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bugs 20915134 and 23142203, a different vulnerability than CVE-2015-7718.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-6606		 Title:
The Secure Element Evaluation Kit (aka SEEK or SmartCard API) plugin in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6606 		Severity:
High
Description:
The Secure Element Evaluation Kit (aka SEEK or SmartCard API) plugin in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 22301786.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-7716		 Title:
libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20721050, a different vulnerability than...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7716 		Severity:
High
Description:
libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20721050, a different vulnerability than CVE-2015-3873.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-7717		 Title:
mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 19573085, a different vulnerability than CVE-2015-6596.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7717 		Severity:
High
Description:
mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 19573085, a different vulnerability than CVE-2015-6596.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-7718		 Title:
mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22278703, a different vulnerability than CVE-2015-6605.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-7718 		Severity:
Medium
Description:
mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22278703, a different vulnerability than CVE-2015-6605.
Applies to:
 Created:
2015-10-06		 Updated:
2017-08-09
ID:
CVE-2015-3876		 Title:
libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3876 		Severity:
High
Description:
libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.
Applies to:
 Created:
2015-10-01		 Updated:
2017-08-09
ID:
CVE-2015-6602		 Title:
libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6602 		Severity:
High
Description:
libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.
Applies to:
 Created:
2015-10-01		 Updated:
2017-08-09
ID:
CVE-2014-7915		 Title:
Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors, aka internal bug 15328708.		 Type:
Mobile Devices		 Bulletins:
CVE-2014-7915 		Severity:
High
Description:
Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors, aka internal bug 15328708.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2014-7916		 Title:
Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors, aka internal bug 15342751.		 Type:
Mobile Devices		 Bulletins:
CVE-2014-7916 		Severity:
High
Description:
Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors, aka internal bug 15342751.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2014-7917		 Title:
Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors, aka internal bug 15342615.		 Type:
Mobile Devices		 Bulletins:
CVE-2014-7917 		Severity:
High
Description:
Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors, aka internal bug 15342615.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-1528		 Title:
Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1528 		Severity:
High
Description:
Integer overflow in the native_handle_create function in libcutils/native_handle.c in Android before 5.1.1 LMY48M allows attackers to obtain a different application's privileges or cause a denial of service (Binder heap memory corruption) via a crafted application, aka internal bug 19334482.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-1536		 Title:
Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (system_server crash) or obtain sensitive system_server...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1536 		Severity:
High
Description:
Integer overflow in the Bitmap_createFromParcel function in core/jni/android/graphics/Bitmap.cpp in Android before 5.1.1 LMY48I allows attackers to cause a denial of service (system_server crash) or obtain sensitive system_server memory-content information via a crafted application that leverages improper unmarshalling of bitmaps, aka internal bug 19666945.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-1538		 Title:
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1538
SFBID76052 		Severity:
High
Description:
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-1539		 Title:
Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1539
SFBID76052 		Severity:
High
Description:
Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-1541		 Title:
The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1541 		Severity:
Medium
Description:
The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an Intent with a (1) FLAG_GRANT_READ_URI_PERMISSION or (2) FLAG_GRANT_WRITE_URI_PERMISSION flag, as demonstrated by bypassing intended restrictions on reading contacts, aka internal bug 19618745.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3824		 Title:
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict size addition, which allows remote attackers to execute arbitrary code or cause a denial of...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3824
SFBID76052 		Severity:
High
Description:
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict size addition, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via a crafted MPEG-4 tx3g atom, aka internal bug 20923261.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3826		 Title:
The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3826
SFBID76052 		Severity:
Medium
Description:
The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to cause a denial of service (integer underflow, buffer over-read, and mediaserver process crash) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3828.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3827		 Title:
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3827
SFBID76052 		Severity:
High
Description:
The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3828		 Title:
The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3828
SFBID76052 		Severity:
High
Description:
The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3829		 Title:
Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3829
SFBID76052 		Severity:
High
Description:
Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted MPEG-4 covr atoms with a size equal to SIZE_MAX, aka internal bug 20923261.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3831		 Title:
Buffer overflow in the readAt function in BpMediaHTTPConnection in media/libmedia/IMediaHTTPConnection.cpp in the mediaserver service in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3831 		Severity:
High
Description:
Buffer overflow in the readAt function in BpMediaHTTPConnection in media/libmedia/IMediaHTTPConnection.cpp in the mediaserver service in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 19400722.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3832		 Title:
Multiple buffer overflows in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via invalid size values of NAL units in MP4 data, aka internal bug 19641538.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3832 		Severity:
High
Description:
Multiple buffer overflows in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via invalid size values of NAL units in MP4 data, aka internal bug 19641538.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3833		 Title:
The getRunningAppProcesses function in services/core/java/com/android/server/am/ActivityManagerService.java in Android before 5.1.1 LMY48I allows attackers to bypass intended getRecentTasks restrictions and discover the name of the...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3833 		Severity:
Medium
Description:
The getRunningAppProcesses function in services/core/java/com/android/server/am/ActivityManagerService.java in Android before 5.1.1 LMY48I allows attackers to bypass intended getRecentTasks restrictions and discover the name of the foreground application via a crafted application, aka internal bug 20034603.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3834		 Title:
Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application that uses HDCP encryption,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3834 		Severity:
High
Description:
Multiple integer overflows in the BnHDCP::onTransact function in media/libmedia/IHDCP.cpp in libstagefright in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application that uses HDCP encryption, leading to a heap-based buffer overflow, aka internal bug 20222489.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3835		 Title:
Buffer overflow in the OMXNodeInstance::emptyBuffer function in omx/OMXNodeInstance.cpp in libstagefright in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 20634516.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3835 		Severity:
High
Description:
Buffer overflow in the OMXNodeInstance::emptyBuffer function in omx/OMXNodeInstance.cpp in libstagefright in Android before 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application, aka internal bug 20634516.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3836		 Title:
The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size field, which allows remote attackers to execute arbitrary...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3836 		Severity:
High
Description:
The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size field, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted XMF data, aka internal bug 21132860.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3837		 Title:
The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3837 		Severity:
High
Description:
The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka internal bug 21437603.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3842		 Title:
Multiple heap-based buffer overflows in libeffects in the Audio Policy Service in mediaserver in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application, aka internal bug 21953516.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3842 		Severity:
High
Description:
Multiple heap-based buffer overflows in libeffects in the Audio Policy Service in mediaserver in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application, aka internal bug 21953516.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3843		 Title:
The SIM Toolkit (STK) framework in Android before 5.1.1 LMY48I allows attackers to (1) intercept or (2) emulate unspecified Telephony STK SIM commands via an application that sends a crafted Intent, related to...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3843 		Severity:
High
Description:
The SIM Toolkit (STK) framework in Android before 5.1.1 LMY48I allows attackers to (1) intercept or (2) emulate unspecified Telephony STK SIM commands via an application that sends a crafted Intent, related to com/android/internal/telephony/cat/AppInterface.java, aka internal bug 21697171.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3844		 Title:
The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trigger incorrect process loading via a crafted...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3844 		Severity:
Medium
Description:
The getProcessRecordLocked method in services/core/java/com/android/server/am/ActivityManagerService.java in ActivityManager in Android before 5.1.1 LMY48I allows attackers to trigger incorrect process loading via a crafted application, as demonstrated by interfering with use of the Settings application, aka internal bug 21669445.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3845		 Title:
The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3845 		Severity:
Medium
Description:
The Parcel::appendFrom function in libs/binder/Parcel.cpp in Binder in Android before 5.1.1 LMY48M does not consider parcel boundaries during identification of binder objects in an append operation, which allows attackers to obtain a different application's privileges via a crafted application, aka internal bug 17312693.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3849		 Title:
The Region_createFromParcel function in core/jni/android/graphics/Region.cpp in Region in Android before 5.1.1 LMY48M does not check the return values of certain read operations, which allows attackers to execute arbitrary code via...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3849 		Severity:
High
Description:
The Region_createFromParcel function in core/jni/android/graphics/Region.cpp in Region in Android before 5.1.1 LMY48M does not check the return values of certain read operations, which allows attackers to execute arbitrary code via an application that sends a crafted message to a service, aka internal bug 21585255.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3858		 Title:
The checkDestination function in internal/telephony/SMSDispatcher.java in Android before 5.1.1 LMY48M relies on an obsolete permission name for an authorization check, which allows attackers to bypass an intended user-confirmation...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3858 		Severity:
High
Description:
The checkDestination function in internal/telephony/SMSDispatcher.java in Android before 5.1.1 LMY48M relies on an obsolete permission name for an authorization check, which allows attackers to bypass an intended user-confirmation requirement for SMS short-code messaging via a crafted application, aka internal bug 22314646.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3860		 Title:
packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3860 		Severity:
High
Description:
packages/Keyguard/res/layout/keyguard_password_view.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers a SystemUI crash, aka internal bug 22214934.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3861		 Title:
Multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allow remote attackers to cause a denial of service (device...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3861 		Severity:
Medium
Description:
Multiple integer overflows in the addVorbisCodecInfo function in matroska/MatroskaExtractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allow remote attackers to cause a denial of service (device inoperability) via crafted Matroska data, aka internal bug 21296336.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3863		 Title:
Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3863 		Severity:
High
Description:
Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug 22802399.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-3864		 Title:
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3864
SFBID76682 		Severity:
High
Description:
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2015-6575		 Title:
SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-6575 		Severity:
High
Description:
SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted atoms in MP4 data, aka internal bug 20139950, a different vulnerability than CVE-2015-1538. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7915, CVE-2014-7916, and/or CVE-2014-7917.
Applies to:
 Created:
2015-09-30		 Updated:
2017-08-09
ID:
CVE-2014-8611		 Title:
The __sflush function in fflush.c in stdio in libc in FreeBSD 10.1 and the kernel in Apple iOS before 9 mishandles failures of the write system call, which allows context-dependent attackers to execute arbitrary code or cause a...		 Type:
Mobile Devices		 Bulletins:
CVE-2014-8611 		Severity:
Medium
Description:
The __sflush function in fflush.c in stdio in libc in FreeBSD 10.1 and the kernel in Apple iOS before 9 mishandles failures of the write system call, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted application.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5764		 Title:
The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5765 and CVE-2015-5767.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5764
SFBID76764 		Severity:
Medium
Description:
The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5765 and CVE-2015-5767.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5765		 Title:
The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5767.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5765
SFBID76764 		Severity:
Medium
Description:
The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5767.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5767		 Title:
The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5765.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5767
SFBID76764 		Severity:
Medium
Description:
The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5765.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-3801		 Title:
The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote attackers to bypass an intended single-cookie restriction via unspecified vectors.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3801
SFBID76764 		Severity:
Medium
Description:
The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote attackers to bypass an intended single-cookie restriction via unspecified vectors.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5788		 Title:
The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5788
SFBID76766 		Severity:
Medium
Description:
The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5789		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5789
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5790		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5790
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5791		 Title:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5791
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5792		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5792
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5793		 Title:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5793
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5794		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5794
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5795		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5795
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5796		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5796
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5809		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5809
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5810		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5810
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5811		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5811
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5812		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5812
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5813		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5813
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5814		 Title:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5814
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5816		 Title:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5816
SFBID76764 		Severity:
Medium
Description:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5817		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5817
SFBID76766 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5818		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5818
SFBID76766 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5819		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5819
SFBID76766 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5797		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5797
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5799		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5799
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5800		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5800
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5801		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5801
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5802		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5802
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5803		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5803
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5804		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5804
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5805		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5805
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5806		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5806
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5807		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5807
SFBID76763 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5820		 Title:
WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted (1) tel://, (2) facetime://, or (3) facetime-audio:// URL.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5820
SFBID76766 		Severity:
Medium
Description:
WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted (1) tel://, (2) facetime://, or (3) facetime-audio:// URL.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5821		 Title:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5821
SFBID76766 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5822		 Title:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5822
SFBID76764 		Severity:
Medium
Description:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5823		 Title:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5823
SFBID76764 		Severity:
Medium
Description:
WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5825		 Title:
WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5825
SFBID76766 		Severity:
Medium
Description:
WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5826		 Title:
WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5826
SFBID76766 		Severity:
Medium
Description:
WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5827		 Title:
WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5827
SFBID76766 		Severity:
Medium
Description:
WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5831		 Title:
NetworkExtension in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows attackers to obtain sensitive memory-layout information via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5831
SFBID76764 		Severity:
Medium
Description:
NetworkExtension in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows attackers to obtain sensitive memory-layout information via a crafted app.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5832		 Title:
The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from the keychain upon a signout action, which might allow physically proximate attackers to obtain sensitive information via unspecified...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5832
SFBID76764 		Severity:
Low
Description:
The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from the keychain upon a signout action, which might allow physically proximate attackers to obtain sensitive information via unspecified vectors.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5835		 Title:
Apple iOS before 9 allows attackers to obtain sensitive information about inter-app communication via a crafted app that conducts an interception attack involving an unspecified URL scheme.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5835
SFBID76764 		Severity:
Medium
Description:
Apple iOS before 9 allows attackers to obtain sensitive information about inter-app communication via a crafted app that conducts an interception attack involving an unspecified URL scheme.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5838		 Title:
SpringBoard in Apple iOS before 9 does not properly restrict access to privileged API calls, which allows attackers to spoof the dialog windows of an arbitrary app via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5838
SFBID76764 		Severity:
Medium
Description:
SpringBoard in Apple iOS before 9 does not properly restrict access to privileged API calls, which allows attackers to spoof the dialog windows of an arbitrary app via a crafted app.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5850		 Title:
AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device backup.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5850
SFBID76764 		Severity:
Low
Description:
AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device backup.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5851		 Title:
The convenience initializer in the Multipeer Connectivity component in Apple iOS before 9 does not require an encrypted session, which allows local users to obtain cleartext multipeer data via an encrypted-to-unencrypted downgrade attack.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5851
SFBID76764 		Severity:
Low
Description:
The convenience initializer in the Multipeer Connectivity component in Apple iOS before 9 does not require an encrypted session, which allows local users to obtain cleartext multipeer data via an encrypted-to-unencrypted downgrade attack.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5856		 Title:
The Application Store component in Apple iOS before 9 allows remote attackers to cause a denial of service to an enterprise-signed app via a crafted ITMS URL.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5856
SFBID76764 		Severity:
Medium
Description:
The Application Store component in Apple iOS before 9 allows remote attackers to cause a denial of service to an enterprise-signed app via a crafted ITMS URL.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5857		 Title:
Mail in Apple iOS before 9 allows remote attackers to use an address-book contact as a spoofed e-mail sender address via unspecified vectors.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5857
SFBID76764 		Severity:
Medium
Description:
Mail in Apple iOS before 9 allows remote attackers to use an address-book contact as a spoofed e-mail sender address via unspecified vectors.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5861		 Title:
SpringBoard in Apple iOS before 9 allows physically proximate attackers to bypass a lock-screen preview-disabled setting, and reply to an audio message, via unspecified vectors.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5861
SFBID76764 		Severity:
Low
Description:
SpringBoard in Apple iOS before 9 allows physically proximate attackers to bypass a lock-screen preview-disabled setting, and reply to an audio message, via unspecified vectors.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5879		 Title:
XNU in the kernel in Apple iOS before 9 does not properly validate the headers of TCP packets, which allows remote attackers to bypass the sequence-number protection mechanism and cause a denial of service (TCP connection disruption)...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5879
SFBID76764 		Severity:
Medium
Description:
XNU in the kernel in Apple iOS before 9 does not properly validate the headers of TCP packets, which allows remote attackers to bypass the sequence-number protection mechanism and cause a denial of service (TCP connection disruption) via a crafted header.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5880		 Title:
CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5880
SFBID76764 		Severity:
Medium
Description:
CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a crafted background app.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5892		 Title:
Siri in Apple iOS before 9 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5892
SFBID76764 		Severity:
Low
Description:
Siri in Apple iOS before 9 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5904		 Title:
Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted web site.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5904
SFBID76764 		Severity:
Medium
Description:
Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted web site.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5905		 Title:
Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on a web site.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5905
SFBID76764 		Severity:
Medium
Description:
Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on a web site.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5906		 Title:
The HTML form implementation in WebKit in Apple iOS before 9 does not prevent QuickType access to the final character of a password, which might make it easier for remote attackers to discover a password by leveraging a later...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5906
SFBID76766 		Severity:
Medium
Description:
The HTML form implementation in WebKit in Apple iOS before 9 does not prevent QuickType access to the final character of a password, which might make it easier for remote attackers to discover a password by leveraging a later prediction containing that character.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5907		 Title:
WebKit in Apple iOS before 9 allows man-in-the-middle attackers to conduct redirection attacks by leveraging the mishandling of the resource cache of an SSL web site with an invalid X.509 certificate.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5907
SFBID76766 		Severity:
Low
Description:
WebKit in Apple iOS before 9 allows man-in-the-middle attackers to conduct redirection attacks by leveraging the mishandling of the resource cache of an SSL web site with an invalid X.509 certificate.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5912		 Title:
The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection attempts to intranet hosts via crafted responses.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5912
SFBID76764 		Severity:
Medium
Description:
The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection attempts to intranet hosts via crafted responses.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-5921		 Title:
WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to obtain sensitive information via unspecified vectors.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5921
SFBID76766 		Severity:
Medium
Description:
WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
Applies to:
 Created:
2015-09-18		 Updated:
2017-08-09
ID:
CVE-2015-3758		 Title:
UIKit WebView in Apple iOS before 8.4.1 allows attackers to bypass an intended user-confirmation requirement and initiate arbitrary FaceTime calls via an app that provides a crafted URL.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3758
SFBID76337 		Severity:
Medium
Description:
UIKit WebView in Apple iOS before 8.4.1 allows attackers to bypass an intended user-confirmation requirement and initiate arbitrary FaceTime calls via an app that provides a crafted URL.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3759		 Title:
Location Framework in Apple iOS before 8.4.1 allows local users to bypass intended restrictions on filesystem modification via a symlink.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3759
SFBID76337 		Severity:
Medium
Description:
Location Framework in Apple iOS before 8.4.1 allows local users to bypass intended restrictions on filesystem modification via a symlink.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3763		 Title:
Safari in Apple iOS before 8.4.1 does not limit the rate of JavaScript alert messages, which allows remote attackers to cause a denial of service (apparent browser locking) via a crafted web site.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3763
SFBID76337 		Severity:
Medium
Description:
Safari in Apple iOS before 8.4.1 does not limit the rate of JavaScript alert messages, which allows remote attackers to cause a denial of service (apparent browser locking) via a crafted web site.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3766		 Title:
The kernel in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly restrict the mach_port_space_info interface, which allows attackers to obtain sensitive memory-layout information via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3766
SFBID76343 		Severity:
Medium
Description:
The kernel in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly restrict the mach_port_space_info interface, which allows attackers to obtain sensitive memory-layout information via a crafted app.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3768		 Title:
Integer overflow in the kernel in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context via a crafted app that makes unspecified IOKit API calls.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3768
SFBID76343 		Severity:
High
Description:
Integer overflow in the kernel in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context via a crafted app that makes unspecified IOKit API calls.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3776		 Title:
IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and application crash) via a malformed plist.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3776
SFBID76343 		Severity:
High
Description:
IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and application crash) via a malformed plist.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3778		 Title:
bootp in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain potentially sensitive information about MAC addresses seen in previous Wi-Fi sessions by sniffing an 802.11 network for DNAv4 broadcast traffic.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3778
SFBID76337 		Severity:
Low
Description:
bootp in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain potentially sensitive information about MAC addresses seen in previous Wi-Fi sessions by sniffing an 802.11 network for DNAv4 broadcast traffic.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3782		 Title:
CloudKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to access an iCloud user record associated with a previous user's login session via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3782
SFBID76343 		Severity:
Medium
Description:
CloudKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to access an iCloud user record associated with a previous user's login session via a crafted app.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3793		 Title:
CFPreferences in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3793
SFBID76337 		Severity:
Medium
Description:
CFPreferences in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3795		 Title:
libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3795
SFBID76343 		Severity:
High
Description:
libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3796		 Title:
The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3796
SFBID76343 		Severity:
High
Description:
The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3797 and CVE-2015-3798.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5752		 Title:
Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5752
SFBID76337 		Severity:
Medium
Description:
Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5755		 Title:
CoreText in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5755
SFBID76343 		Severity:
Medium
Description:
CoreText in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-5761.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5756		 Title:
FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5756
SFBID76343 		Severity:
Medium
Description:
FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-3804 and CVE-2015-5775.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5757		 Title:
libpthread in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via an app that uses a crafted syscall to interfere with...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5757
SFBID76343 		Severity:
High
Description:
libpthread in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via an app that uses a crafted syscall to interfere with locking.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5758		 Title:
ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted TIFF image.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5758
SFBID76343 		Severity:
Medium
Description:
ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted TIFF image.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5759		 Title:
WebKit in Apple iOS before 8.4.1 allows remote attackers to spoof clicks via a crafted web site that leverages tap events.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5759
SFBID76337 		Severity:
Medium
Description:
WebKit in Apple iOS before 8.4.1 allows remote attackers to spoof clicks via a crafted web site that leverages tap events.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5761		 Title:
CoreText in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5761
SFBID76343 		Severity:
Medium
Description:
CoreText in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-5755.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5766		 Title:
Directory traversal vulnerability in Air Traffic in Apple iOS before 8.4.1 allows attackers to access arbitrary filesystem locations via vectors related to asset handling.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5766
SFBID76337 		Severity:
Medium
Description:
Directory traversal vulnerability in Air Traffic in Apple iOS before 8.4.1 allows attackers to access arbitrary filesystem locations via vectors related to asset handling.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3729		 Title:
Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3729
SFBID76342 		Severity:
Medium
Description:
Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not indicate what web site originated an input prompt, which allows remote attackers to conduct spoofing attacks via a crafted site.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3730		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3730
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3731		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3731
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3732		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3732
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3733		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3733
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3734		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3734
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3735		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3735
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3736		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3736
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3737		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3737
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3738		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3738
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3739		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3739
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3740		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3740
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3741		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3741
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3742		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3742
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3743		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3743
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3744		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3744
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3745		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3745
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3746		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3746
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3747		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3747
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3748		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3748
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3749		 Title:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3749
SFBID76338 		Severity:
Medium
Description:
WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3750		 Title:
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3750
SFBID76341 		Severity:
Medium
Description:
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3751		 Title:
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3751
SFBID76341 		Severity:
Medium
Description:
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in conjunction with an IMG element within an OBJECT element.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3752		 Title:
The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3752
SFBID76341 		Severity:
Medium
Description:
The Content Security Policy implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly restrict cookie transmission for report requests, which allows remote attackers to obtain sensitive information via vectors involving (1) a cross-origin request or (2) a private-browsing request.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3753		 Title:
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3753
SFBID76341 		Severity:
Medium
Description:
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3755		 Title:
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3755
SFBID76344 		Severity:
Medium
Description:
WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3756		 Title:
The Certificate UI in Apple iOS before 8.4.1 does not prevent X.509 certificate acceptance within the lock screen, which allows physically proximate attackers to establish arbitrary certificate trust relationships by completing a dialog.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3756
SFBID76337 		Severity:
Low
Description:
The Certificate UI in Apple iOS before 8.4.1 does not prevent X.509 certificate acceptance within the lock screen, which allows physically proximate attackers to establish arbitrary certificate trust relationships by completing a dialog.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3797		 Title:
The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3797
SFBID76343 		Severity:
High
Description:
The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3796 and CVE-2015-3798.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3798		 Title:
The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3798
SFBID76343 		Severity:
High
Description:
The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3796 and CVE-2015-3797.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3800		 Title:
The DiskImages component in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via a malformed DMG image.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3800
SFBID76343 		Severity:
High
Description:
The DiskImages component in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via a malformed DMG image.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3802		 Title:
Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism via a crafted Mach-O file, a different vulnerability than CVE-2015-3805.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3802
SFBID76343 		Severity:
High
Description:
Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism via a crafted Mach-O file, a different vulnerability than CVE-2015-3805.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3803		 Title:
Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism via a crafted multi-architecture executable file.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3803
SFBID76343 		Severity:
High
Description:
Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism via a crafted multi-architecture executable file.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3804		 Title:
FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3804
SFBID76343 		Severity:
High
Description:
FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-5756 and CVE-2015-5775.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3805		 Title:
Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism via a crafted Mach-O file, a different vulnerability than CVE-2015-3802.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3805
SFBID76343 		Severity:
High
Description:
Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism via a crafted Mach-O file, a different vulnerability than CVE-2015-3802.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-3806		 Title:
Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism by appending code to a crafted executable file.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3806
SFBID76343 		Severity:
High
Description:
Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism by appending code to a crafted executable file.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5746		 Title:
AppleFileConduit in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via an afc command that leverages symlink mishandling.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5746
SFBID76337 		Severity:
Medium
Description:
AppleFileConduit in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via an afc command that leverages symlink mishandling.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5748		 Title:
The kernel in Apple OS X before 10.10.5 does not properly mount HFS volumes, which allows local users to cause a denial of service via a crafted volume.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5748
SFBID76340 		Severity:
Low
Description:
The kernel in Apple OS X before 10.10.5 does not properly mount HFS volumes, which allows local users to cause a denial of service via a crafted volume.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5749		 Title:
The Sandbox_profiles component in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5749
SFBID76337 		Severity:
Medium
Description:
The Sandbox_profiles component in Apple iOS before 8.4.1 allows attackers to bypass the third-party app-sandbox protection mechanism and read arbitrary managed preferences via a crafted app.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5769		 Title:
The MSVDX driver in Apple iOS before 8.4.1 allows remote attackers to cause a denial of service (device crash) via a crafted video.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5769
SFBID76337 		Severity:
High
Description:
The MSVDX driver in Apple iOS before 8.4.1 allows remote attackers to cause a denial of service (device crash) via a crafted video.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5770		 Title:
MobileInstallation in Apple iOS before 8.4.1 does not ensure the uniqueness of universal provisioning profile bundle IDs, which allows attackers to replace arbitrary extensions via a crafted enterprise app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5770
SFBID76337 		Severity:
Medium
Description:
MobileInstallation in Apple iOS before 8.4.1 does not ensure the uniqueness of universal provisioning profile bundle IDs, which allows attackers to replace arbitrary extensions via a crafted enterprise app.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5773		 Title:
QL Office in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted office document.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5773
SFBID76343 		Severity:
Medium
Description:
QL Office in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted office document.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5774		 Title:
Buffer overflow in IOHIDFamily in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges via unspecified vectors.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5774
SFBID76343 		Severity:
High
Description:
Buffer overflow in IOHIDFamily in Apple iOS before 8.4.1 and OS X before 10.10.5 allows local users to gain privileges via unspecified vectors.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5775		 Title:
FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5775
SFBID76343 		Severity:
High
Description:
FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-3804 and CVE-2015-5756.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5776		 Title:
Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5776
SFBID76343 		Severity:
High
Description:
Libinfo in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by leveraging use of an AF_INET6 socket.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5777		 Title:
CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5777
SFBID76343 		Severity:
Medium
Description:
CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-5778.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5778		 Title:
CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5778
SFBID76343 		Severity:
Medium
Description:
CoreMedia Playback in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-5777.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5781		 Title:
ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted PNG image.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5781
SFBID76343 		Severity:
Medium
Description:
ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted PNG image.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-5782		 Title:
ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-5782
SFBID76343 		Severity:
Medium
Description:
ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.
Applies to:
 Created:
2015-08-16		 Updated:
2017-08-09
ID:
CVE-2015-1805		 Title:
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1805
SFBID74951 		Severity:
High
Description:
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun."
Applies to:
 Created:
2015-08-08		 Updated:
2017-08-09
ID:
MITRE:29480		 Title:
oval:org.mitre.oval:def:29480: Adobe Reader and Acrobat 7.0.8 and earlier allows user-assisted remote attackers to execute code		 Type:
Software		 Bulletins:
MITRE:29480
CVE-2006-5857 		Severity:
Low
Description:
Adobe Reader and Acrobat 7.0.8 and earlier allows user-assisted remote attackers to execute code via a crafted PDF file that triggers memory corruption and overwrites a subroutine pointer during rendering.
Applies to:
Adobe Acrobat
Adobe Reader		 Created:
2015-07-30		 Updated:
2015-12-22
ID:
MITRE:29418		 Title:
oval:org.mitre.oval:def:29418: Buffer overflow in a "core application plug-in" for Adobe Reader 5.1 through 7.0.2 and Acrobat 5.0 through 7.0.2		 Type:
Software		 Bulletins:
MITRE:29418
CVE-2005-2470 		Severity:
Low
Description:
Buffer overflow in a "core application plug-in" for Adobe Reader 5.1 through 7.0.2 and Acrobat 5.0 through 7.0.2 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.
Applies to:
Adobe Acrobat
Adobe Reader		 Created:
2015-07-30		 Updated:
2015-12-22
ID:
MITRE:29400		 Title:
oval:org.mitre.oval:def:29400: Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers		 Type:
Web		 Bulletins:
MITRE:29400
CVE-2007-3457 		Severity:
Low
Description:
Adobe Flash Player 8.0.34.0 and earlier insufficiently validates HTTP Referer headers, which might allow remote attackers to conduct a CSRF attack via a crafted SWF file.
Applies to:
Adobe Flash Player		 Created:
2015-07-30		 Updated:
2015-12-22
ID:
MITRE:28544		 Title:
oval:org.mitre.oval:def:28544: Microsoft Office memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28544
CVE-2015-2415 		Severity:
Low
Description:
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Applies to:
Microsoft Excel 2007
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft Office Compatibility Pack		 Created:
2015-07-23		 Updated:
2015-12-22
ID:
MITRE:29449		 Title:
oval:org.mitre.oval:def:29449: Microsoft Office memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29449
CVE-2015-2380 		Severity:
Low
Description:
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, and Word 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Applies to:
Microsoft Word 2007
Microsoft Word 2010
Microsoft Word 2013
Microsoft Word Viewer		 Created:
2015-07-23		 Updated:
2015-12-22
ID:
MITRE:29525		 Title:
oval:org.mitre.oval:def:29525: Microsoft Excel DLL remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:29525
CVE-2015-2378 		Severity:
Low
Description:
Untrusted search path vulnerability in Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel Viewer 2007 SP3, and Office Compatibility Pack SP3 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Microsoft Excel DLL Remote Code Execution Vulnerability."
Applies to:
Microsoft Excel 2007
Microsoft Excel 2010
Microsoft Excel Viewer 2007
Microsoft Office Compatibility Pack		 Created:
2015-07-23		 Updated:
2015-12-22
ID:
MITRE:29284		 Title:
oval:org.mitre.oval:def:29284: Microsoft Office memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29284
CVE-2015-2379 		Severity:
Low
Description:
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Applies to:
Microsoft Word 2007
Microsoft Word 2010
Microsoft Word 2013
Microsoft Word Viewer		 Created:
2015-07-23		 Updated:
2015-12-22
ID:
MITRE:29517		 Title:
oval:org.mitre.oval:def:29517: Microsoft Office memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29517
CVE-2015-2424 		Severity:
Low
Description:
Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Applies to:
Microsoft PowerPoint 2007
Microsoft PowerPoint 2010
Microsoft PowerPoint 2013
Microsoft Word 2007
Microsoft Word 2010
Microsoft Word 2013		 Created:
2015-07-23		 Updated:
2015-12-22
ID:
MITRE:29245		 Title:
oval:org.mitre.oval:def:29245: Microsoft Office memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29245
CVE-2015-2376 		Severity:
Low
Description:
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Applies to:
Microsoft Excel 2007
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft Excel Viewer 2007
Microsoft Office Compatibility Pack
Microsoft SharePoint Server 2007
Microsoft SharePoint Server 2010
Microsoft SharePoint Server 2013		 Created:
2015-07-23		 Updated:
2015-12-22
ID:
MITRE:28805		 Title:
oval:org.mitre.oval:def:28805: Microsoft Office memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28805
CVE-2015-2377 		Severity:
Low
Description:
Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Applies to:
Microsoft Excel 2007
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft Office Compatibility Pack		 Created:
2015-07-23		 Updated:
2015-12-22
ID:
MITRE:29139		 Title:
oval:org.mitre.oval:def:29139: Microsoft Office memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29139
CVE-2015-2375 		Severity:
Low
Description:
Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel Viewer 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to bypass the ASLR protection mechanism via a crafted spreadsheet, aka "Microsoft Excel ASLR Bypass Vulnerability."
Applies to:
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft SharePoint Server 2010
Microsoft SharePoint Server 2013		 Created:
2015-07-23		 Updated:
2015-12-22
ID:
MITRE:29010		 Title:
oval:org.mitre.oval:def:29010: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29010
CVE-2015-2403 		Severity:
Low
Description:
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 8		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29436		 Title:
oval:org.mitre.oval:def:29436: Win32k Elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:29436
CVE-2015-2363 		Severity:
Low
Description:
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29388		 Title:
oval:org.mitre.oval:def:29388: Win32k information disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:29388
CVE-2015-2381 		Severity:
Low
Description:
win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory via a crafted application, aka "Win32k Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2382.
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29493		 Title:
oval:org.mitre.oval:def:29493: OpenType font driver vulnerability		 Type:
Software		 Bulletins:
MITRE:29493
CVE-2015-2426 		Severity:
Low
Description:
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Driver Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29149		 Title:
oval:org.mitre.oval:def:29149: DLL planting remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:29149
CVE-2015-2369 		Severity:
Low
Description:
Untrusted search path vulnerability in Windows Media Device Manager in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rtf file, aka "DLL Planting Remote Code Execution Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29422		 Title:
oval:org.mitre.oval:def:29422: Internet Explorer information disclosure vulnerability		 Type:
Web		 Bulletins:
MITRE:29422
CVE-2015-2413 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted module-resource request, aka "Internet Explorer Information Disclosure Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:28804		 Title:
oval:org.mitre.oval:def:28804: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28804
CVE-2015-2390 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2397, CVE-2015-2404, CVE-2015-2406, and CVE-2015-2422.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:28818		 Title:
oval:org.mitre.oval:def:28818: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28818
CVE-2015-1733 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2389 and CVE-2015-2411.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29278		 Title:
oval:org.mitre.oval:def:29278: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29278
CVE-2015-2385 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, CVE-2015-2406, and CVE-2015-2422.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29315		 Title:
oval:org.mitre.oval:def:29315: SQL Server remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:29315
CVE-2015-1763 		Severity:
Low
Description:
Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual functions, which allows remote authenticated users to execute arbitrary code via a crafted query, aka "SQL Server Remote Code Execution Vulnerability."
Applies to:
Microsoft SQL Server 2008
Microsoft SQL Server 2008 R2
Microsoft SQL Server 2012
Microsoft SQL Server 2014		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29487		 Title:
oval:org.mitre.oval:def:29487: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29487
CVE-2015-2388 		Severity:
Low
Description:
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1738.
Applies to:
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29414		 Title:
oval:org.mitre.oval:def:29414: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29414
CVE-2015-1738 		Severity:
Low
Description:
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2388.
Applies to:
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29132		 Title:
oval:org.mitre.oval:def:29132: Win32k information disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:29132
CVE-2015-2382 		Severity:
Low
Description:
win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from kernel memory via a crafted application, aka "Win32k Information Disclosure Vulnerability," a different vulnerability than CVE-2015-2381.
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:28990		 Title:
oval:org.mitre.oval:def:28990: OLE Elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:28990
CVE-2015-2416 		Severity:
Low
Description:
OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via crafted input, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "OLE Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2417.
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29198		 Title:
oval:org.mitre.oval:def:29198: OLE Elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:29198
CVE-2015-2417 		Severity:
Low
Description:
OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via crafted input, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "OLE Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2416.
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29324		 Title:
oval:org.mitre.oval:def:29324: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29324
CVE-2015-2397 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2404, CVE-2015-2406, and CVE-2015-2422.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29159		 Title:
oval:org.mitre.oval:def:29159: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29159
CVE-2015-2412 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to read arbitrary local files via a crafted pathname, aka "Internet Explorer Information Disclosure Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29360		 Title:
oval:org.mitre.oval:def:29360: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29360
CVE-2015-2422 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, and CVE-2015-2406.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29431		 Title:
oval:org.mitre.oval:def:29431: Windows installer EoP vulnerability		 Type:
Software		 Bulletins:
MITRE:29431
CVE-2015-2371 		Severity:
Low
Description:
The Windows Installer service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a custom action script associated with a .msi package, aka "Windows Installer EoP Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29392		 Title:
oval:org.mitre.oval:def:29392: Remote Desktop Protocol		 Type:
Software		 Bulletins:
MITRE:29392
CVE-2015-2373 		Severity:
Low
Description:
The Remote Desktop Protocol (RDP) server service in Microsoft Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a series of crafted packets, aka "Remote Desktop Protocol (RDP) Remote Code Execution Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29485		 Title:
oval:org.mitre.oval:def:29485: SQL Server remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:29485
CVE-2015-1762 		Severity:
Low
Description:
Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014, when transactional replication is configured, does not prevent use of uninitialized memory in unspecified function calls, which allows remote authenticated users to execute arbitrary code by leveraging certain permissions and making a crafted query, as demonstrated by the VIEW SERVER STATE permission, aka "SQL Server Remote Code Execution Vulnerability."
Applies to:
Microsoft SQL Server 2008
Microsoft SQL Server 2008 R2
Microsoft SQL Server 2012
Microsoft SQL Server 2014		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29296		 Title:
oval:org.mitre.oval:def:29296: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29296
CVE-2015-2425 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:28614		 Title:
oval:org.mitre.oval:def:28614: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28614
CVE-2015-2384 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2425.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29332		 Title:
oval:org.mitre.oval:def:29332: ATMFD.DLL Memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29332
CVE-2015-2387 		Severity:
Low
Description:
ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "ATMFD.DLL Memory Corruption Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:28968		 Title:
oval:org.mitre.oval:def:28968: Elevation of privilege vulnerability in Netlogon		 Type:
Software		 Bulletins:
MITRE:28968
CVE-2015-2374 		Severity:
Low
Description:
The Netlogon service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly implement domain-controller communication, which allows remote attackers to discover credentials by leveraging certain PDC access and spoofing the BDC role in a PDC communication channel, aka "Elevation of Privilege Vulnerability in Netlogon."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29015		 Title:
oval:org.mitre.oval:def:29015: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29015
CVE-2015-1767 		Severity:
Low
Description:
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2401 and CVE-2015-2408.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29280		 Title:
oval:org.mitre.oval:def:29280: Windows DLL remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:29280
CVE-2015-2368 		Severity:
Low
Description:
Untrusted search path vulnerability in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Windows DLL Remote Code Execution Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29087		 Title:
oval:org.mitre.oval:def:29087: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29087
CVE-2015-2410 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted stylesheet, aka "Internet Explorer Information Disclosure Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29406		 Title:
oval:org.mitre.oval:def:29406: Hyper-V system data structure vulnerability		 Type:
Software		 Bulletins:
MITRE:29406
CVE-2015-2362 		Severity:
Low
Description:
Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly initialize guest OS system data structures, which allows guest OS users to execute arbitrary code on the host OS by leveraging guest OS privileges, aka "Hyper-V System Data Structure Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:28529		 Title:
oval:org.mitre.oval:def:28529: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28529
CVE-2015-2401 		Severity:
Low
Description:
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1767 and CVE-2015-2408.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29128		 Title:
oval:org.mitre.oval:def:29128: Win32k elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:29128
CVE-2015-2366 		Severity:
Low
Description:
win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29247		 Title:
oval:org.mitre.oval:def:29247: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29247
CVE-2015-2391 		Severity:
Low
Description:
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29452		 Title:
oval:org.mitre.oval:def:29452: SQL Server elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:29452
CVE-2015-1761 		Severity:
Low
Description:
Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 uses an incorrect class during casts of unspecified pointers, which allows remote authenticated users to gain privileges by leveraging certain write access, aka "SQL Server Elevation of Privilege Vulnerability."
Applies to:
Microsoft SQL Server 2008
Microsoft SQL Server 2008 R2
Microsoft SQL Server 2012
Microsoft SQL Server 2014		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29219		 Title:
oval:org.mitre.oval:def:29219: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29219
CVE-2015-2411 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1733 and CVE-2015-2389.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29355		 Title:
oval:org.mitre.oval:def:29355: Internet Explorer ASLR bypass vulnerability		 Type:
Web		 Bulletins:
MITRE:29355
CVE-2015-2421 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29156		 Title:
oval:org.mitre.oval:def:29156: Win32k elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:29156
CVE-2015-2365 		Severity:
Low
Description:
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29470		 Title:
oval:org.mitre.oval:def:29470: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29470
CVE-2015-2414 		Severity:
Low
Description:
Microsoft Internet Explorer 8 through 11 allows remote attackers to obtain sensitive browsing-history information via vectors related to image caching, aka "Internet Explorer Information Disclosure Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29357		 Title:
oval:org.mitre.oval:def:29357: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29357
CVE-2015-2404 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2397, CVE-2015-2406, and CVE-2015-2422.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29164		 Title:
oval:org.mitre.oval:def:29164: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29164
CVE-2015-2383 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2384 and CVE-2015-2425.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29454		 Title:
oval:org.mitre.oval:def:29454: Internet Explorer elevation of privilege vulnerability		 Type:
Web		 Bulletins:
MITRE:29454
CVE-2015-2402 		Severity:
Low
Description:
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29395		 Title:
oval:org.mitre.oval:def:29395: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29395
CVE-2015-2389 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1733 and CVE-2015-2411.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:28938		 Title:
oval:org.mitre.oval:def:28938: VBScript Memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28938
CVE-2015-2372 		Severity:
Low
Description:
vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
Applies to:
Microsoft VBScript 5.6
Microsoft VBScript 5.7
Microsoft VBScript 5.8		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29391		 Title:
oval:org.mitre.oval:def:29391: Hyper-V buffer overflow vulnerability		 Type:
Software		 Bulletins:
MITRE:29391
CVE-2015-2361 		Severity:
Low
Description:
Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 does not properly initialize guest OS system data structures, which allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (buffer overflow) by leveraging guest OS privileges, aka "Hyper-V Buffer Overflow Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29292		 Title:
oval:org.mitre.oval:def:29292: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29292
CVE-2015-2408 		Severity:
Low
Description:
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1767 and CVE-2015-2401.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29327		 Title:
oval:org.mitre.oval:def:29327: Windows RPC elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:29327
CVE-2015-2370 		Severity:
Low
Description:
The authentication implementation in the RPC subsystem in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not prevent DCE/RPC connection reflection, which allows local users to gain privileges via a crafted application, aka "Windows RPC Elevation of Privilege Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:28708		 Title:
oval:org.mitre.oval:def:28708: Graphics component EOP vulnerability		 Type:
Software		 Bulletins:
MITRE:28708
CVE-2015-2364 		Severity:
Low
Description:
The graphics component in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application that leverages an incorrect bitmap conversion, aka "Graphics Component EOP Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:28834		 Title:
oval:org.mitre.oval:def:28834: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28834
CVE-2015-2406 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, and CVE-2015-2422.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29295		 Title:
oval:org.mitre.oval:def:29295: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29295
CVE-2015-1729 		Severity:
Low
Description:
Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:28743		 Title:
oval:org.mitre.oval:def:28743: Win32k information disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:28743
CVE-2015-2367 		Severity:
Low
Description:
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to obtain sensitive information from uninitialized kernel memory via a crafted application, aka "Win32k Information Disclosure Vulnerability."
Applies to:
 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29316		 Title:
oval:org.mitre.oval:def:29316: Jscript9 Memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29316
CVE-2015-2419 		Severity:
Low
Description:
JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
MITRE:29075		 Title:
oval:org.mitre.oval:def:29075: Internet Explorer XSS filter bypass vulnerability		 Type:
Web		 Bulletins:
MITRE:29075
CVE-2015-2398 		Severity:
Low
Description:
Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document, aka "Internet Explorer XSS Filter Bypass Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-07-22		 Updated:
2015-12-22
ID:
CVE-2015-5357		 Title:
The Juniper EX4600, QFX3500, QFX3600, and QFX5100 switches with Junos 13.2X51-D15 through 13.2X51-D25, 13.2X51 before 13.2X51-D30, and 14.1X53 before 14.1X53-D10 allows remote attackers to cause a denial of service (CPU consumption) via unspecified...		 Type:
Hardware		 Bulletins:
CVE-2015-5357 		Severity:
Medium
Description:
The Juniper EX4600, QFX3500, QFX3600, and QFX5100 switches with Junos 13.2X51-D15 through 13.2X51-D25, 13.2X51 before 13.2X51-D30, and 14.1X53 before 14.1X53-D10 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Applies to:
 Created:
2015-07-16		 Updated:
2017-08-09
ID:
CVE-2015-5360		 Title:
IPv6 sendd in Juniper Junos 12.1X44 before 12.1X44-D51, 12.1X46 before 12.1X46-D36, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R8, 13.3 before 13.3R6, 14.1 before 14.1R5,...		 Type:
Hardware		 Bulletins:
CVE-2015-5360 		Severity:
Medium
Description:
IPv6 sendd in Juniper Junos 12.1X44 before 12.1X44-D51, 12.1X46 before 12.1X46-D36, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R8, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.2 before 14.2R3, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D20, when the "set protocols neighbor-discovery secure security-level default" option is configured, allows remote attackers to cause a denial of service (CPU consumption) via a crafted Secure Neighbor Discovery (SEND) Protocol packet.
Applies to:
 Created:
2015-07-16		 Updated:
2017-08-09
ID:
CVE-2015-5363		 Title:
The SRX Network Security Daemon (nsd) in Juniper SRX Series services gateways with Junos 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, and 12.3X48 before 12.3X48-D15 allows remote DNS servers to cause a denial...		 Type:
Hardware		 Bulletins:
CVE-2015-5363 		Severity:
Medium
Description:
The SRX Network Security Daemon (nsd) in Juniper SRX Series services gateways with Junos 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, and 12.3X48 before 12.3X48-D15 allows remote DNS servers to cause a denial of service (crash) via a crafted DNS response.
Applies to:
 Created:
2015-07-16		 Updated:
2017-08-09
ID:
CVE-2015-3007		 Title:
The Juniper SRX Series services gateways with Junos OS 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, and 12.3X48 before 12.3X48-D15 do not properly implement the "set system ports console insecure" feature, which allows physically...		 Type:
Hardware		 Bulletins:
CVE-2015-3007 		Severity:
High
Description:
The Juniper SRX Series services gateways with Junos OS 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, and 12.3X48 before 12.3X48-D15 do not properly implement the "set system ports console insecure" feature, which allows physically proximate attackers to gain administrative privileges by leveraging access to the console port.
Applies to:
 Created:
2015-07-14		 Updated:
2017-08-09
ID:
CVE-2015-5358		 Title:
Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.2X52 before 13.2X52-D25, 13.3 before 13.3R6,...		 Type:
Hardware		 Bulletins:
CVE-2015-5358 		Severity:
High
Description:
Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R7, 13.2X51 before 13.2X51-D35, 13.2X52 before 13.2X52-D25, 13.3 before 13.3R6, 14.1R3 before 14.1R3-S2, 14.1 before 14.1R4, 14.1X53 before 14.1X53-D12, 14.1X53 before 14.1X53-D16, 14.1X55 before 14.1X55-D25, 14.2 before 14.2R2, and 15.1 before 15.1R1 allows remote attackers to cause a denial of service (mbuf and connection consumption and restart) via a large number of requests that trigger a TCP connection to move to the LAST_ACK state when there is more data to send.
Applies to:
 Created:
2015-07-14		 Updated:
2017-08-09
ID:
CVE-2015-5359		 Title:
Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D10, 13.2 before 13.2R7, 13.3 before 13.3R5, 14.1R3 before 14.1R3-S2, 14.1 before 14.1R4, 14.2 before...		 Type:
Hardware		 Bulletins:
CVE-2015-5359 		Severity:
High
Description:
Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D10, 13.2 before 13.2R7, 13.3 before 13.3R5, 14.1R3 before 14.1R3-S2, 14.1 before 14.1R4, 14.2 before 14.2R2, and 15.1 before 15.1R1 allows remote attackers to cause a denial of service (NULL pointer dereference and RDP crash) via a large number of BGP-VPLS advertisements with updated BGP local preference values.
Applies to:
 Created:
2015-07-14		 Updated:
2017-08-09
ID:
CVE-2015-5362		 Title:
The BFD daemon in Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R8, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before...		 Type:
Hardware		 Bulletins:
CVE-2015-5362 		Severity:
High
Description:
The BFD daemon in Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R8, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D85, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R3, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D10 allows remote attackers to cause a denial of service (bfdd crash and restart) or execute arbitrary code via a crafted BFD packet.
Applies to:
 Created:
2015-07-14		 Updated:
2017-08-09
ID:
CVE-2015-3658		 Title:
The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3658
SFBID75492 		Severity:
Medium
Description:
The Page Loading functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly consider redirects during decisions about sending an Origin header, which makes it easier for remote attackers to bypass CSRF protection mechanisms via a crafted web site.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3659		 Title:
The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3659
SFBID75492 		Severity:
Medium
Description:
The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3684		 Title:
The HTTPAuthentication implementation in CFNetwork in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted credentials in a URL.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3684
SFBID75491 		Severity:
Medium
Description:
The HTTPAuthentication implementation in CFNetwork in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted credentials in a URL.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3685		 Title:
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3686,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3685
SFBID75491 		Severity:
Medium
Description:
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3686		 Title:
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3686
SFBID75491 		Severity:
Medium
Description:
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3687		 Title:
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3687
SFBID75491 		Severity:
Medium
Description:
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3686, CVE-2015-3688, and CVE-2015-3689.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3688		 Title:
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3688
SFBID75491 		Severity:
Medium
Description:
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3686, CVE-2015-3687, and CVE-2015-3689.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3689		 Title:
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685,...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3689
SFBID75491 		Severity:
Medium
Description:
CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3686, CVE-2015-3687, and CVE-2015-3688.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3690		 Title:
The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3690
SFBID75491 		Severity:
Medium
Description:
The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3694		 Title:
FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3719.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3694
SFBID75491 		Severity:
Medium
Description:
FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3719.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3703		 Title:
ImageIO in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3703
SFBID75491 		Severity:
Medium
Description:
ImageIO in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3710		 Title:
Mail in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to trigger a refresh operation, and consequently cause a visit to an arbitrary web site, via a crafted HTML e-mail message.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3710
SFBID75491 		Severity:
Medium
Description:
Mail in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to trigger a refresh operation, and consequently cause a visit to an arbitrary web site, via a crafted HTML e-mail message.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3719		 Title:
TrueTypeScaler in FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3719
SFBID75491 		Severity:
Medium
Description:
TrueTypeScaler in FontParser in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3694.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3721		 Title:
The kernel in Apple iOS before 8.4 and OS X before 10.10.4 does not properly handle HFS parameters, which allows attackers to obtain sensitive memory-layout information via a crafted app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3721
SFBID75491 		Severity:
Medium
Description:
The kernel in Apple iOS before 8.4 and OS X before 10.10.4 does not properly handle HFS parameters, which allows attackers to obtain sensitive memory-layout information via a crafted app.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3722		 Title:
Application Store in Apple iOS before 8.4 does not ensure the uniqueness of bundle IDs, which allows attackers to cause a denial of service (ID collision and launch outage) via a crafted universal provisioning profile app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3722
SFBID75490 		Severity:
Medium
Description:
Application Store in Apple iOS before 8.4 does not ensure the uniqueness of bundle IDs, which allows attackers to cause a denial of service (ID collision and launch outage) via a crafted universal provisioning profile app.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3723		 Title:
CoreGraphics in Apple iOS before 8.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ICC profile in a PDF document, a different vulnerability than CVE-2015-3724.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3723
SFBID75490 		Severity:
Medium
Description:
CoreGraphics in Apple iOS before 8.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ICC profile in a PDF document, a different vulnerability than CVE-2015-3724.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3724		 Title:
CoreGraphics in Apple iOS before 8.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ICC profile in a PDF document, a different vulnerability than CVE-2015-3723.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3724
SFBID75490 		Severity:
Medium
Description:
CoreGraphics in Apple iOS before 8.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ICC profile in a PDF document, a different vulnerability than CVE-2015-3723.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3725		 Title:
MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch outage) via a crafted universal provisioning profile app.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3725
SFBID75490 		Severity:
Medium
Description:
MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch outage) via a crafted universal provisioning profile app.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3726		 Title:
The Telephony subsystem in Apple iOS before 8.4 allows physically proximate attackers to execute arbitrary code via a crafted (1) SIM or (2) UIM card.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3726
SFBID75490 		Severity:
Medium
Description:
The Telephony subsystem in Apple iOS before 8.4 allows physically proximate attackers to execute arbitrary code via a crafted (1) SIM or (2) UIM card.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3727		 Title:
WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict rename operations on WebSQL tables, which allows remote attackers to access...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3727
SFBID75492 		Severity:
Medium
Description:
WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict rename operations on WebSQL tables, which allows remote attackers to access an arbitrary web site's database via a crafted web site.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
CVE-2015-3728		 Title:
The WiFi Connectivity feature in Apple iOS before 8.4 allows remote Wi-Fi access points to trigger an automatic association, with an arbitrary security type, by operating with a recognized ESSID within an 802.11 network's coverage area.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-3728
SFBID75490 		Severity:
Medium
Description:
The WiFi Connectivity feature in Apple iOS before 8.4 allows remote Wi-Fi access points to trigger an automatic association, with an arbitrary security type, by operating with a recognized ESSID within an 802.11 network's coverage area.
Applies to:
 Created:
2015-07-02		 Updated:
2017-08-09
ID:
MITRE:29140		 Title:
oval:org.mitre.oval:def:29140: RHSA-2015:0808 -- java-1.6.0-openjdk security update		 Type:
Software		 Bulletins:
MITRE:29140 		Severity:
Low
Description:
The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)
Applies to:
java-1.6.0-openjdk		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28921		 Title:
oval:org.mitre.oval:def:28921: SUSE-SU-2015:0866-1 -- Security update for gd		 Type:
Software		 Bulletins:
MITRE:28921 		Severity:
Low
Description:
The graphics drawing library gd was updated to fix one security issue. The following vulnerability was fixed: * possible buffer read overflow (CVE-2014-9709)
Applies to:
gd		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29110		 Title:
oval:org.mitre.oval:def:29110: RHSA-2009:1060 -- pidgin security update		 Type:
Software		 Bulletins:
MITRE:29110 		Severity:
Low
Description:
Updated pidgin packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. A buffer overflow flaw was found in the way Pidgin initiates file transfers when using the Extensible Messaging and Presence Protocol (XMPP). If a Pidgin client initiates a file transfer, and the remote target sends a malformed response, it could cause Pidgin to crash or, potentially, execute arbitrary code with the permissions of the user running Pidgin. This flaw only affects accounts using XMPP, such as Jabber and Google Talk. (CVE-2009-1373)
Applies to:
pidgin		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28279		 Title:
oval:org.mitre.oval:def:28279: SUSE-SU-2015:0884-1 -- Security update for spice		 Type:
Software		 Bulletins:
MITRE:28279 		Severity:
Low
Description:
The remote desktop software SPICE was updated to address one security issue. The following vulnerabilitiy was fixed: * A stack-based buffer overflow in the password handling code allowed remote attackers to cause a denial of service (crash) via a long password in a SPICE ticket. (bsc#848279, CVE-2013-4282)
Applies to:
spice		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28696		 Title:
oval:org.mitre.oval:def:28696: SUSE-SU-2015:0974-1 -- Security update for apache2		 Type:
Web		 Bulletins:
MITRE:28696 		Severity:
Low
Description:
Apache2 updated to fix four security issues and one non-security bug. The following vulnerabilities have been fixed: - mod_headers rules could be bypassed via chunked requests. Adds "MergeTrailers" directive to restore legacy behavior. (bsc#871310, CVE-2013-5704) - An empty value in Content-Type could lead to a crash through a null pointer dereference and a denial of service. (bsc#899836, CVE-2014-3581) - Remote attackers could bypass intended access restrictions in mod_lua LuaAuthzProvider when multiple Require directives with different arguments are used. (bsc#909715, CVE-2014-8109)
Applies to:
apache2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29242		 Title:
oval:org.mitre.oval:def:29242: SUSE-SU-2015:0979-1 -- Security update for dnsmasq		 Type:
DNS		 Bulletins:
MITRE:29242 		Severity:
Low
Description:
The DNS server dnsmasq was updated to fix one security issue and one non-security bug. The following vulnerability was fixed: * CVE-2015-3294: A remote unauthenticated attacker could have caused a denial of service (DoS) or read heap memory, potentially disclosing information such as performed DNS queries or encryption keys. (bsc#928867)
Applies to:
dnsmasq		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28396		 Title:
oval:org.mitre.oval:def:28396: RHSA-2009:1148 -- httpd security update		 Type:
Web		 Bulletins:
MITRE:28396 		Severity:
Low
Description:
Updated httpd packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular Web server. A denial of service flaw was found in the Apache mod_proxy module when it was used as a reverse proxy. A remote attacker could use this flaw to force a proxy process to consume large amounts of CPU time. (CVE-2009-1890)
Applies to:
httpd		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29230		 Title:
oval:org.mitre.oval:def:29230: RHSA-2009:1530 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29230 		Severity:
Low
Description:
Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. nspr provides the Netscape Portable Runtime (NSPR). A flaw was found in the way Firefox handles form history. A malicious web page could steal saved form data by synthesizing input events, causing the browser to auto-fill form fields (which could then be read by an attacker). (CVE-2009-3370)
Applies to:
firefox
nspr
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28898		 Title:
oval:org.mitre.oval:def:28898: RHSA-2009:1584 -- java-1.6.0-openjdk security update		 Type:
Software		 Bulletins:
MITRE:28898 		Severity:
Low
Description:
Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language.
Applies to:
java-1.6.0-openjdk		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29270		 Title:
oval:org.mitre.oval:def:29270: RHSA-2009:1452 -- neon security update		 Type:
Software		 Bulletins:
MITRE:29270 		Severity:
Low
Description:
Updated neon packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. neon is an HTTP and WebDAV client library, with a C interface. It provides a high-level interface to HTTP and WebDAV methods along with a low-level interface for HTTP request handling. neon supports persistent connections, proxy servers, basic, digest and Kerberos authentication, and has complete SSL support.
Applies to:
neon		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29038		 Title:
oval:org.mitre.oval:def:29038: RHSA-2008:0583 -- openldap security update		 Type:
Services		 Bulletins:
MITRE:29038 		Severity:
Low
Description:
Updated openldap packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols for accessing directory services. A denial of service flaw was found in the way the OpenLDAP slapd daemon processed certain network messages. An unauthenticated remote attacker could send a specially crafted request that would crash the slapd daemon. (CVE-2008-2952) Users of openldap should upgrade to these updated packages, which contain a backported patch to correct this issue.
Applies to:
openldap		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28256		 Title:
oval:org.mitre.oval:def:28256: RHSA-2008:0839 -- postfix security update		 Type:
Mail		 Bulletins:
MITRE:28256 		Severity:
Low
Description:
Updated postfix packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL), and TLS. A flaw was found in the way Postfix dereferences symbolic links. If a local user has write access to a mail spool directory with no root mailbox, it may be possible for them to append arbitrary data to files that root has write permission to. (CVE-2008-2936) Red Hat would like to thank Sebastian Krahmer for responsibly disclosing this issue. All users of postfix should upgrade to these updated packages, which contain a backported patch that resolves this issue.
Applies to:
postfix		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29129		 Title:
oval:org.mitre.oval:def:29129: RHSA-2008:0885 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29129 		Severity:
Low
Description:
Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28823		 Title:
oval:org.mitre.oval:def:28823: ELSA-2015-1189 -- kvm security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28823 		Severity:
Low
Description:
[kvm-83-273.0.1.el5] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch [kvm-83.273.el5] - kvm-pcnet-Properly-handle-TX-requests-during-Link-Fail.patch [bz#1225896] - kvm-pcnet-fix-Negative-array-index-read.patch [bz#1225896] - kvm-pcnet-force-the-buffer-access-to-be-in-bounds-during.patch [bz#1225896] - Resolves: bz#1225896 (EMBARGOED CVE-2015-3209 kvm: qemu: pcnet: multi-tmd buffer overflow in the tx path [rhel-5.11.z)
Applies to:
kmod-kvm
kmod-kvm-debug
kvm
kvm-qemu-img
kvm-tools		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28926		 Title:
oval:org.mitre.oval:def:28926: RHSA-2009:1471 -- elinks security update		 Type:
Web		 Bulletins:
MITRE:28926 		Severity:
Low
Description:
An updated elinks package that fixes two security issues is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. ELinks is a text-based Web browser. ELinks does not display any images, but it does support frames, tables, and most other HTML tags. An off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A remote attacker could use this flaw to create a specially-crafted HTML file that would cause ELinks to crash or, possibly, execute arbitrary code when rendered. (CVE-2008-7224)
Applies to:
elinks		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29343		 Title:
oval:org.mitre.oval:def:29343: RHSA-2009:0225 -- Red Hat Enterprise Linux 5.3 kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29343 		Severity:
Low
Description:
Updated kernel packages that fix three security issues, address several hundred bugs and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 5. This is the third regular update. This update has been rated as having important security impact by the Red Hat Security Response Team.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29286		 Title:
oval:org.mitre.oval:def:29286: RHSA-2009:0444 -- giflib security update		 Type:
Software		 Bulletins:
MITRE:29286 		Severity:
Low
Description:
Updated giflib packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The giflib packages contain a shared library of functions for loading and saving GIF image files. This library is API and ABI compatible with libungif, the library that supported uncompressed GIF image files while the Unisys LZW patent was in effect. Several flaws were discovered in the way giflib decodes GIF images. An attacker could create a carefully crafted GIF image that could cause an application using giflib to crash or, possibly, execute arbitrary code when opened by a victim. (CVE-2005-2974, CVE-2005-3350)
Applies to:
giflib		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29039		 Title:
oval:org.mitre.oval:def:29039: RHSA-2008:0893 -- bzip2 security update		 Type:
Software		 Bulletins:
MITRE:29039 		Severity:
Low
Description:
Updated bzip2 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Bzip2 is a freely available, high-quality data compressor. It provides both stand-alone compression and decompression utilities, as well as a shared library for use with other programs. A buffer over-read flaw was discovered in the bzip2 decompression routine. This issue could cause an application linked against the libbz2 library to crash when decompressing malformed archives. (CVE-2008-1372) Users of bzip2 should upgrade to these updated packages, which contain a backported patch to resolve this issue.
Applies to:
bzip2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28617		 Title:
oval:org.mitre.oval:def:28617: RHSA-2009:1106 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:28617 		Severity:
Low
Description:
Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29369		 Title:
oval:org.mitre.oval:def:29369: RHSA-2009:1321 -- nfs-utils security and bug fix update		 Type:
Miscellaneous		 Bulletins:
MITRE:29369 		Severity:
Low
Description:
An updated nfs-utils package that fixes a security issue and several bugs is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The nfs-utils package provides a daemon for the kernel NFS server and related tools.
Applies to:
nfs-utils		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29146		 Title:
oval:org.mitre.oval:def:29146: SUSE-SU-2015:0942-1 -- Security update for gstreamer-0_10-plugins-bad		 Type:
Miscellaneous		 Bulletins:
MITRE:29146 		Severity:
Low
Description:
gstreamer-0_10-plugins-bad was updated to fix a security issue, a buffer overflow in mp4 parsing (bnc#927559 CVE-2015-0797).
Applies to:
gstreamer-0_10-plugins-bad		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29199		 Title:
oval:org.mitre.oval:def:29199: RHSA-2008:0946 -- ed security update		 Type:
Software		 Bulletins:
MITRE:29199 		Severity:
Low
Description:
An updated ed package that fixes one security issue is now available for Red Hat Enterprise Linux 2.1, 3, 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. ed is a line-oriented text editor, used to create, display, and modify text files (both interactively and via shell scripts). A heap-based buffer overflow was discovered in the way ed, the GNU line editor, processed long file names. An attacker could create a file with a specially-crafted name that could possibly execute an arbitrary code when opened in the ed editor. (CVE-2008-3916) Users of ed should upgrade to this updated package, which contains a backported patch to resolve this issue.
Applies to:
ed		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29170		 Title:
oval:org.mitre.oval:def:29170: RHSA-2009:1561 -- libvorbis security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29170 		Severity:
Low
Description:
Updated libvorbis packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format.
Applies to:
libvorbis		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29098		 Title:
oval:org.mitre.oval:def:29098: RHSA-2009:0267 -- sudo security update		 Type:
Software		 Bulletins:
MITRE:29098 		Severity:
Low
Description:
An updated sudo package to fix a security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The sudo (superuser do) utility allows system administrators to give certain users the ability to run commands as root with logging.
Applies to:
sudo		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29288		 Title:
oval:org.mitre.oval:def:29288: RHSA-2009:0008 -- dbus security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29288 		Severity:
Low
Description:
Updated dbus packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. D-Bus is a system for sending messages between applications. It is used for the system-wide message bus service and as a per-user-login-session messaging facility. A denial-of-service flaw was discovered in the system for sending messages between applications. A local user could send a message with a malformed signature to the bus causing the bus (and, consequently, any process using libdbus to receive messages) to abort. (CVE-2008-3834)
Applies to:
dbus		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29255		 Title:
oval:org.mitre.oval:def:29255: RHSA-2008:0581 -- bluez-libs and bluez-utils security update		 Type:
Software		 Bulletins:
MITRE:29255 		Severity:
Low
Description:
Updated bluez-libs and bluez-utils packages that fix a security flaw are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The bluez-libs package contains libraries for use in Bluetooth applications. The bluez-utils package contains Bluetooth daemons and utilities. An input validation flaw was found in the Bluetooth Session Description Protocol (SDP) packet parser used by the Bluez Bluetooth utilities. A Bluetooth device with an already-established trust relationship, or a local user registering a service record via a UNIX reg; socket or D-Bus interface, could cause a crash, or possibly execute arbitrary code with privileges of the hcid daemon. (CVE-2008-2374) Users of bluez-libs and bluez-utils are advised to upgrade to these updated packages, which contains a backported patch to correct this issue.
Applies to:
bluez-libs
bluez-utils		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29289		 Title:
oval:org.mitre.oval:def:29289: RHSA-2008:0967 -- httpd security and bug fix update		 Type:
Web		 Bulletins:
MITRE:29289 		Severity:
Low
Description:
Updated httpd packages that resolve several security issues and fix a bug are now available for Red Hat Enterprise Linux 3, 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular Web server. A flaw was found in the mod_proxy Apache module. An attacker in control of a Web server to which requests were being proxied could have caused a limited denial of service due to CPU consumption and stack exhaustion. (CVE-2008-2364)
Applies to:
httpd		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29169		 Title:
oval:org.mitre.oval:def:29169: RHSA-2009:1186 -- nspr and nss security, bug fix, and enhancement update		 Type:
Web		 Bulletins:
MITRE:29169 		Severity:
Low
Description:
Updated nspr and nss packages that fix security issues, bugs, and add an enhancement are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team.
Applies to:
nspr
nss		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28793		 Title:
oval:org.mitre.oval:def:28793: RHSA-2009:0326 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:28793 		Severity:
Low
Description:
Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28407		 Title:
oval:org.mitre.oval:def:28407: RHSA-2008:0648 -- tomcat security update		 Type:
Web		 Bulletins:
MITRE:28407 		Severity:
Low
Description:
Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. A cross-site scripting vulnerability was discovered in the HttpServletResponse.sendErrormethod. A remote attacker could inject arbitrary web script or HTML via forged HTTP headers. (CVE-2008-1232)
Applies to:
tomcat5		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29084		 Title:
oval:org.mitre.oval:def:29084: RHSA-2015:0807 -- java-1.7.0-openjdk security update		 Type:
Software		 Bulletins:
MITRE:29084 		Severity:
Low
Description:
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)
Applies to:
java-1.7.0-openjdk		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29091		 Title:
oval:org.mitre.oval:def:29091: RHSA-2009:1061 -- freetype security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29091 		Severity:
Low
Description:
Updated freetype packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. FreeType is a free, high-quality, portable font engine that can open and manage font files. It also loads, hints, and renders individual glyphs efficiently. These packages provide the FreeType 2 font engine.
Applies to:
freetype		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28242		 Title:
oval:org.mitre.oval:def:28242: RHSA-2008:0897 -- ruby security update		 Type:
Software		 Bulletins:
MITRE:28242 		Severity:
Low
Description:
Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for quick and easy object-oriented programming. The Ruby DNS resolver library, resolv.rb, used predictable transaction IDs and a fixed source port when sending DNS requests. A remote attacker could use this flaw to spoof a malicious reply to a DNS query. (CVE-2008-3905)
Applies to:
ruby		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29178		 Title:
oval:org.mitre.oval:def:29178: RHSA-2009:0397 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29178 		Severity:
Low
Description:
Updated firefox packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A memory corruption flaw was discovered in the way Firefox handles XML files containing an XSLT transform. A remote attacker could use this flaw to crash Firefox or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-1169)
Applies to:
firefox
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29301		 Title:
oval:org.mitre.oval:def:29301: RHSA-2009:1127 -- kdelibs security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29301 		Severity:
Low
Description:
Updated kdelibs packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The kdelibs packages provide libraries for the K Desktop Environment (KDE).
Applies to:
kdelibs		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28850		 Title:
oval:org.mitre.oval:def:28850: RHSA-2009:0259 -- mod_auth_mysql security update		 Type:
Software		 Bulletins:
MITRE:28850 		Severity:
Low
Description:
An updated mod_auth_mysql package to correct a security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The mod_auth_mysql package includes an extension module for the Apache HTTP Server which can be used to implement web user authentication against a MySQL database.
Applies to:
mod_auth_mysql		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28765		 Title:
oval:org.mitre.oval:def:28765: RHSA-2009:1453 -- pidgin security update		 Type:
Software		 Bulletins:
MITRE:28765 		Severity:
Low
Description:
Updated pidgin packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. Info/Query (IQ) is an Extensible Messaging and Presence Protocol (XMPP) specific request-response mechanism. A NULL pointer dereference flaw was found in the way the Pidgin XMPP protocol plug-in processes IQ error responses when trying to fetch a custom smiley. A remote client could send a specially-crafted IQ error response that would crash Pidgin. (CVE-2009-3085)
Applies to:
pidgin		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29380		 Title:
oval:org.mitre.oval:def:29380: RHSA-2009:0457 -- libwmf security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29380 		Severity:
Low
Description:
Updated libwmf packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. libwmf is a library for reading and converting Windows Metafile Format (WMF) vector graphics. libwmf is used by applications such as GIMP and ImageMagick.
Applies to:
libwmf		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29190		 Title:
oval:org.mitre.oval:def:29190: RHSA-2009:1490 -- squirrelmail security update		 Type:
Web		 Bulletins:
MITRE:29190 		Severity:
Low
Description:
An updated squirrelmail package that fixes several security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Applies to:
squirrelmail		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28800		 Title:
oval:org.mitre.oval:def:28800: RHSA-2009:1075 -- httpd security update		 Type:
Web		 Bulletins:
MITRE:28800 		Severity:
Low
Description:
Updated httpd packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular and freely-available Web server. A flaw was found in the handling of compression structures between mod_ssl and OpenSSL. If too many connections were opened in a short period of time, all system memory and swap space would be consumed by httpd, negatively impacting other processes, or causing a system crash. (CVE-2008-1678)
Applies to:
httpd		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29079		 Title:
oval:org.mitre.oval:def:29079: RHSA-2009:0479 -- perl-DBD-Pg security update		 Type:
Software		 Bulletins:
MITRE:29079 		Severity:
Low
Description:
An updated perl-DBD-Pg package that fixes two security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Perl DBI is a database access Application Programming Interface (API) for the Perl language. perl-DBD-Pg allows Perl applications to access PostgreSQL database servers. A heap-based buffer overflow flaw was discovered in the pg_getline function implementation. If the pg_getline or getline functions read large, untrusted records from a database, it could cause an application using these functions to crash or, possibly, execute arbitrary code. (CVE-2009-0663)
Applies to:
perl-DBD-Pg		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29237		 Title:
oval:org.mitre.oval:def:29237: RHSA-2008:0978 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29237 		Severity:
Low
Description:
All firefox users should upgrade to these updated packages, which contain backported patches that correct these issues.
Applies to:
devhelp
firefox
nss
xulrunner
yelp		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28421		 Title:
oval:org.mitre.oval:def:28421: RHSA-2009:0408 -- krb5 security update		 Type:
Services		 Bulletins:
MITRE:28421 		Severity:
Low
Description:
Updated krb5 packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC). The Generic Security Service Application Program Interface (GSS-API) definition provides security services to callers (protocols) in a generic fashion. The Simple and Protected GSS-API Negotiation (SPNEGO) mechanism is used by GSS-API peers to choose from a common set of security mechanisms. An input validation flaw was found in the ASN.1 (Abstract Syntax Notation One) decoder used by MIT Kerberos. A remote attacker could use this flaw to crash a network service using the MIT Kerberos library, such as kadmind or krb5kdc, by causing it to dereference or free an uninitialized pointer. (CVE-2009-0846)
Applies to:
krb5		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29143		 Title:
oval:org.mitre.oval:def:29143: RHSA-2009:0018 -- xterm security update		 Type:
Software		 Bulletins:
MITRE:29143 		Severity:
Low
Description:
An updated xterm package to correct a security issue is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xterm program is a terminal emulator for the X Window System. A flaw was found in the xterm handling of Device Control Request Status String (DECRQSS) escape sequences. An attacker could create a malicious text file (or log entry, if unfiltered) that could run arbitrary commands if read by a victim inside an xterm window. (CVE-2008-2383)
Applies to:
xterm		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29166		 Title:
oval:org.mitre.oval:def:29166: RHSA-2009:0258 -- thunderbird security update		 Type:
Software		 Bulletins:
MITRE:29166 		Severity:
Low
Description:
An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2009-0352, CVE-2009-0353, CVE-2009-0772, CVE-2009-0774, CVE-2009-0775)
Applies to:
thunderbird		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29029		 Title:
oval:org.mitre.oval:def:29029: RHSA-2008:0649 -- libxslt security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29029 		Severity:
Low
Description:
Updated libxslt packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. libxslt is a library for transforming XML files into other XML files using the standard XSLT stylesheet transformation mechanism. A heap buffer overflow flaw was discovered in the RC4 libxslt library extension. An attacker could create a malicious XSL file that would cause a crash, or, possibly, execute arbitrary code with the privileges of the application using the libxslt library to perform XSL transformations on untrusted XSL style sheets. (CVE-2008-2935) Red Hat would like to thank Chris Evans for reporting this vulnerability. All libxslt users are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.
Applies to:
libxslt		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29271		 Title:
oval:org.mitre.oval:def:29271: RHSA-2009:1470 -- openssh security update		 Type:
Services		 Bulletins:
MITRE:29271 		Severity:
Low
Description:
Updated openssh packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Applies to:
openssh		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28787		 Title:
oval:org.mitre.oval:def:28787: RHSA-2008:0533 -- bind security update		 Type:
Software		 Bulletins:
MITRE:28787 		Severity:
Low
Description:
Updated bind packages that help mitigate DNS spoofing attacks are now available. This update has been rated as having important security impact by the Red Hat Security Response Team. We have updated the Enterprise Linux 5 packages in this advisory. The default and sample caching-nameserver configuration files have been updated so that they do not specify a fixed query-source port. Administrators wishing to take advantage of randomized UDP source ports should check their configuration file to ensure they have not specified fixed query-source ports. ISC BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols.
Applies to:
bind
selinux-policy
selinux-policy-targeted		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28736		 Title:
oval:org.mitre.oval:def:28736: RHSA-2009:0449 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:28736 		Severity:
Low
Description:
Updated firefox packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-1313)
Applies to:
firefox
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29299		 Title:
oval:org.mitre.oval:def:29299: RHSA-2009:1107 -- apr-util security update		 Type:
Web		 Bulletins:
MITRE:29299 		Severity:
Low
Description:
Updated apr-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. apr-util is a utility library used with the Apache Portable Runtime (APR). It aims to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing, and more.
Applies to:
apr-util		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28954		 Title:
oval:org.mitre.oval:def:28954: RHSA-2009:0373 -- systemtap security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28954 		Severity:
Low
Description:
Updated systemtap packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SystemTap is an instrumentation infrastructure for systems running version 2.6 of the Linux kernel. SystemTap scripts can collect system operations data, greatly simplifying information gathering. Collected data can then assist in performance measuring, functional testing, and performance and function problem diagnosis.
Applies to:
systemtap		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28693		 Title:
oval:org.mitre.oval:def:28693: RHSA-2008:0908 -- thunderbird security update		 Type:
Software		 Bulletins:
MITRE:28693 		Severity:
Low
Description:
Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060, CVE-2008-4061, CVE-2008-4062)
Applies to:
thunderbird		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29192		 Title:
oval:org.mitre.oval:def:29192: RHSA-2008:0855 -- openssh security update		 Type:
Services		 Bulletins:
MITRE:29192 		Severity:
Low
Description:
Updated openssh packages are now available for Red Hat Enterprise Linux 4, Red Hat Enterprise Linux 5, and Red Hat Enterprise Linux 4.5 Extended Update Support. This update has been rated as having critical security impact by the Red Hat Security Response Team.
Applies to:
openssh		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29259		 Title:
oval:org.mitre.oval:def:29259: RHSA-2009:1364 -- gdm security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29259 		Severity:
Low
Description:
Updated gdm packages that fix a security issue and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. The GNOME Display Manager (GDM) is a configurable re-implementation of XDM, the X Display Manager. GDM allows you to log in to your system with the X Window System running, and supports running several different X sessions on your local machine at the same time. A flaw was found in the way the gdm package was built. The gdm package was missing TCP wrappers support, which could result in an administrator believing they had access restrictions enabled when they did not. (CVE-2009-2697)
Applies to:
gdm		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29241		 Title:
oval:org.mitre.oval:def:29241: RHSA-2008:0836 -- libxml2 security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29241 		Severity:
Low
Description:
Updated libxml2 packages that fix a security issue are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The original fix used in this errata caused some applications using the libxml2 library in an unexpected way to crash when used with updated libxml2 packages. We have updated the packages for Red Hat Enterprise Linux 3, 4 and 5 to use a different fix that does not break affected applications.
Applies to:
libxml2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29264		 Title:
oval:org.mitre.oval:def:29264: RHSA-2009:1529 -- samba security update		 Type:
Services		 Bulletins:
MITRE:29264 		Severity:
Low
Description:
Updated samba packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Samba is a suite of programs used by machines to share files, printers, and other information. A denial of service flaw was found in the Samba smbd daemon. An authenticated, remote user could send a specially-crafted response that would cause an smbd child process to enter an infinite loop. An authenticated, remote user could use this flaw to exhaust system resources by opening multiple CIFS sessions. (CVE-2009-2906)
Applies to:
samba		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29379		 Title:
oval:org.mitre.oval:def:29379: RHSA-2009:1427 -- fetchmail security update		 Type:
Mail		 Bulletins:
MITRE:29379 		Severity:
Low
Description:
An updated fetchmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Applies to:
fetchmail		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29109		 Title:
oval:org.mitre.oval:def:29109: RHSA-2009:1620 -- bind security update		 Type:
Software		 Bulletins:
MITRE:29109 		Severity:
Low
Description:
Updated bind packages that fix one security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Applies to:
bind		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29183		 Title:
oval:org.mitre.oval:def:29183: RHSA-2009:1126 -- thunderbird security update		 Type:
Software		 Bulletins:
MITRE:29183 		Severity:
Low
Description:
An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2009-1392, CVE-2009-1303, CVE-2009-1305, CVE-2009-1833, CVE-2009-1838)
Applies to:
thunderbird		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29153		 Title:
oval:org.mitre.oval:def:29153: RHSA-2009:1243 -- Red Hat Enterprise Linux 5.4 kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29153 		Severity:
Low
Description:
Updated kernel packages that fix security issues, address several hundred bugs and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 5. This is the fourth regular update. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29103		 Title:
oval:org.mitre.oval:def:29103: RHSA-2009:1138 -- openswan security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29103 		Severity:
Low
Description:
Updated openswan packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Openswan is a free implementation of Internet Protocol Security (IPsec) and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN).
Applies to:
openswan		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29069		 Title:
oval:org.mitre.oval:def:29069: RHSA-2008:0939 -- openoffice.org security update		 Type:
Software		 Bulletins:
MITRE:29069 		Severity:
Low
Description:
Updated openoffice.org packages that correct security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenOffice.org is an office productivity suite that includes desktop applications such as a word processor, spreadsheet, presentation manager, formula editor, and drawing program.
Applies to:
openoffice.org
openoffice.org2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29248		 Title:
oval:org.mitre.oval:def:29248: RHSA-2015:0803 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29248 		Severity:
Low
Description:
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29028		 Title:
oval:org.mitre.oval:def:29028: RHSA-2008:0569 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29028 		Severity:
Low
Description:
Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)
Applies to:
devhelp
firefox
xulrunner
yelp		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28333		 Title:
oval:org.mitre.oval:def:28333: SUSE-SU-2015:0743-1 -- Security update for mariadb		 Type:
Software		 Bulletins:
MITRE:28333 		Severity:
Low
Description:
mariadb was updated to version 10.0.16 to fix 40 security issues. These security issues were fixed: - CVE-2015-0411: Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier, and 5.6.21 and earlier, allowed remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Server : Security : Encryption (bnc#915911).
Applies to:
mariadb		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29345		 Title:
oval:org.mitre.oval:def:29345: RHSA-2009:0338 -- php security update		 Type:
Web		 Bulletins:
MITRE:29345 		Severity:
Low
Description:
Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.
Applies to:
php		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29205		 Title:
oval:org.mitre.oval:def:29205: RHSA-2009:1201 -- java-1.6.0-openjdk security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29205 		Severity:
Low
Description:
Updated java-1.6.0-openjdk packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language.
Applies to:
java-1.6.0-openjdk		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29148		 Title:
oval:org.mitre.oval:def:29148: SUSE-SU-2015:1020-1 -- Security update for autofs		 Type:
Software		 Bulletins:
MITRE:29148 		Severity:
Low
Description:
autofs was updated to fix one security issue. This security issue was fixed: - CVE-2014-8169: Prevent potential privilege escalation via interpreter load path for program-based automount maps (bnc#917977). These non-security issues were fixed: - Dont pass sloppy option for other than nfs mounts (bnc#901448, bnc#916203)
Applies to:
autofs		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28514		 Title:
oval:org.mitre.oval:def:28514: RHSA-2015:0800 -- openssl security update		 Type:
Web		 Bulletins:
MITRE:28514 		Severity:
Low
Description:
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. It was discovered that OpenSSL would accept ephemeral RSA keys when using non-export RSA cipher suites. A malicious server could make a TLS/SSL client using OpenSSL use a weaker key exchange method. (CVE-2015-0204)
Applies to:
openssl		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29041		 Title:
oval:org.mitre.oval:def:29041: RHSA-2009:1463 -- newt security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29041 		Severity:
Low
Description:
Updated newt packages that fix one security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Newt is a programming library for color text mode, widget-based user interfaces. Newt can be used to add stacked windows, entry widgets, checkboxes, radio buttons, labels, plain text fields, scrollbars, and so on, to text mode user interfaces.
Applies to:
newt		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28894		 Title:
oval:org.mitre.oval:def:28894: RHSA-2009:1100 -- wireshark security update		 Type:
Software		 Bulletins:
MITRE:28894 		Severity:
Low
Description:
Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. A format string flaw was found in Wireshark. If Wireshark read a malformed packet off a network or opened a malicious dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2009-1210) Several denial of service flaws were found in Wireshark. Wireshark could crash or stop responding if it read a malformed packet off a network, or opened a malicious dump file. (CVE-2009-1268, CVE-2009-1269, CVE-2009-1829) Users of wireshark should upgrade to these updated packages, which contain Wireshark version 1.0.8, and resolve these issues. All running instances of Wireshark must be restarted for the update to take effect.
Applies to:
wireshark		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29342		 Title:
oval:org.mitre.oval:def:29342: RHSA-2009:1674 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29342 		Severity:
Low
Description:
Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
Applies to:
firefox
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29125		 Title:
oval:org.mitre.oval:def:29125: RHSA-2009:1130 -- kdegraphics security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29125 		Severity:
Low
Description:
Updated kdegraphics packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment (KDE). Scalable Vector Graphics (SVG) is an XML-based language to describe vector images. KSVG is a framework aimed at implementing the latest W3C SVG specifications.
Applies to:
kdegraphics		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28627		 Title:
oval:org.mitre.oval:def:28627: RHSA-2009:1222 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:28627 		Severity:
Low
Description:
Updated kernel packages that fix two security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29310		 Title:
oval:org.mitre.oval:def:29310: RHSA-2009:1513 -- cups security update		 Type:
Services		 Bulletins:
MITRE:29310 		Severity:
Low
Description:
Updated cups packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Applies to:
cups		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29188		 Title:
oval:org.mitre.oval:def:29188: RHSA-2009:1162 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29188 		Severity:
Low
Description:
Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox.
Applies to:
firefox
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29045		 Title:
oval:org.mitre.oval:def:29045: RHSA-2009:0256 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29045 		Severity:
Low
Description:
All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.6, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
Applies to:
firefox
nss
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29283		 Title:
oval:org.mitre.oval:def:29283: RHSA-2009:1646 -- libtool security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29283 		Severity:
Low
Description:
Updated libtool packages that fix one security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Applies to:
libtool		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28495		 Title:
oval:org.mitre.oval:def:28495: RHSA-2009:1036 -- ipsec-tools security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28495 		Severity:
Low
Description:
An updated ipsec-tools package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The ipsec-tools package is used in conjunction with the IPsec functionality in the Linux kernel and includes racoon, an IKEv1 keying daemon. A denial of service flaw was found in the ipsec-tools racoon daemon. An unauthenticated, remote attacker could trigger a NULL pointer dereference that could cause the racoon daemon to crash. (CVE-2009-1574)
Applies to:
ipsec-tools		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28953		 Title:
oval:org.mitre.oval:def:28953: RHSA-2009:1337 -- gfs2-utils security and bug fix update		 Type:
Software		 Bulletins:
MITRE:28953 		Severity:
Low
Description:
An updated gfs2-utils package that fixes multiple security issues and various bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. The gfs2-utils package provides the user-space tools necessary to mount, create, maintain, and test GFS2 file systems. Multiple insecure temporary file use flaws were discovered in GFS2 user level utilities. A local attacker could use these flaws to overwrite an arbitrary file writable by a victim running those utilities (typically root) with the output of the utilities via a symbolic link attack. (CVE-2008-6552)
Applies to:
gfs2-utils		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29167		 Title:
oval:org.mitre.oval:def:29167: RHSA-2008:0789 -- dnsmasq security update		 Type:
DNS		 Bulletins:
MITRE:29167 		Severity:
Low
Description:
An updated dnsmasq package that implements UDP source-port randomization is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Dnsmasq is lightweight DNS forwarder and DHCP server. It is designed to provide DNS and, optionally, DHCP, to a small network. The dnsmasq DNS resolver used a fixed source UDP port. This could have made DNS spoofing attacks easier. dnsmasq has been updated to use random UDP source ports, helping to make DNS spoofing attacks harder. (CVE-2008-1447) All dnsmasq users are advised to upgrade to this updated package, that upgrades dnsmasq to version 2.45, which resolves this issue.
Applies to:
dnsmasq		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29052		 Title:
oval:org.mitre.oval:def:29052: RHSA-2009:1341 -- cman security, bug fix, and enhancement update		 Type:
Software		 Bulletins:
MITRE:29052 		Severity:
Low
Description:
Updated cman packages that fix several security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. The Cluster Manager (cman) utility provides services for managing a Linux cluster. Multiple insecure temporary file use flaws were found in fence_apc_snmp and ccs_tool. A local attacker could use these flaws to overwrite an arbitrary file writable by a victim running those utilities (typically root) with the output of the utilities via a symbolic link attack. (CVE-2008-4579, CVE-2008-6552)
Applies to:
cman		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29300		 Title:
oval:org.mitre.oval:def:29300: RHSA-2009:0011 -- lcms security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29300 		Severity:
Low
Description:
Updated lcms packages that resolve several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Applies to:
lcms		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29210		 Title:
oval:org.mitre.oval:def:29210: RHSA-2008:1023 -- pidgin security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29210 		Severity:
Low
Description:
Updated Pidgin packages that fix several security issues and bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Pidgin is a multi-protocol Internet Messaging client. A denial-of-service flaw was found in Pidgin's MSN protocol handler. If a remote user was able to send, and the Pidgin user accepted, a carefully-crafted file request, it could result in Pidgin crashing. (CVE-2008-2955)
Applies to:
pidgin		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29133		 Title:
oval:org.mitre.oval:def:29133: RHSA-2008:0818 -- hplip security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29133 		Severity:
Low
Description:
Updated hplip packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The hplip (Hewlett-Packard Linux Imaging and Printing) packages provide drivers for Hewlett-Packard printers and multifunction peripherals. A flaw was discovered in the hplip alert-mailing functionality. A local attacker could elevate their privileges by using specially-crafted packets to trigger alert mails, which are sent by the root account. (CVE-2008-2940) A flaw was discovered in the hpssd message parser. By sending specially-crafted packets, a local attacker could cause a denial of service, stopping the hpssd process. (CVE-2008-2941) Users of hplip should upgrade to these updated packages, which contain backported patches to correct these issues.
Applies to:
hplip		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29365		 Title:
oval:org.mitre.oval:def:29365: RHSA-2009:1601 -- kdelibs security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29365 		Severity:
Low
Description:
Updated kdelibs packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The kdelibs packages provide libraries for the K Desktop Environment (KDE). A buffer overflow flaw was found in the kdelibs string to floating point conversion routines. A web page containing malicious JavaScript could crash Konqueror or, potentially, execute arbitrary code with the privileges of the user running Konqueror. (CVE-2009-0689)
Applies to:
kdelibs		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29193		 Title:
oval:org.mitre.oval:def:29193: RHSA-2009:0431 -- kdegraphics security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29193 		Severity:
Low
Description:
Updated kdegraphics packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment, including KPDF, a viewer for Portable Document Format (PDF) files. Multiple integer overflow flaws were found in KPDF's JBIG2 decoder. An attacker could create a malicious PDF file that would cause KPDF to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0147, CVE-2009-1179)
Applies to:
kdegraphics		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29165		 Title:
oval:org.mitre.oval:def:29165: SUSE-SU-2015:0990-1 -- Security update for curl		 Type:
Web		 Bulletins:
MITRE:29165 		Severity:
Low
Description:
curl was updated to fix five security issues. The following vulnerabilities were fixed: * CVE-2015-3143: curl could re-use NTML authenticateds connections * CVE-2015-3144: curl could access memory out of bounds with zero length host names * CVE-2015-3145: curl cookie parser could access memory out of boundary * CVE-2015-3148: curl could treat Negotiate as not connection-oriented * CVE-2015-3153: curl could have sent sensitive HTTP headers also to proxies
Applies to:
curl		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29171		 Title:
oval:org.mitre.oval:def:29171: RHSA-2009:0345 -- ghostscript security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29171 		Severity:
Low
Description:
Updated ghostscript packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ghostscript is a set of software that provides a PostScript(TM) interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files. Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in Ghostscript's International Color Consortium Format library (icclib). Using specially-crafted ICC profiles, an attacker could create a malicious PostScript or PDF file with embedded images which could cause Ghostscript to crash, or, potentially, execute arbitrary code when opened by the victim. (CVE-2009-0583, CVE-2009-0584) All users of ghostscript are advised to upgrade to these updated packages, which contain a backported patch to correct these issues.
Applies to:
ghostscript		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29090		 Title:
oval:org.mitre.oval:def:29090: RHSA-2008:0907 -- pam_krb5 security update		 Type:
Services		 Bulletins:
MITRE:29090 		Severity:
Low
Description:
An updated pam_krb5 package that fixes a security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The pam_krb5 module allows Pluggable Authentication Modules (PAM) aware applications to use Kerberos to verify user identities by obtaining user credentials at log in time.
Applies to:
pam_krb5		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29396		 Title:
oval:org.mitre.oval:def:29396: RHSA-2009:1095 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29396 		Severity:
Low
Description:
Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-1392, CVE-2009-1832, CVE-2009-1833, CVE-2009-1837, CVE-2009-1838, CVE-2009-1841)
Applies to:
firefox
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28629		 Title:
oval:org.mitre.oval:def:28629: RHSA-2009:1179 -- bind security update		 Type:
Software		 Bulletins:
MITRE:28629 		Severity:
Low
Description:
Updated bind packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. [Updated 29th July 2009] The packages in this erratum have been updated to also correct this issue in the bind-sdb package.
Applies to:
bind		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28978		 Title:
oval:org.mitre.oval:def:28978: RHSA-2009:0341 -- curl security update		 Type:
Web		 Bulletins:
MITRE:28978 		Severity:
Low
Description:
Updated curl packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity.
Applies to:
curl		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29111		 Title:
oval:org.mitre.oval:def:29111: RHSA-2009:1426 -- openoffice.org security update		 Type:
Software		 Bulletins:
MITRE:29111 		Severity:
Low
Description:
Updated openoffice.org packages that correct security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor, and a drawing program. An integer underflow flaw and a boundary error flaw, both possibly leading to a heap-based buffer overflow, were found in the way OpenOffice.org parses certain records in Microsoft Word documents. An attacker could create a specially-crafted Microsoft Word document, which once opened by an unsuspecting user, could cause OpenOffice.org to crash or, potentially, execute arbitrary code with the permissions of the user running OpenOffice.org. (CVE-2009-0200, CVE-2009-0201) All users of OpenOffice.org are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running instances of OpenOffice.org applications must be restarted for this update to take effect.
Applies to:
openoffice.org
openoffice.org2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29217		 Title:
oval:org.mitre.oval:def:29217: RHSA-2009:1219 -- libvorbis security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29217 		Severity:
Low
Description:
Updated libvorbis packages that fix one security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The libvorbis packages contain runtime libraries for use in programs that support Ogg Vorbis. Ogg Vorbis is a fully open, non-proprietary, patent-and royalty-free, general-purpose compressed audio format.
Applies to:
libvorbis		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29163		 Title:
oval:org.mitre.oval:def:29163: RHSA-2009:1203 -- subversion security update		 Type:
Services		 Bulletins:
MITRE:29163 		Severity:
Low
Description:
Updated subversion packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes.
Applies to:
subversion		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29276		 Title:
oval:org.mitre.oval:def:29276: RHSA-2009:0421 -- ghostscript security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29276 		Severity:
Low
Description:
Updated ghostscript packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ghostscript is a set of software that provides a PostScript interpreter, a set of C procedures (the Ghostscript library, which implements the graphics capabilities in the PostScript language) and an interpreter for Portable Document Format (PDF) files.
Applies to:
ghostscript		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29265		 Title:
oval:org.mitre.oval:def:29265: RHSA-2008:0957 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29265 		Severity:
Low
Description:
Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The original packages distributed with this errata had a bug which prevented the Xen kernel booting on older hardware. We have updated the packages to correct this bug.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29261		 Title:
oval:org.mitre.oval:def:29261: RHSA-2009:0013 -- avahi security update		 Type:
DNS		 Bulletins:
MITRE:29261 		Severity:
Low
Description:
Updated avahi packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Avahi is an implementation of the DNS Service Discovery and Multicast DNS specifications for Zeroconf Networking. It facilitates service discovery on a local network. Avahi and Avahi-aware applications allow you to plug your computer into a network and, with no configuration, view other people to chat with, see printers to print to, and find shared files on other computers. Hugo Dias discovered a denial of service flaw in avahi-daemon. A remote attacker on the same local area network (LAN) could send a specially-crafted mDNS (Multicast DNS) packet that would cause avahi-daemon to exit unexpectedly due to a failed assertion check. (CVE-2008-5081) All users are advised to upgrade to these updated packages, which contain a backported patch which resolves this issue. After installing the update, avahi-daemon will be restarted automatically.
Applies to:
avahi		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29319		 Title:
oval:org.mitre.oval:def:29319: RHSA-2009:0352 -- gstreamer-plugins-base security update		 Type:
Software		 Bulletins:
MITRE:29319 		Severity:
Low
Description:
Updated gstreamer-plugins-base packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. GStreamer is a streaming media framework based on graphs of filters which operate on media data. GStreamer Base Plug-ins is a collection of well-maintained base plug-ins. An integer overflow flaw which caused a heap-based buffer overflow was discovered in the Vorbis comment tags reader. An attacker could create a carefully-crafted Vorbis file that would cause an application using GStreamer to crash or, potentially, execute arbitrary code if opened by a victim. (CVE-2009-0586)
Applies to:
gstreamer-plugins-base		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29275		 Title:
oval:org.mitre.oval:def:29275: RHSA-2009:1549 -- wget security update		 Type:
Software		 Bulletins:
MITRE:29275 		Severity:
Low
Description:
An updated wget package that fixes a security issue is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. GNU Wget is a file retrieval utility that can use HTTP, HTTPS, and FTP. Daniel Stenberg reported that Wget is affected by the previously published null prefix attack, caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse Wget into accepting it by mistake. (CVE-2009-3490) Wget users should upgrade to this updated package, which contains a backported patch to correct this issue.
Applies to:
wget		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29208		 Title:
oval:org.mitre.oval:def:29208: SUSE-SU-2015:1077-1 -- Security update for openldap2		 Type:
Software		 Bulletins:
MITRE:29208 		Severity:
Low
Description:
openldap2 was updated to fix two security issues and one non-security bug. The following vulnerabilities were fixed: * A remote attacker could cause a denial of service through a NULL pointer dereference and crash via an empty attribute list in a deref control in a search request. (bnc#916897 CVE-2015-1545) * A remote attacker could cause a denial of service (crash) via a crafted search query with a matched values control. (bnc#916914 CVE-2015-1546) The following non-security issue was fixed: * Prevent connection-0 (internal connection) from showing up in the monitor backend (bnc#905959)
Applies to:
openldap2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29367		 Title:
oval:org.mitre.oval:def:29367: RHSA-2009:0261 -- vnc security update		 Type:
Software		 Bulletins:
MITRE:29367 		Severity:
Low
Description:
Updated vnc packages to correct a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Applies to:
vnc		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28987		 Title:
oval:org.mitre.oval:def:28987: RHSA-2009:0020 -- bind security update		 Type:
Software		 Bulletins:
MITRE:28987 		Severity:
Low
Description:
Updated Bind packages to correct a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. A flaw was discovered in the way BIND checked the return value of the OpenSSL DSA_do_verify function. On systems using DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, allowing spoofing attacks. (CVE-2009-0025)
Applies to:
bind		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29197		 Title:
oval:org.mitre.oval:def:29197: RHSA-2008:0971 -- net-snmp security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29197 		Severity:
Low
Description:
Updated net-snmp packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Simple Network Management Protocol (SNMP) is a protocol used for network management. A denial-of-service flaw was found in the way Net-SNMP processes SNMP GETBULK requests. A remote attacker who issued a specially-crafted request could cause the snmpd server to crash. (CVE-2008-4309)
Applies to:
net-snmp		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29267		 Title:
oval:org.mitre.oval:def:29267: RHSA-2009:0436 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29267 		Severity:
Low
Description:
Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-1302, CVE-2009-1303, CVE-2009-1304, CVE-2009-1305)
Applies to:
firefox
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29233		 Title:
oval:org.mitre.oval:def:29233: SUSE-SU-2015:0108-1 -- Security update for evolution-data-server		 Type:
Miscellaneous		 Bulletins:
MITRE:29233 		Severity:
Low
Description:
evolution-data-server was updated to disable support for SSLv3. This security issues was fixed: - SSLv3 POODLE attack (CVE-2014-3566)
Applies to:
evolution-data-server		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29202		 Title:
oval:org.mitre.oval:def:29202: SUSE-SU-2015:0515-1 -- Security update for gnome-settings-daemon		 Type:
Miscellaneous		 Bulletins:
MITRE:29202 		Severity:
Low
Description:
gnome-settings-daemon was updated to fix a bug and a security issue: Security issue fixed: - CVE-2014-7300: The lockscreen can be bypassed with the Print Screen button. Bug fixed: - Do not hide the cursor while there was no mutter running (bsc#905158).
Applies to:
gnome-settings-daemon		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29308		 Title:
oval:org.mitre.oval:def:29308: RHSA-2008:1001 -- tog-pegasus security update		 Type:
Software		 Bulletins:
MITRE:29308 		Severity:
Low
Description:
Updated tog-pegasus packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The tog-pegasus packages provide OpenPegasus Web-Based Enterprise Management (WBEM) services. WBEM is a platform and resource independent Distributed Management Task Force (DMTF) standard that defines a common information model and communication protocol for monitoring and controlling resources.
Applies to:
tog-pegasus		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29262		 Title:
oval:org.mitre.oval:def:29262: RHSA-2009:0361 -- NetworkManager security update		 Type:
Software		 Bulletins:
MITRE:29262 		Severity:
Low
Description:
Updated NetworkManager packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. NetworkManager is a network link manager that attempts to keep a wired or wireless network connection active at all times. An information disclosure flaw was found in NetworkManager's D-Bus interface. A local attacker could leverage this flaw to discover sensitive information, such as network connection passwords and pre-shared keys. (CVE-2009-0365)
Applies to:
NetworkManager		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28916		 Title:
oval:org.mitre.oval:def:28916: RHSA-2009:1504 -- poppler security and bug fix update		 Type:
Miscellaneous		 Bulletins:
MITRE:28916 		Severity:
Low
Description:
Updated poppler packages that fix multiple security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.
Applies to:
poppler		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28897		 Title:
oval:org.mitre.oval:def:28897: RHSA-2009:1502 -- kdegraphics security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28897 		Severity:
Low
Description:
Updated kdegraphics packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kdegraphics packages contain applications for the K Desktop Environment, including KPDF, a viewer for Portable Document Format (PDF) files.
Applies to:
kdegraphics		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28965		 Title:
oval:org.mitre.oval:def:28965: RHSA-2009:1122 -- icu security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28965 		Severity:
Low
Description:
Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The International Components for Unicode (ICU) library provides robust and full-featured Unicode services. A flaw was found in the way ICU processed certain, invalid byte sequences during Unicode conversion. If an application used ICU to decode malformed, multibyte character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2009-0153) All users of icu should upgrade to these updated packages, which contain backported patches to resolve this issue.
Applies to:
icu		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29196		 Title:
oval:org.mitre.oval:def:29196: RHSA-2009:0333 -- libpng security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29196 		Severity:
Low
Description:
Updated libpng and libpng10 packages that fix a couple of security issues are now available for Red Hat Enterprise Linux 2.1, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The libpng packages contain a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files. A flaw was discovered in libpng that could result in libpng trying to freerandom memory if certain, unlikely error conditions occurred. If a carefully-crafted PNG file was loaded by an application linked against libpng, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2009-0040)
Applies to:
libpng
libpng10		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28930		 Title:
oval:org.mitre.oval:def:28930: RHSA-2008:0892 -- xen security and bug fix update		 Type:
Software		 Bulletins:
MITRE:28930 		Severity:
Low
Description:
Updated xen packages that resolve a couple of security issues and fix a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization.
Applies to:
xen		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29253		 Title:
oval:org.mitre.oval:def:29253: RHSA-2009:0012 -- netpbm security update		 Type:
Software		 Bulletins:
MITRE:29253 		Severity:
Low
Description:
Updated netpbm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The netpbm package contains a library of functions for editing and converting between various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps), and others.
Applies to:
netpbm		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29347		 Title:
oval:org.mitre.oval:def:29347: RHSA-2009:1625 -- expat security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29347 		Severity:
Low
Description:
Updated expat packages that fix two security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Expat is a C library written by James Clark for parsing XML documents. Two buffer over-read flaws were found in the way Expat handled malformed UTF-8 sequences when processing XML files. A specially-crafted XML file could cause applications using Expat to crash while parsing the file. (CVE-2009-3560, CVE-2009-3720)
Applies to:
expat		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29294		 Title:
oval:org.mitre.oval:def:29294: RHSA-2009:1176 -- python security update		 Type:
Software		 Bulletins:
MITRE:29294 		Severity:
Low
Description:
Updated python packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Python is an interpreted, interactive, object-oriented programming language.
Applies to:
python		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29008		 Title:
oval:org.mitre.oval:def:29008: RHSA-2008:0879 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29008 		Severity:
Low
Description:
All firefox users should upgrade to this updated package, which contains backported patches that correct these issues.
Applies to:
devhelp
firefox
nss
xulrunner
yelp		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29185		 Title:
oval:org.mitre.oval:def:29185: RHSA-2008:0937 -- cups security update		 Type:
Services		 Bulletins:
MITRE:29185 		Severity:
Low
Description:
Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX Printing System (CUPS) provides a portable printing layer for UNIX(R) operating systems.
Applies to:
cups		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29334		 Title:
oval:org.mitre.oval:def:29334: RHSA-2009:1430 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29334 		Severity:
Low
Description:
Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. nspr provides the Netscape Portable Runtime (NSPR).
Applies to:
firefox
nspr
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29213		 Title:
oval:org.mitre.oval:def:29213: RHSA-2009:0057 -- squirrelmail security update		 Type:
Web		 Bulletins:
MITRE:29213 		Severity:
Low
Description:
An updated squirrelmail package that fixes a security issue is now available for Red Hat Enterprise Linux 3, 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. SquirrelMail is an easy-to-configure, standards-based, webmail package written in PHP. It includes built-in PHP support for the IMAP and SMTP protocols, and pure HTML 4.0 page-rendering (with no JavaScript required) for maximum browser-compatibility, strong MIME support, address books, and folder manipulation.
Applies to:
squirrelmail		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28592		 Title:
oval:org.mitre.oval:def:28592: RHSA-2009:0429 -- cups security update		 Type:
Services		 Bulletins:
MITRE:28592 		Severity:
Low
Description:
Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team.
Applies to:
cups		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29266		 Title:
oval:org.mitre.oval:def:29266: RHSA-2009:1648 -- ntp security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29266 		Severity:
Low
Description:
An updated ntp package that fixes a security issue is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Applies to:
ntp		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29234		 Title:
oval:org.mitre.oval:def:29234: RHSA-2008:0575 -- rdesktop security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29234 		Severity:
Low
Description:
An updated rdesktop package that fixes a security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. rdesktop is an open source client for Microsoft Windows NT Terminal Server and Microsoft Windows 2000 and 2003 Terminal Services, capable of natively using the Remote Desktop Protocol (RDP) to present the user's NT desktop. No additional server extensions are required. An integer underflow and integer signedness issue were discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801, CVE-2008-1803) Users of rdesktop should upgrade to these updated packages, which contain a backported patches to resolve these issues.
Applies to:
rdesktop		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29358		 Title:
oval:org.mitre.oval:def:29358: RHSA-2009:1307 -- ecryptfs-utils security, bug fix, and enhancement update		 Type:
Software		 Bulletins:
MITRE:29358 		Severity:
Low
Description:
Updated ecryptfs-utils packages that fix a security issue, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. eCryptfs is a stacked, cryptographic file system. It is transparent to the underlying file system and provides per-file granularity.
Applies to:
ecryptfs-utils		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28964		 Title:
oval:org.mitre.oval:def:28964: RHSA-2008:0965 -- lynx security update		 Type:
Software		 Bulletins:
MITRE:28964 		Severity:
Low
Description:
An updated lynx package that corrects two security issues is now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Lynx is a text-based Web browser.
Applies to:
lynx		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29331		 Title:
oval:org.mitre.oval:def:29331: RHSA-2009:1451 -- freeradius security update		 Type:
Software		 Bulletins:
MITRE:29331 		Severity:
Low
Description:
Updated freeradius packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. FreeRADIUS is a high-performance and highly configurable free Remote Authentication Dial In User Service (RADIUS) server, designed to allow centralized authentication and authorization for a network.
Applies to:
freeradius		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29317		 Title:
oval:org.mitre.oval:def:29317: RHSA-2009:1579 -- httpd security update		 Type:
Web		 Bulletins:
MITRE:29317 		Severity:
Low
Description:
Updated httpd packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache HTTP Server is a popular Web server. A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols handle session renegotiation. A man-in-the-middle attacker could use this flaw to prefix arbitrary plain text to a client's session (for example, an HTTPS connection to a website). This could force the server to process an attacker's request as if authenticated using the victim's credentials. This update partially mitigates this flaw for SSL sessions to HTTP servers using mod_ssl by rejecting client-requested renegotiation. (CVE-2009-3555)
Applies to:
httpd		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29371		 Title:
oval:org.mitre.oval:def:29371: RHSA-2009:0344 -- libsoup security update		 Type:
Software		 Bulletins:
MITRE:29371 		Severity:
Low
Description:
Updated libsoup and evolution28-libsoup packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. libsoup is an HTTP client/library implementation for GNOME written in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.
Applies to:
evolution28-libsoup
libsoup		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29387		 Title:
oval:org.mitre.oval:def:29387: RHSA-2009:0411 -- device-mapper-multipath security update		 Type:
Software		 Bulletins:
MITRE:29387 		Severity:
Low
Description:
Updated device-mapper-multipath packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The device-mapper multipath packages provide tools to manage multipath devices by issuing instructions to the device-mapper multipath kernel module, and by managing the creation and removal of partitions for device-mapper devices.
Applies to:
device-mapper-multipath		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29236		 Title:
oval:org.mitre.oval:def:29236: RHSA-2009:0339 -- lcms security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29236 		Severity:
Low
Description:
Updated lcms packages that resolve several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Little Color Management System (LittleCMS) is a small-footprint, speed-optimized open source color management engine. Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in LittleCMS. An attacker could use these flaws to create a specially-crafted image file which could cause an application using LittleCMS to crash, or, possibly, execute arbitrary code when opened by a victim. (CVE-2009-0723, CVE-2009-0733)
Applies to:
lcms		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29055		 Title:
oval:org.mitre.oval:def:29055: SUSE-SU-2015:0953-2 -- Security update for perl-YAML-LibYAML		 Type:
Miscellaneous		 Bulletins:
MITRE:29055 		Severity:
Low
Description:
erl-YAML-LibYAML was updated to fix three security issues. These security issues were fixed: - CVE-2013-6393: The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performed an incorrect cast, which allowed remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggered a heap-based buffer overflow (bnc#860617, bnc#911782).
Applies to:
perl-YAML-LibYAML		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29022		 Title:
oval:org.mitre.oval:def:29022: RHSA-2009:1116 -- cyrus-imapd security update		 Type:
Software		 Bulletins:
MITRE:29022 		Severity:
Low
Description:
Updated cyrus-imapd packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support.
Applies to:
cyrus-imapd		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29162		 Title:
oval:org.mitre.oval:def:29162: RHSA-2008:0835 -- openoffice.org security update		 Type:
Software		 Bulletins:
MITRE:29162 		Severity:
Low
Description:
Updated openoffice.org packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenOffice.org is an office productivity suite that includes desktop applications, such as a word processor, spreadsheet, presentation manager, formula editor, and a drawing program. A numeric truncation error was found in the OpenOffice.org memory allocator. If a carefully crafted file was opened by a victim, an attacker could use this flaw to crash OpenOffice.org or, possibly, execute arbitrary code. (CVE-2008-3282) All users of openoffice.org are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
Applies to:
openoffice.org		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29134		 Title:
oval:org.mitre.oval:def:29134: RHSA-2009:1209 -- curl security update		 Type:
Web		 Bulletins:
MITRE:29134 		Severity:
Low
Description:
Updated curl packages that fix security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity.
Applies to:
curl		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28265		 Title:
oval:org.mitre.oval:def:28265: SUSE-SU-2015:1143-1 -- Security update for openssl		 Type:
Web		 Bulletins:
MITRE:28265 		Severity:
Low
Description:
This update of openssl fixes the following security issues: - CVE-2015-4000 (bsc#931698) * The Logjam Attack / weakdh.org * reject connections with DH parameters shorter than 1024 bits * generates 2048-bit DH parameters by default - CVE-2015-1788 (bsc#934487) * Malformed ECParameters causes infinite loop - CVE-2015-1789 (bsc#934489)
Applies to:
openssl		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29281		 Title:
oval:org.mitre.oval:def:29281: RHSA-2009:1232 -- gnutls security update		 Type:
Software		 Bulletins:
MITRE:29281 		Severity:
Low
Description:
Updated gnutls packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).
Applies to:
gnutls		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28973		 Title:
oval:org.mitre.oval:def:28973: RHSA-2008:0847 -- libtiff security and bug fix update		 Type:
Miscellaneous		 Bulletins:
MITRE:28973 		Severity:
Low
Description:
Updated libtiff packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)
Applies to:
libtiff		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29254		 Title:
oval:org.mitre.oval:def:29254: RHSA-2009:1102 -- cscope security update		 Type:
Software		 Bulletins:
MITRE:29254 		Severity:
Low
Description:
An updated cscope package that fixes multiple security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. cscope is a mature, ncurses-based, C source-code tree browsing tool. Multiple buffer overflow flaws were found in cscope. An attacker could create a specially crafted source code file that could cause cscope to crash or, possibly, execute arbitrary code when browsed with cscope. (CVE-2004-2541, CVE-2009-0148) All users of cscope are advised to upgrade to this updated package, which contains backported patches to fix these issues. All running instances of cscope must be restarted for this update to take effect.
Applies to:
cscope		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28983		 Title:
oval:org.mitre.oval:def:28983: RHSA-2008:0612 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:28983 		Severity:
Low
Description:
Updated kernel packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29222		 Title:
oval:org.mitre.oval:def:29222: RHSA-2009:1218 -- pidgin security update		 Type:
Software		 Bulletins:
MITRE:29222 		Severity:
Low
Description:
Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. Federico Muttis of Core Security Technologies discovered a flaw in Pidgin's MSN protocol handler. If a user received a malicious MSN message, it was possible to execute arbitrary code with the permissions of the user running Pidgin. (CVE-2009-2694)
Applies to:
pidgin		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29215		 Title:
oval:org.mitre.oval:def:29215: RHSA-2008:1036 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29215 		Severity:
Low
Description:
Note: after the errata packages are installed, Firefox must be restarted for the update to take effect. All firefox users should upgrade to these updated packages, which contain backported patches that correct these issues.
Applies to:
firefox
nspr
nss
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29277		 Title:
oval:org.mitre.oval:def:29277: RHSA-2009:0377 -- java-1.6.0-openjdk security update		 Type:
Software		 Bulletins:
MITRE:29277 		Severity:
Low
Description:
Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language.
Applies to:
java-1.6.0-openjdk		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28896		 Title:
oval:org.mitre.oval:def:28896: RHSA-2009:0271 -- gstreamer-plugins-good security update		 Type:
Software		 Bulletins:
MITRE:28896 		Severity:
Low
Description:
Updated gstreamer-plugins-good packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. GStreamer is a streaming media framework, based on graphs of filters which operate on media data. GStreamer Good Plug-ins is a collection of well-supported, GStreamer plug-ins of good quality released under the LGPL license.
Applies to:
gstreamer-plugins-good		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29381		 Title:
oval:org.mitre.oval:def:29381: RHSA-2009:0315 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29381 		Severity:
Low
Description:
An updated firefox package that fixes various security issues is now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. Mozilla Firefox is an open source Web browser. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2009-0040, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774, CVE-2009-0775)
Applies to:
firefox
xulrunner		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29313		 Title:
oval:org.mitre.oval:def:29313: RHSA-2009:0205 -- dovecot security and bug fix update		 Type:
Mail		 Bulletins:
MITRE:29313 		Severity:
Low
Description:
An updated dovecot package that corrects two security flaws and various bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. Dovecot is an IMAP server for Linux and UNIX-like systems, primarily written with security in mind.
Applies to:
dovecot		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29350		 Title:
oval:org.mitre.oval:def:29350: RHSA-2009:1287 -- openssh security, bug fix, and enhancement update		 Type:
Services		 Bulletins:
MITRE:29350 		Severity:
Low
Description:
Updated openssh packages that fix a security issue, a bug, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team.
Applies to:
openssh		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29269		 Title:
oval:org.mitre.oval:def:29269: RHSA-2009:1548 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29269 		Severity:
Low
Description:
Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28703		 Title:
oval:org.mitre.oval:def:28703: RHSA-2009:0427 -- udev security update		 Type:
Services		 Bulletins:
MITRE:28703 		Severity:
Low
Description:
Updated udev packages that fix one security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. udev provides a user-space API and implements a dynamic device directory, providing only the devices present on the system. udev replaces devfs in order to provide greater hot plug functionality. Netlink is a datagram oriented service, used to transfer information between kernel modules and user-space processes. It was discovered that udev did not properly check the origin of Netlink messages. A local attacker could use this flaw to gain root privileges via a crafted Netlink message sent to udev, causing it to create a world-writable block device file for an existing system block device (for example, the root file system). (CVE-2009-1185)
Applies to:
udev		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29068		 Title:
oval:org.mitre.oval:def:29068: RHSA-2009:0336 -- glib2 security update		 Type:
Software		 Bulletins:
MITRE:29068 		Severity:
Low
Description:
Updated glib2 packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. GLib is the low-level core library that forms the basis for projects such as GTK+ and GNOME. It provides data structure handling for C, portability wrappers, and interfaces for such runtime functionality as an event loop, threads, dynamic loading, and an object system.
Applies to:
glib2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29044		 Title:
oval:org.mitre.oval:def:29044: RHSA-2008:0849 -- ipsec-tools security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29044 		Severity:
Low
Description:
An updated ipsec-tools package that fixes two security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team.
Applies to:
ipsec-tools		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28925		 Title:
oval:org.mitre.oval:def:28925: SUSE-SU-2015:0803-1 -- Security update for gdm		 Type:
Software		 Bulletins:
MITRE:28925 		Severity:
Low
Description:
The GNOME Display Manager was updated to fix several bugs: Security issue fixed: - Removed gdm-fingerprint and gdm-smartcard pamfiles that allowed unlocking the screen without password or fingerprint if fingerprint reader support was enabled. (boo#900836). Bugs fixed: - Fix support for DISPLAYMANAGER_STARTS_XSERVER from /etc/sysconfig/displaymanager (bsc#919723). - Ensure ShowLocalGreeter configuration key is properly handled (bgo#743440).
Applies to:
gdm		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29354		 Title:
oval:org.mitre.oval:def:29354: RHSA-2008:1017 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29354 		Severity:
Low
Description:
Updated kernel packages that resolve several security issues and fix various bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29136		 Title:
oval:org.mitre.oval:def:29136: RHSA-2015:0809 -- java-1.8.0-openjdk security update		 Type:
Software		 Bulletins:
MITRE:29136 		Severity:
Low
Description:
The java-1.8.0-openjdk packages provide the OpenJDK 8 Java Runtime Environment and the OpenJDK 8 Java Software Development Kit. An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)
Applies to:
java-1.8.0-openjdk		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29012		 Title:
oval:org.mitre.oval:def:29012: RHSA-2008:0890 -- wireshark security update		 Type:
Software		 Bulletins:
MITRE:29012 		Severity:
Low
Description:
Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-3146)
Applies to:
wireshark		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29320		 Title:
oval:org.mitre.oval:def:29320: RHSA-2009:1428 -- xmlsec1 security update		 Type:
Software		 Bulletins:
MITRE:29320 		Severity:
Low
Description:
Updated xmlsec1 packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The XML Security Library is a C library based on libxml2 and OpenSSL. It implements the XML Signature Syntax and Processing and XML Encryption Syntax and Processing standards. HMAC is used for message authentication using cryptographic hash functions. The HMAC algorithm allows the hash output to be truncated (as documented in RFC 2104).
Applies to:
xmlsec1		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29047		 Title:
oval:org.mitre.oval:def:29047: RHSA-2009:1615 -- xerces-j2 security update		 Type:
Software		 Bulletins:
MITRE:29047 		Severity:
Low
Description:
Updated xerces-j2 packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The xerces-j2 packages provide the Apache Xerces2 Java Parser, a high-performance XML parser. A Document Type Definition (DTD) defines the legal syntax (and also which elements can be used) for certain types of files, such as XML files.
Applies to:
xerces-j2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29263		 Title:
oval:org.mitre.oval:def:29263: RHSA-2009:1642 -- acpid security update		 Type:
Services		 Bulletins:
MITRE:29263 		Severity:
Low
Description:
An updated acpid package that fixes one security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.
Applies to:
acpid		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29095		 Title:
oval:org.mitre.oval:def:29095: SUSE-SU-2015:1013-1 -- Security update for wpa_supplicant		 Type:
Software		 Bulletins:
MITRE:29095 		Severity:
Low
Description:
wpa_supplicant was updated to fix three security issues: - CVE-2015-0210: wpa_supplicant: broken certificate subject check this adds the "domain_match" config option from upstream (additional to the already existing domain_suffix_match) - CVE-2014-3686: hostapd command execution - CVE-2015-1863: P2P SSID processing vulnerability
Applies to:
wpa_supplicant		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29137		 Title:
oval:org.mitre.oval:def:29137: RHSA-2008:1029 -- cups security update		 Type:
Services		 Bulletins:
MITRE:29137 		Severity:
Low
Description:
Updated cups packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Applies to:
cups		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29258		 Title:
oval:org.mitre.oval:def:29258: RHSA-2009:1140 -- ruby security update		 Type:
Software		 Bulletins:
MITRE:29258 		Severity:
Low
Description:
Updated ruby packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.
Applies to:
ruby		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28879		 Title:
oval:org.mitre.oval:def:28879: RHSA-2009:1159 -- libtiff security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28879 		Severity:
Low
Description:
Updated libtiff packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.
Applies to:
libtiff		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29100		 Title:
oval:org.mitre.oval:def:29100: RHSA-2009:1139 -- pidgin security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29100 		Severity:
Low
Description:
Updated pidgin packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. The AOL Open System for CommunicAtion in Realtime (OSCAR) protocol is used by the AOL ICQ and AIM instant messaging systems.
Applies to:
pidgin		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29144		 Title:
oval:org.mitre.oval:def:29144: RHSA-2008:0584 -- pidgin security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29144 		Severity:
Low
Description:
Updated Pidgin packages that fix a security issue and address a bug are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Pidgin is a multi-protocol Internet Messaging client.
Applies to:
pidgin		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28792		 Title:
oval:org.mitre.oval:def:28792: SUSE-SU-2015:1014-1 -- Security update for vorbis-tools		 Type:
Miscellaneous		 Bulletins:
MITRE:28792 		Severity:
Low
Description:
Vorbis tools was updated to fix division by zero and integer overflows by crafted WAV files (CVE-2014-9638, CVE-2014-9639, bnc#914439, bnc#914441), that would allow attackers to crash the vorbis tools processes.
Applies to:
vorbis-tools		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29077		 Title:
oval:org.mitre.oval:def:29077: RHSA-2009:1204 -- apr and apr-util security update		 Type:
Web		 Bulletins:
MITRE:29077 		Severity:
Low
Description:
Updated apr and apr-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It aims to provide a free library of C data structures and routines.
Applies to:
apr
apr-util		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28838		 Title:
oval:org.mitre.oval:def:28838: RHSA-2009:0474 -- acpid security update		 Type:
Services		 Bulletins:
MITRE:28838 		Severity:
Low
Description:
An updated acpid package that fixes one security issue is now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. acpid is a daemon that dispatches ACPI (Advanced Configuration and Power Interface) events to user-space programs.
Applies to:
acpid		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29088		 Title:
oval:org.mitre.oval:def:29088: RHSA-2009:0313 -- wireshark security update		 Type:
Software		 Bulletins:
MITRE:29088 		Severity:
Low
Description:
Updated wireshark packages that fix several security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Wireshark is a program for monitoring network traffic. Wireshark was previously known as Ethereal. Multiple buffer overflow flaws were found in Wireshark. If Wireshark read a malformed packet off a network or opened a malformed dump file, it could crash or, possibly, execute arbitrary code as the user running Wireshark. (CVE-2008-4683, CVE-2009-0599)
Applies to:
wireshark		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29359		 Title:
oval:org.mitre.oval:def:29359: RHSA-2009:1238 -- dnsmasq security update		 Type:
DNS		 Bulletins:
MITRE:29359 		Severity:
Low
Description:
An updated dnsmasq package that fixes two security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Dnsmasq is a lightweight and easy to configure DNS forwarder and DHCP server.
Applies to:
dnsmasq		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28712		 Title:
oval:org.mitre.oval:def:28712: RHSA-2009:0004 -- openssl security update		 Type:
Web		 Bulletins:
MITRE:28712 		Severity:
Low
Description:
Updated OpenSSL packages that correct a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength, general purpose, cryptography library. The Google security team discovered a flaw in the way OpenSSL checked the verification of certificates. An attacker in control of a malicious server, or able to effect a man in the middle attack, could present a malformed SSL/TLS signature from a certificate chain to a vulnerable client and bypass validation. (CVE-2008-5077)
Applies to:
openssl
openssl095a
openssl096
openssl096b
openssl097a		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29179		 Title:
oval:org.mitre.oval:def:29179: RHSA-2009:1164 -- tomcat security update		 Type:
Web		 Bulletins:
MITRE:29179 		Severity:
Low
Description:
Updated tomcat packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Applies to:
tomcat5		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29251		 Title:
oval:org.mitre.oval:def:29251: SUSE-SU-2015:0805-1 -- Security update for cups-filters		 Type:
Software		 Bulletins:
MITRE:29251 		Severity:
Low
Description:
cups-filters was updated to fix one security issue. This security issue was fixed: - CVE-2015-2265: Remote command execution in remove_bad_chars() (bnc#921753). This non-security issue was fixed: - LSB compliance of foomatic-rip (bnc#915545).
Applies to:
cups-filters		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29195		 Title:
oval:org.mitre.oval:def:29195: RHSA-2009:0296 -- icu security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29195 		Severity:
Low
Description:
Updated icu packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The International Components for Unicode (ICU) library provides robust and full-featured Unicode services. A flaw was found in the way ICU processed certain, invalid, encoded data. If an application used ICU to decode malformed, multibyte, character data, it may have been possible to bypass certain content protection mechanisms, or display information in a manner misleading to the user. (CVE-2008-1036) All users of icu should upgrade to these updated packages, which contain backported patches to resolve these issues.
Applies to:
icu		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29201		 Title:
oval:org.mitre.oval:def:29201: RHSA-2009:0002 -- thunderbird security update		 Type:
Software		 Bulletins:
MITRE:29201 		Severity:
Low
Description:
Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-5500, CVE-2008-5501, CVE-2008-5502, CVE-2008-5511, CVE-2008-5512, CVE-2008-5513)
Applies to:
thunderbird		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29463		 Title:
oval:org.mitre.oval:def:29463: RHSA-2009:1039 -- ntp security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29463 		Severity:
Low
Description:
An updated ntp package that fixes two security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team.
Applies to:
ntp		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29206		 Title:
oval:org.mitre.oval:def:29206: RHSA-2009:1082 -- cups security update		 Type:
Services		 Bulletins:
MITRE:29206 		Severity:
Low
Description:
Updated cups packages that fix one security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The Common UNIX reg; Printing System (CUPS) provides a portable printing layer for UNIX operating systems. The Internet Printing Protocol (IPP) allows users to print and manage printing-related tasks over a network. A NULL pointer dereference flaw was found in the CUPS IPP routine, used for processing incoming IPP requests for the CUPS scheduler. An attacker could use this flaw to send specially-crafted IPP requests that would crash the cupsd daemon. (CVE-2009-0949)
Applies to:
cups		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29382		 Title:
oval:org.mitre.oval:def:29382: RHSA-2009:1619 -- dstat security update		 Type:
Software		 Bulletins:
MITRE:29382 		Severity:
Low
Description:
An updated dstat package that fixes one security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Dstat is a versatile replacement for the vmstat, iostat, and netstat tools. Dstat can be used for performance tuning tests, benchmarks, and troubleshooting.
Applies to:
dstat		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29046		 Title:
oval:org.mitre.oval:def:29046: RHSA-2009:1536 -- pidgin security update		 Type:
Software		 Bulletins:
MITRE:29046 		Severity:
Low
Description:
Updated pidgin packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Pidgin is an instant messaging program which can log in to multiple accounts on multiple instant messaging networks simultaneously. The AOL Open System for Communication in Realtime (OSCAR) protocol is used by the AOL ICQ and AIM instant messaging systems. An invalid pointer dereference bug was found in the way the Pidgin OSCAR protocol implementation processed lists of contacts. A remote attacker could send a specially-crafted contact list to a user running Pidgin, causing Pidgin to crash. (CVE-2009-3615)
Applies to:
pidgin		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28776		 Title:
oval:org.mitre.oval:def:28776: RHSA-2009:0003 -- xen security and bug fix update		 Type:
Software		 Bulletins:
MITRE:28776 		Severity:
Low
Description:
Updated xen packages that resolve several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The xen packages contain the Xen tools and management daemons needed to manage virtual machines running on Red Hat Enterprise Linux. Xen was found to allow unprivileged DomU domains to overwrite xenstore values which should only be changeable by the privileged Dom0 domain. An attacker controlling a DomU domain could, potentially, use this flaw to kill arbitrary processes in Dom0 or trick a Dom0 user into accessing the text console of a different domain running on the same host. This update makes certain parts of the xenstore tree read-only to the unprivileged DomU domains. (CVE-2008-4405)
Applies to:
xen		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28887		 Title:
oval:org.mitre.oval:def:28887: RHSA-2008:0486 -- nfs-utils security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28887 		Severity:
Low
Description:
An updated nfs-utils package that fixes a security issue is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The nfs-utils package provides a daemon for the kernel NFS server and related tools. A flaw was found in the nfs-utils package build. The nfs-utils package was missing TCP wrappers support, which could result in an administrator believing they had access restrictions enabled when they did not. (CVE-2008-1376) Users of nfs-utils are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.
Applies to:
nfs-utils		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28749		 Title:
oval:org.mitre.oval:def:28749: RHSA-2009:1335 -- openssl security, bug fix, and enhancement update		 Type:
Web		 Bulletins:
MITRE:28749 		Severity:
Low
Description:
Updated openssl packages that fix several security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength general purpose cryptography library. Datagram TLS (DTLS) is a protocol based on TLS that is capable of securing datagram transport (for example, UDP).
Applies to:
openssl		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29030		 Title:
oval:org.mitre.oval:def:29030: RHSA-2008:0884 -- libxml2 security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29030 		Severity:
Low
Description:
Updated libxml2 packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The libxml2 packages provide a library that allows you to manipulate XML files. It includes support to read, modify, and write XML and HTML files. A heap-based buffer overflow flaw was found in the way libxml2 handled long XML entity names. If an application linked against libxml2 processed untrusted malformed XML content, it could cause the application to crash or, possibly, execute arbitrary code. (CVE-2008-3529) All users of libxml2 are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue.
Applies to:
libxml2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29020		 Title:
oval:org.mitre.oval:def:29020: RHSA-2008:0982 -- gnutls security update		 Type:
Software		 Bulletins:
MITRE:29020 		Severity:
Low
Description:
Updated gnutls packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). Martin von Gagern discovered a flaw in the way GnuTLS verified certificate chains provided by a server. A malicious server could use this flaw to spoof its identity by tricking client applications using the GnuTLS library to trust invalid certificates. (CVE-2008-4989) Users of GnuTLS are advised to upgrade to these updated packages, which contain a backported patch that corrects this issue.
Applies to:
gnutls		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29154		 Title:
oval:org.mitre.oval:def:29154: RHSA-2009:1193 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29154 		Severity:
Low
Description:
Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28686		 Title:
oval:org.mitre.oval:def:28686: RHSA-2008:0981 -- ruby security update		 Type:
Software		 Bulletins:
MITRE:28686 		Severity:
Low
Description:
Updated ruby packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. Vincent Danen reported, that Red Hat Security Advisory RHSA-2008:0897 did not properly address a denial of service flaw in the WEBrick (Ruby HTTP server toolkit), known as CVE-2008-3656. This flaw allowed a remote attacker to send a specially-crafted HTTP request to a WEBrick server that would cause the server to use excessive CPU time. This update properly addresses this flaw. (CVE-2008-4310) All Ruby users should upgrade to these updated packages, which contain a correct patch that resolves this issue.
Applies to:
ruby		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28958		 Title:
oval:org.mitre.oval:def:28958: RHSA-2009:1206 -- libxml and libxml2 security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28958 		Severity:
Low
Description:
Updated libxml and libxml2 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. libxml is a library for parsing and manipulating XML files. A Document Type Definition (DTD) defines the legal syntax (and also which elements can be used) for certain types of files, such as XML files.
Applies to:
libxml
libxml2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28934		 Title:
oval:org.mitre.oval:def:28934: RHSA-2009:0402 -- openswan security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28934 		Severity:
Low
Description:
Updated openswan packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Openswan is a free implementation of Internet Protocol Security (IPsec) and Internet Key Exchange (IKE). IPsec uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the untrusted network is encrypted by the IPsec gateway machine, and decrypted by the gateway at the other end of the tunnel. The resulting tunnel is a virtual private network (VPN).
Applies to:
openswan		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29339		 Title:
oval:org.mitre.oval:def:29339: RHSA-2009:1066 -- squirrelmail security update		 Type:
Web		 Bulletins:
MITRE:29339 		Severity:
Low
Description:
An updated squirrelmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. SquirrelMail is a standards-based webmail package written in PHP.
Applies to:
squirrelmail		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28976		 Title:
oval:org.mitre.oval:def:28976: RHSA-2008:1016 -- enscript security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28976 		Severity:
Low
Description:
An updated enscript packages that fixes several security issues is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. GNU enscript converts ASCII files to PostScript(R) language files and spools the generated output to a specified printer or saves it to a file. Enscript can be extended to handle different output media and includes options for customizing printouts. Two buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the special escapes option (-e or --escapes) enabled. (CVE-2008-3863, CVE-2008-4306)
Applies to:
enscript		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28741		 Title:
oval:org.mitre.oval:def:28741: RHSA-2009:0354 -- evolution-data-server security update		 Type:
Software		 Bulletins:
MITRE:28741 		Severity:
Low
Description:
Updated evolution-data-server and evolution28-evolution-data-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Evolution Data Server provides a unified back-end for applications which interact with contacts, task, and calendar information. Evolution Data Server was originally developed as a back-end for Evolution, but is now used by multiple other applications.
Applies to:
evolution-data-server
evolution28-evolution-data-server		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29066		 Title:
oval:org.mitre.oval:def:29066: RHSA-2008:0597 -- firefox security update		 Type:
Software		 Bulletins:
MITRE:29066 		Severity:
Low
Description:
Updated firefox packages that fix various security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The nspluginwrapper package has been added to this advisory to satisfy a missing package dependency issue. Mozilla Firefox is an open source Web browser. An integer overflow flaw was found in the way Firefox displayed certain web content. A malicious web site could cause Firefox to crash, or execute arbitrary code with the permissions of the user running Firefox. (CVE-2008-2785) A flaw was found in the way Firefox handled certain command line URLs. If another application passed Firefox a malformed URL, it could result in Firefox executing local malicious content with chrome privileges. (CVE-2008-2933) All firefox users should upgrade to these updated packages, which contain Firefox 3.0.1 that corrects these issues.
Applies to:
devhelp
firefox
nspluginwrapper
xulrunner
yelp		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28980		 Title:
oval:org.mitre.oval:def:28980: RHSA-2008:0561 -- ruby security update		 Type:
Software		 Bulletins:
MITRE:28980 		Severity:
Low
Description:
Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for quick and easy object-oriented programming. Multiple integer overflows leading to a heap overflow were discovered in the array- and string-handling code used by Ruby. An attacker could use these flaws to crash a Ruby application or, possibly, execute arbitrary code with the privileges of the Ruby application using untrusted inputs in array or string operations. (CVE-2008-2376, CVE-2008-2662, CVE-2008-2663, CVE-2008-2725, CVE-2008-2726)
Applies to:
ruby		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28946		 Title:
oval:org.mitre.oval:def:28946: RHSA-2009:0476 -- pango security update		 Type:
Software		 Bulletins:
MITRE:28946 		Severity:
Low
Description:
Updated pango and evolution28-pango packages that fix an integer overflow flaw are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Pango is a library used for the layout and rendering of internationalized text.
Applies to:
evolution28-pango
pango		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28869		 Title:
oval:org.mitre.oval:def:28869: RHSA-2009:0480 -- poppler security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28869 		Severity:
Low
Description:
Updated poppler packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince. Multiple integer overflow flaws were found in poppler. An attacker could create a malicious PDF file that would cause applications that use poppler (such as Evince) to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0147, CVE-2009-1179, CVE-2009-1187, CVE-2009-1188)
Applies to:
poppler		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28842		 Title:
oval:org.mitre.oval:def:28842: RHSA-2008:0815 -- yum-rhn-plugin security update		 Type:
Software		 Bulletins:
MITRE:28842 		Severity:
Low
Description:
Updated yum-rhn-plugin packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The yum-rhn-plugin provides support for yum to securely access a Red Hat Network (RHN) server for software updates.
Applies to:
yum-rhn-plugin		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28941		 Title:
oval:org.mitre.oval:def:28941: RHSA-2009:1484 -- postgresql security update		 Type:
Services		 Bulletins:
MITRE:28941 		Severity:
Low
Description:
Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PostgreSQL is an advanced object-relational database management system (DBMS). It was discovered that the upstream patch for CVE-2007-6600 included in the Red Hat Security Advisory RHSA-2008:0038 did not include protection against misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An authenticated user could use this flaw to install malicious code that would later execute with superuser privileges. (CVE-2009-3230)
Applies to:
postgresql		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29306		 Title:
oval:org.mitre.oval:def:29306: RHSA-2008:0988 -- libxml2 security update		 Type:
Miscellaneous		 Bulletins:
MITRE:29306 		Severity:
Low
Description:
Updated libxml2 packages that fix security issues are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. libxml2 is a library for parsing and manipulating XML files. It includes support for reading, modifying, and writing XML and HTML files. An integer overflow flaw causing a heap-based buffer overflow was found in the libxml2 XML parser. If an application linked against libxml2 processed untrusted, malformed XML content, it could cause the application to crash or, possibly, execute arbitrary code. (CVE-2008-4226) A denial of service flaw was discovered in the libxml2 XML parser. If an application linked against libxml2 processed untrusted, malformed XML content, it could cause the application to enter an infinite loop. (CVE-2008-4225) Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting these issues. Users of libxml2 are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
Applies to:
libxml2		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28888		 Title:
oval:org.mitre.oval:def:28888: RHSA-2009:1289 -- mysql security and bug fix update		 Type:
Software		 Bulletins:
MITRE:28888 		Severity:
Low
Description:
Updated mysql packages that fix various security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
Applies to:
mysql		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28716		 Title:
oval:org.mitre.oval:def:28716: RHSA-2008:0616 -- thunderbird security update		 Type:
Software		 Bulletins:
MITRE:28716 		Severity:
Low
Description:
Updated thunderbird packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Multiple flaws were found in the processing of malformed JavaScript content. An HTML mail containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)
Applies to:
thunderbird		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29232		 Title:
oval:org.mitre.oval:def:29232: RHSA-2008:0580 -- vim security update		 Type:
Software		 Bulletins:
MITRE:29232 		Severity:
Low
Description:
Updated vim packages that fix security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Vim (Visual editor IMproved) is an updated and improved version of the vi editor.
Applies to:
vim		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28862		 Title:
oval:org.mitre.oval:def:28862: RHSA-2009:1670 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:28862 		Severity:
Low
Description:
Updated kernel packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29311		 Title:
oval:org.mitre.oval:def:29311: RHSA-2009:1123 -- gstreamer-plugins-good security update		 Type:
Software		 Bulletins:
MITRE:29311 		Severity:
Low
Description:
Updated gstreamer-plugins-good packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. GStreamer is a streaming media framework, based on graphs of filters which operate on media data. GStreamer Good Plug-ins is a collection of well-supported, good quality GStreamer plug-ins. Multiple integer overflow flaws, that could lead to a buffer overflow, were found in the GStreamer Good Plug-ins PNG decoding handler. An attacker could create a specially-crafted PNG file that would cause an application using the GStreamer Good Plug-ins library to crash or, potentially, execute arbitrary code as the user running the application when parsed. (CVE-2009-1932)
Applies to:
gstreamer-plugins-good		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28599		 Title:
oval:org.mitre.oval:def:28599: RHSA-2015:0806 -- java-1.7.0-openjdk security update		 Type:
Software		 Bulletins:
MITRE:28599 		Severity:
Low
Description:
The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment and the OpenJDK 7 Java Software Development Kit. An off-by-one flaw, leading to a buffer overflow, was found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could possibly cause the Java Virtual Machine to execute arbitrary code, allowing an untrusted Java application or applet to bypass Java sandbox restrictions. (CVE-2015-0469)
Applies to:
java-1.7.0-openjdk		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28929		 Title:
oval:org.mitre.oval:def:28929: RHSA-2009:1278 -- lftp security and bug fix update		 Type:
Software		 Bulletins:
MITRE:28929 		Severity:
Low
Description:
An updated lftp package that fixes one security issue and various bugs is now available for Red Hat Enterprise Linux 5. This update has been rated as having low security impact by the Red Hat Security Response Team. LFTP is a sophisticated file transfer program for the FTP and HTTP protocols. Like bash, it has job control and uses the readline library for input. It has bookmarks, built-in mirroring, and can transfer several files in parallel. It is designed with reliability in mind.
Applies to:
lftp		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28966		 Title:
oval:org.mitre.oval:def:28966: RHSA-2009:0264 -- kernel security update		 Type:
Software		 Bulletins:
MITRE:28966 		Severity:
Low
Description:
Updated kernel packages that resolve several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29340		 Title:
oval:org.mitre.oval:def:29340: RHSA-2009:1472 -- xen security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29340 		Severity:
Low
Description:
Updated xen packages that fix a security issue and multiple bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Xen is an open source virtualization framework. Virtualization allows users to run guest operating systems in virtual machines on top of a host operating system.
Applies to:
xen		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28923		 Title:
oval:org.mitre.oval:def:28923: RHSA-2009:0046 -- ntp security update		 Type:
Miscellaneous		 Bulletins:
MITRE:28923 		Severity:
Low
Description:
Updated ntp packages to correct a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Network Time Protocol (NTP) is used to synchronize a computer's time with a referenced time source. A flaw was discovered in the way the ntpd daemon checked the return value of the OpenSSL EVP_VerifyFinal function. On systems using NTPv4 authentication, this could lead to an incorrect verification of cryptographic signatures, allowing time-spoofing attacks. (CVE-2009-0021)
Applies to:
ntp		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29372		 Title:
oval:org.mitre.oval:def:29372: RHSA-2009:0010 -- squirrelmail security update		 Type:
Web		 Bulletins:
MITRE:29372 		Severity:
Low
Description:
An updated squirrelmail package that resolves various security issues is now available for Red Hat Enterprise Linux 3, 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. SquirrelMail is an easy-to-configure, standards-based, webmail package written in PHP. It includes built-in PHP support for the IMAP and SMTP protocols, and pure HTML 4.0 page-rendering (with no JavaScript required) for maximum browser-compatibility, strong MIME support, address books, and folder manipulation.
Applies to:
squirrelmail		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28758		 Title:
oval:org.mitre.oval:def:28758: RHSA-2009:1459 -- cyrus-imapd security update		 Type:
Software		 Bulletins:
MITRE:28758 		Severity:
Low
Description:
Updated cyrus-imapd packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and Sieve support.
Applies to:
cyrus-imapd		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29116		 Title:
oval:org.mitre.oval:def:29116: RHSA-2008:0976 -- thunderbird security update		 Type:
Software		 Bulletins:
MITRE:29116 		Severity:
Low
Description:
Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-5014, CVE-2008-5016, CVE-2008-5017, CVE-2008-5018, CVE-2008-5021)
Applies to:
thunderbird		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29252		 Title:
oval:org.mitre.oval:def:29252: SUSE-SU-2015:1150-1 -- Security update for compat-openssl098		 Type:
Miscellaneous		 Bulletins:
MITRE:29252 		Severity:
Low
Description:
This update fixes the following security issues: - CVE-2015-4000 (boo#931698) * The Logjam Attack / weakdh.org * reject connections with DH parameters shorter than 1024 bits * generates 2048-bit DH parameters by default - CVE-2015-1788 (boo#934487) * Malformed ECParameters causes infinite loop - CVE-2015-1789 (boo#934489) * Exploitable out-of-bounds read in X509_cmp_time
Applies to:
compat-openssl098		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29150		 Title:
oval:org.mitre.oval:def:29150: RHSA-2008:0544 -- php security update		 Type:
Web		 Bulletins:
MITRE:29150 		Severity:
Low
Description:
Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. It was discovered that the PHP escapeshellcmdfunction did not properly escape multi-byte characters which are not valid in the locale used by the script. This could allow an attacker to bypass quoting restrictions imposed by escapeshellcmdand execute arbitrary commands if the PHP script was using certain locales. Scripts using the default UTF-8 locale are not affected by this issue. (CVE-2008-2051)
Applies to:
php		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:29446		 Title:
oval:org.mitre.oval:def:29446: RHSA-2009:0473 -- kernel security and bug fix update		 Type:
Software		 Bulletins:
MITRE:29446 		Severity:
Low
Description:
Updated kernel packages that fix several security issues and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The kernel packages contain the Linux kernel, the core of any Linux operating system.
Applies to:
kernel		 Created:
2015-06-29		 Updated:
2015-08-17
ID:
MITRE:28971		 Title:
oval:org.mitre.oval:def:28971: Vulnerability in Active Directory Federation Services could allow elevation of privilege		 Type:
Software		 Bulletins:
MITRE:28971
CVE-2015-1757 		Severity:
Low
Description:
Cross-site scripting (XSS) vulnerability in adfs/ls in Active Directory Federation Services (AD FS) in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 allows remote attackers to inject arbitrary web script or HTML via the wct parameter, aka "ADFS XSS Elevation of Privilege Vulnerability."
Applies to:
Microsoft Active Directory Federation Services		 Created:
2015-06-24		 Updated:
2015-08-03
ID:
MITRE:28910		 Title:
oval:org.mitre.oval:def:28910: Windows Media Player RCE via DataObject vulnerability		 Type:
Software		 Bulletins:
MITRE:28910
CVE-2015-1728 		Severity:
Low
Description:
Microsoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site, aka "Windows Media Player RCE via DataObject Vulnerability."
Applies to:
Windows Media Player		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28769		 Title:
oval:org.mitre.oval:def:28769: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28769
CVE-2015-1737 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1736, and CVE-2015-1755.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29057		 Title:
oval:org.mitre.oval:def:29057: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29057
CVE-2015-1747 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1750, and CVE-2015-1753.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29060		 Title:
oval:org.mitre.oval:def:29060: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29060
CVE-2015-1751 		Severity:
Low
Description:
Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 10		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28610		 Title:
oval:org.mitre.oval:def:28610: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28610
CVE-2015-1730 		Severity:
Low
Description:
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28531		 Title:
oval:org.mitre.oval:def:28531: Microsoft Office uninitialized memory use vulnerability		 Type:
Software		 Bulletins:
MITRE:28531
CVE-2015-1770 		Severity:
Low
Description:
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Uninitialized Memory Use Vulnerability."
Applies to:
Microsoft Office 2013		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28508		 Title:
oval:org.mitre.oval:def:28508: Win32k memory corruption elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:28508
CVE-2015-1768 		Severity:
Low
Description:
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Memory Corruption Elevation of Privilege Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29067		 Title:
oval:org.mitre.oval:def:29067: Microsoft Windows Station use after free vulnerability		 Type:
Software		 Bulletins:
MITRE:29067
CVE-2015-1723 		Severity:
Low
Description:
Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Station Use After Free Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29142		 Title:
oval:org.mitre.oval:def:29142: Internet Explorer elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:29142
CVE-2015-1739 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28889		 Title:
oval:org.mitre.oval:def:28889: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28889
CVE-2015-1736 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1737, and CVE-2015-1755.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29093		 Title:
oval:org.mitre.oval:def:29093: Microsoft Windows Kernel information disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:29093
CVE-2015-1719 		Severity:
Low
Description:
The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to obtain sensitive information from kernel memory via a crafted application, aka "Microsoft Windows Kernel Information Disclosure Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28525		 Title:
oval:org.mitre.oval:def:28525: Windows LoadLibrary EoP vulnerability		 Type:
Software		 Bulletins:
MITRE:28525
CVE-2015-1758 		Severity:
Low
Description:
Untrusted search path vulnerability in the LoadLibrary function in the kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a Trojan horse DLL in an unspecified directory, aka "Windows LoadLibrary EoP Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-08-03
ID:
MITRE:29072		 Title:
oval:org.mitre.oval:def:29072: Microsoft common control use after free vulnerability		 Type:
Software		 Bulletins:
MITRE:29072
CVE-2015-1756 		Severity:
Low
Description:
Use-after-free vulnerability in Microsoft Common Controls in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted web site that is accessed with the F12 Developer Tools feature of Internet Explorer, aka "Microsoft Common Control Use After Free Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29119		 Title:
oval:org.mitre.oval:def:29119: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29119
CVE-2015-1742 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1747, CVE-2015-1750, and CVE-2015-1753.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29113		 Title:
oval:org.mitre.oval:def:29113: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29113
CVE-2015-1735 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1740, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29005		 Title:
oval:org.mitre.oval:def:29005: Internet Explorer elevation of privilege vulnerability		 Type:
Web		 Bulletins:
MITRE:29005
CVE-2015-1748 		Severity:
Low
Description:
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1743.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28201		 Title:
oval:org.mitre.oval:def:28201: Microsoft Windows Kernel Brush Object use after free vulnerability		 Type:
Software		 Bulletins:
MITRE:28201
CVE-2015-1726 		Severity:
Low
Description:
Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Brush Object Use After Free Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29050		 Title:
oval:org.mitre.oval:def:29050: Win32k Pool buffer overflow vulnerability		 Type:
Software		 Bulletins:
MITRE:29050
CVE-2015-1727 		Severity:
Low
Description:
Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Pool Buffer Overflow Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29145		 Title:
oval:org.mitre.oval:def:29145: Win32k Null pointer dereference vulnerability		 Type:
Software		 Bulletins:
MITRE:29145
CVE-2015-1721 		Severity:
Low
Description:
The kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a crafted application, aka "Win32k Null Pointer Dereference Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29124		 Title:
oval:org.mitre.oval:def:29124: Microsoft Windows Kernel Object use after free vulnerability		 Type:
Software		 Bulletins:
MITRE:29124
CVE-2015-1724 		Severity:
Low
Description:
Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Object Use After Free Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28806		 Title:
oval:org.mitre.oval:def:28806: Microsoft Windows Kernel Bitmap handling use after free vulnerability		 Type:
Software		 Bulletins:
MITRE:28806
CVE-2015-1722 		Severity:
Low
Description:
Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Bitmap Handling Use After Free Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29115		 Title:
oval:org.mitre.oval:def:29115: Exchange Cross-Site Request Forgery vulnerability		 Type:
Software		 Bulletins:
MITRE:29115
CVE-2015-1771 		Severity:
Low
Description:
Cross-site request forgery (CSRF) vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows remote attackers to hijack the authentication of arbitrary users, aka "Exchange Cross-Site Request Forgery Vulnerability."
Applies to:
Microsoft Exchange Server 2013		 Created:
2015-06-16		 Updated:
2015-08-03
ID:
MITRE:29081		 Title:
oval:org.mitre.oval:def:29081: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29081
CVE-2015-1687 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28512		 Title:
oval:org.mitre.oval:def:28512: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28512
CVE-2015-1752 		Severity:
Low
Description:
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1741.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28928		 Title:
oval:org.mitre.oval:def:28928: Exchange HTML injection vulnerability		 Type:
Software		 Bulletins:
MITRE:28928
CVE-2015-2359 		Severity:
Low
Description:
Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Exchange HTML Injection Vulnerability."
Applies to:
Microsoft Exchange Server 2013		 Created:
2015-06-16		 Updated:
2015-08-03
ID:
MITRE:28593		 Title:
oval:org.mitre.oval:def:28593: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28593
CVE-2015-1750 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1747, and CVE-2015-1753.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29118		 Title:
oval:org.mitre.oval:def:29118: Microsoft Windows Kernel use after free vulnerability		 Type:
Software		 Bulletins:
MITRE:29118
CVE-2015-1720 		Severity:
Low
Description:
Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Use After Free Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28513		 Title:
oval:org.mitre.oval:def:28513: Microsoft Office memory corruption vulnerability		 Type:
Miscellaneous		 Bulletins:
MITRE:28513
CVE-2015-1760 		Severity:
Low
Description:
Microsoft Office Compatibility Pack SP3, Office 2010 SP2, Office 2013 SP1, and Office 2013 RT SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Applies to:
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office Compatibility Pack		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28518		 Title:
oval:org.mitre.oval:def:28518: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28518
CVE-2015-1745 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1744, and CVE-2015-1766.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28848		 Title:
oval:org.mitre.oval:def:28848: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28848
CVE-2015-1744 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1745, and CVE-2015-1766.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28530		 Title:
oval:org.mitre.oval:def:28530: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28530
CVE-2015-1731 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1736, CVE-2015-1737, and CVE-2015-1755.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28665		 Title:
oval:org.mitre.oval:def:28665: Win32k buffer overflow vulnerability		 Type:
Software		 Bulletins:
MITRE:28665
CVE-2015-1725 		Severity:
Low
Description:
Buffer overflow in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Buffer Overflow Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28429		 Title:
oval:org.mitre.oval:def:28429: Internet Explorer information disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:28429
CVE-2015-1765 		Severity:
Low
Description:
Microsoft Internet Explorer 9 through 11 allows remote attackers to read the browser history via a crafted web site.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28724		 Title:
oval:org.mitre.oval:def:28724: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28724
CVE-2015-1754 		Severity:
Low
Description:
Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 8		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28948		 Title:
oval:org.mitre.oval:def:28948: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28948
CVE-2015-1755 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1731, CVE-2015-1736, and CVE-2015-1737.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29076		 Title:
oval:org.mitre.oval:def:29076: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29076
CVE-2015-1766 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1744, and CVE-2015-1745.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29033		 Title:
oval:org.mitre.oval:def:29033: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29033
CVE-2015-1732 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1742, CVE-2015-1747, CVE-2015-1750, and CVE-2015-1753.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29061		 Title:
oval:org.mitre.oval:def:29061: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29061
CVE-2015-1753 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1747, and CVE-2015-1750.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28650		 Title:
oval:org.mitre.oval:def:28650: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28650
CVE-2015-1741 		Severity:
Low
Description:
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1752.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28607		 Title:
oval:org.mitre.oval:def:28607: Exchange Server-Side Request Forgery vulnerability		 Type:
Software		 Bulletins:
MITRE:28607
CVE-2015-1764 		Severity:
Low
Description:
The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet servers via a crafted request, related to a Server-Side Request Forgery (SSRF) issue, aka "Exchange Server-Side Request Forgery Vulnerability."
Applies to:
Microsoft Exchange Server 2013		 Created:
2015-06-16		 Updated:
2015-08-03
ID:
MITRE:28994		 Title:
oval:org.mitre.oval:def:28994: Win32k elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:28994
CVE-2015-2360 		Severity:
Low
Description:
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Applies to:
 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29123		 Title:
oval:org.mitre.oval:def:29123: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:29123
CVE-2015-1740 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1744, CVE-2015-1745, and CVE-2015-1766.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29147		 Title:
oval:org.mitre.oval:def:29147: Internet Explorer elevation of privilege vulnerability		 Type:
Web		 Bulletins:
MITRE:29147
CVE-2015-1743 		Severity:
Low
Description:
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1748.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28744		 Title:
oval:org.mitre.oval:def:28744: Microsoft Office memory corruption vulnerability		 Type:
Miscellaneous		 Bulletins:
MITRE:28744
CVE-2015-1759 		Severity:
Low
Description:
Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Applies to:
Microsoft Office Compatibility Pack		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28643		 Title:
oval:org.mitre.oval:def:28643: ELSA-2015-1115 -- Oracle openssl		 Type:
Web		 Bulletins:
MITRE:28643 		Severity:
Low
Description:
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An invalid free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could cause a DTLS server or client using OpenSSL to crash or, potentially, execute arbitrary code. A flaw was found in the way the OpenSSL packages shipped with Red Hat Enterprise Linux 6 and 7 performed locking in the ssleay_rand_bytes function. This issue could possibly cause a multi-threaded application using OpenSSL to perform an out-of-bounds read and crash. An out-of-bounds read flaw was found in the X509_cmp_time function of OpenSSL. A specially crafted X.509 certificate or a Certificate Revocation List could possibly cause a TLS/SSL server or client using OpenSSL to crash. A race condition was found in the session handling code of OpenSSL. This issue could possibly cause a multi-threaded TLS/SSL client using OpenSSL to double free session ticket data and crash. A flaw was found in the way OpenSSL handled Cryptographic Message Syntax messages. A CMS message with an unknown hash function identifier could cause an application using OpenSSL to enter an infinite loop. A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. A specially crafted PKCS#7 input with missing EncryptedContent data could cause an application using OpenSSL to crash. Red Hat would like to thank the OpenSSL project for reporting CVE-2014-8176, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791 and CVE-2015-1792 flaws. Upstream acknowledges Praveen Kariyanahalli and Ivan Fratric as the original reporters of CVE-2014-8176, Robert Swiecki and Hanno Bock as the original reporters of CVE-2015-1789, Michal Zalewski as the original reporter of CVE-2015-1790, Emilia Kasper as the original report of CVE-2015-1791 and Johannes Bauer as the original reporter of CVE-2015-1792. All openssl users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
Applies to:
openssl		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29099		 Title:
oval:org.mitre.oval:def:29099: CESA-2015:1115 -- centos 7 openssl		 Type:
Web		 Bulletins:
MITRE:29099 		Severity:
Low
Description:
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An invalid free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could cause a DTLS server or client using OpenSSL to crash or, potentially, execute arbitrary code. A flaw was found in the way the OpenSSL packages shipped with Red Hat Enterprise Linux 6 and 7 performed locking in the ssleay_rand_bytes function. This issue could possibly cause a multi-threaded application using OpenSSL to perform an out-of-bounds read and crash. An out-of-bounds read flaw was found in the X509_cmp_time function of OpenSSL. A specially crafted X.509 certificate or a Certificate Revocation List could possibly cause a TLS/SSL server or client using OpenSSL to crash. A race condition was found in the session handling code of OpenSSL. This issue could possibly cause a multi-threaded TLS/SSL client using OpenSSL to double free session ticket data and crash. A flaw was found in the way OpenSSL handled Cryptographic Message Syntax messages. A CMS message with an unknown hash function identifier could cause an application using OpenSSL to enter an infinite loop. A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. A specially crafted PKCS#7 input with missing EncryptedContent data could cause an application using OpenSSL to crash. Red Hat would like to thank the OpenSSL project for reporting CVE-2014-8176, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791 and CVE-2015-1792 flaws. Upstream acknowledges Praveen Kariyanahalli and Ivan Fratric as the original reporters of CVE-2014-8176, Robert Swiecki and Hanno Bock as the original reporters of CVE-2015-1789, Michal Zalewski as the original reporter of CVE-2015-1790, Emilia Kasper as the original report of CVE-2015-1791 and Johannes Bauer as the original reporter of CVE-2015-1792. All openssl users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
Applies to:
openssl		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28440		 Title:
oval:org.mitre.oval:def:28440: RHSA-2015:1115-01 -- Redhat openssl		 Type:
Web		 Bulletins:
MITRE:28440 		Severity:
Low
Description:
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An invalid free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could cause a DTLS server or client using OpenSSL to crash or, potentially, execute arbitrary code. A flaw was found in the way the OpenSSL packages shipped with Red Hat Enterprise Linux 6 and 7 performed locking in the ssleay_rand_bytes function. This issue could possibly cause a multi-threaded application using OpenSSL to perform an out-of-bounds read and crash. An out-of-bounds read flaw was found in the X509_cmp_time function of OpenSSL. A specially crafted X.509 certificate or a Certificate Revocation List could possibly cause a TLS/SSL server or client using OpenSSL to crash. A race condition was found in the session handling code of OpenSSL. This issue could possibly cause a multi-threaded TLS/SSL client using OpenSSL to double free session ticket data and crash. A flaw was found in the way OpenSSL handled Cryptographic Message Syntax messages. A CMS message with an unknown hash function identifier could cause an application using OpenSSL to enter an infinite loop. A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. A specially crafted PKCS#7 input with missing EncryptedContent data could cause an application using OpenSSL to crash. Red Hat would like to thank the OpenSSL project for reporting CVE-2014-8176, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791 and CVE-2015-1792 flaws. Upstream acknowledges Praveen Kariyanahalli and Ivan Fratric as the original reporters of CVE-2014-8176, Robert Swiecki and Hanno Bock as the original reporters of CVE-2015-1789, Michal Zalewski as the original reporter of CVE-2015-1790, Emilia Kasper as the original report of CVE-2015-1791 and Johannes Bauer as the original reporter of CVE-2015-1792. All openssl users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
Applies to:
openssl		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28674		 Title:
oval:org.mitre.oval:def:28674: CESA-2015:1115 -- centos 6 openssl		 Type:
Web		 Bulletins:
MITRE:28674 		Severity:
Low
Description:
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An invalid free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could cause a DTLS server or client using OpenSSL to crash or, potentially, execute arbitrary code. A flaw was found in the way the OpenSSL packages shipped with Red Hat Enterprise Linux 6 and 7 performed locking in the ssleay_rand_bytes function. This issue could possibly cause a multi-threaded application using OpenSSL to perform an out-of-bounds read and crash. An out-of-bounds read flaw was found in the X509_cmp_time function of OpenSSL. A specially crafted X.509 certificate or a Certificate Revocation List could possibly cause a TLS/SSL server or client using OpenSSL to crash. A race condition was found in the session handling code of OpenSSL. This issue could possibly cause a multi-threaded TLS/SSL client using OpenSSL to double free session ticket data and crash. A flaw was found in the way OpenSSL handled Cryptographic Message Syntax messages. A CMS message with an unknown hash function identifier could cause an application using OpenSSL to enter an infinite loop. A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. A specially crafted PKCS#7 input with missing EncryptedContent data could cause an application using OpenSSL to crash. Red Hat would like to thank the OpenSSL project for reporting CVE-2014-8176, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791 and CVE-2015-1792 flaws. Upstream acknowledges Praveen Kariyanahalli and Ivan Fratric as the original reporters of CVE-2014-8176, Robert Swiecki and Hanno Bock as the original reporters of CVE-2015-1789, Michal Zalewski as the original reporter of CVE-2015-1790, Emilia Kasper as the original report of CVE-2015-1791 and Johannes Bauer as the original reporter of CVE-2015-1792. All openssl users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
Applies to:
openssl		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:29126		 Title:
oval:org.mitre.oval:def:29126: ELSA-2015-1115 -- Oracle openssl		 Type:
Web		 Bulletins:
MITRE:29126 		Severity:
Low
Description:
OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength, general purpose cryptography library. An invalid free flaw was found in the way OpenSSL handled certain DTLS handshake messages. A malicious DTLS client or server could cause a DTLS server or client using OpenSSL to crash or, potentially, execute arbitrary code. A flaw was found in the way the OpenSSL packages shipped with Red Hat Enterprise Linux 6 and 7 performed locking in the ssleay_rand_bytes function. This issue could possibly cause a multi-threaded application using OpenSSL to perform an out-of-bounds read and crash. An out-of-bounds read flaw was found in the X509_cmp_time function of OpenSSL. A specially crafted X.509 certificate or a Certificate Revocation List could possibly cause a TLS/SSL server or client using OpenSSL to crash. A race condition was found in the session handling code of OpenSSL. This issue could possibly cause a multi-threaded TLS/SSL client using OpenSSL to double free session ticket data and crash. A flaw was found in the way OpenSSL handled Cryptographic Message Syntax messages. A CMS message with an unknown hash function identifier could cause an application using OpenSSL to enter an infinite loop. A NULL pointer dereference was found in the way OpenSSL handled certain PKCS#7 inputs. A specially crafted PKCS#7 input with missing EncryptedContent data could cause an application using OpenSSL to crash. Red Hat would like to thank the OpenSSL project for reporting CVE-2014-8176, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791 and CVE-2015-1792 flaws. Upstream acknowledges Praveen Kariyanahalli and Ivan Fratric as the original reporters of CVE-2014-8176, Robert Swiecki and Hanno Bock as the original reporters of CVE-2015-1789, Michal Zalewski as the original reporter of CVE-2015-1790, Emilia Kasper as the original report of CVE-2015-1791 and Johannes Bauer as the original reporter of CVE-2015-1792. All openssl users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.
Applies to:
openssl		 Created:
2015-06-16		 Updated:
2015-07-27
ID:
MITRE:28198		 Title:
oval:org.mitre.oval:def:28198: CESA-2015:1003 -- centos 5 kvm		 Type:
Miscellaneous		 Bulletins:
MITRE:28198 		Severity:
Low
Description:
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. An out-of-bounds memory access flaw was found in the way QEMU"s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host"s QEMU process corresponding to the guest. Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue. All kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. Note: The procedure in the Solution section must be performed before this update will take effect.
Applies to:
kvm		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
MITRE:29004		 Title:
oval:org.mitre.oval:def:29004: ELSA-2015-0998 -- Oracle qemu-kvm_qemu-guest-agent		 Type:
Software		 Bulletins:
MITRE:29004 		Severity:
Low
Description:
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. An out-of-bounds memory access flaw was found in the way QEMU"s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host"s QEMU process corresponding to the guest. Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue. All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
Applies to:
qemu-guest-agent
qemu-kvm		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
MITRE:28949		 Title:
oval:org.mitre.oval:def:28949: ELSA-2015-1003 -- Oracle kvm-83		 Type:
Software		 Bulletins:
MITRE:28949 		Severity:
Low
Description:
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
Applies to:
kvm-83		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
MITRE:28893		 Title:
oval:org.mitre.oval:def:28893: ELSA-2015-0999 -- Oracle qemu-kvm		 Type:
Software		 Bulletins:
MITRE:28893 		Severity:
Low
Description:
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. An out-of-bounds memory access flaw was found in the way QEMU"s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host"s QEMU process corresponding to the guest. Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue. All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
Applies to:
libcacard
qemu-kvm		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
MITRE:28600		 Title:
oval:org.mitre.oval:def:28600: CESA-2015:0999 -- centos 7 qemu-kvm,libcacard		 Type:
Software		 Bulletins:
MITRE:28600 		Severity:
Low
Description:
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. An out-of-bounds memory access flaw was found in the way QEMU"s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host"s QEMU process corresponding to the guest. Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue. All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
Applies to:
libcacard
qemu-kvm		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
MITRE:28702		 Title:
oval:org.mitre.oval:def:28702: RHSA-2015:0998-01 -- Redhat qemu-kvm, qemu-guest-agent		 Type:
Software		 Bulletins:
MITRE:28702 		Severity:
Low
Description:
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. An out-of-bounds memory access flaw was found in the way QEMU"s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host"s QEMU process corresponding to the guest. Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue. All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
Applies to:
qemu-guest-agent
qemu-kvm		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
MITRE:28974		 Title:
oval:org.mitre.oval:def:28974: ELSA-2015-1002 -- Oracle xen		 Type:
Software		 Bulletins:
MITRE:28974 		Severity:
Low
Description:
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
Applies to:
xen		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
MITRE:28106		 Title:
oval:org.mitre.oval:def:28106: RHSA-2015:0999-01 -- Redhat qemu-kvm, libcacard		 Type:
Software		 Bulletins:
MITRE:28106 		Severity:
Low
Description:
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. An out-of-bounds memory access flaw was found in the way QEMU"s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host"s QEMU process corresponding to the guest. Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue. All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
Applies to:
libcacard
qemu-kvm		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
MITRE:28937		 Title:
oval:org.mitre.oval:def:28937: CESA-2015:1002 -- centos 5 xen		 Type:
Software		 Bulletins:
MITRE:28937 		Severity:
Low
Description:
The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Red Hat Enterprise Linux. An out-of-bounds memory access flaw was found in the way QEMU"s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host"s QEMU process corresponding to the guest. Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue. All xen users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, all running fully-virtualized guests must be restarted for this update to take effect.
Applies to:
xen		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
MITRE:28912		 Title:
oval:org.mitre.oval:def:28912: CESA-2015:0998 -- centos 6 qemu-kvm,qemu-guest-agent		 Type:
Software		 Bulletins:
MITRE:28912 		Severity:
Low
Description:
KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM. An out-of-bounds memory access flaw was found in the way QEMU"s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host"s QEMU process corresponding to the guest. Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue. All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
Applies to:
qemu-guest-agent
qemu-kvm		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
MITRE:28539		 Title:
oval:org.mitre.oval:def:28539: RHSA-2015:1002-01 -- Redhat xen		 Type:
Software		 Bulletins:
MITRE:28539 		Severity:
Low
Description:
The xen packages contain administration tools and the xend service for managing the kernel-xen kernel for virtualization on Red Hat Enterprise Linux. An out-of-bounds memory access flaw was found in the way QEMU"s virtual Floppy Disk Controller handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host"s QEMU process corresponding to the guest. Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue. All xen users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, all running fully-virtualized guests must be restarted for this update to take effect.
Applies to:
xen		 Created:
2015-06-02		 Updated:
2015-07-13
ID:
CVE-2015-1157		 Title:
CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1157
SFBID75491 		Severity:
High
Description:
CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.
Applies to:
 Created:
2015-05-27		 Updated:
2017-08-09
ID:
MITRE:28742		 Title:
oval:org.mitre.oval:def:28742: Windows Journal remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:28742
CVE-2015-1675 		Severity:
Low
Description:
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28645		 Title:
oval:org.mitre.oval:def:28645: Microsoft Office memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28645
CVE-2015-1682 		Severity:
Low
Description:
Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Office 2013 RT SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office for Mac 2011, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, PowerPoint Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, SharePoint Foundation 2010 SP2, and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
Applies to:
Microsoft Excel 2010
Microsoft Excel 2013
Microsoft Office 2010
Microsoft Office 2013
Microsoft Office Web Apps 2010
Microsoft Office Web Apps Server 2013
Microsoft PowerPoint 2010
Microsoft PowerPoint 2013
Microsoft SharePoint Foundation 2010		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28815		 Title:
oval:org.mitre.oval:def:28815: Internet Explorer elevation of privilege vulnerability		 Type:
Web		 Bulletins:
MITRE:28815
CVE-2015-1704 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1703.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:29000		 Title:
oval:org.mitre.oval:def:29000: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:29000
CVE-2015-1658 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1706, CVE-2015-1711, CVE-2015-1717, and CVE-2015-1718.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28680		 Title:
oval:org.mitre.oval:def:28680: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28680
CVE-2015-1714 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28883		 Title:
oval:org.mitre.oval:def:28883: Microsoft windows kernel memory disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:28883
CVE-2015-1701 		Severity:
Low
Description:
Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28936		 Title:
oval:org.mitre.oval:def:28936: Windows Journal remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:28936
CVE-2015-1699 		Severity:
Low
Description:
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, and CVE-2015-1698.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28517		 Title:
oval:org.mitre.oval:def:28517: Windows Journal remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:28517
CVE-2015-1695 		Severity:
Low
Description:
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:29001		 Title:
oval:org.mitre.oval:def:29001: Microsoft windows kernel memory disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:29001
CVE-2015-1676 		Severity:
Low
Description:
The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1677, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:29016		 Title:
oval:org.mitre.oval:def:29016: Internet Explorer ASLR bypass vulnerability		 Type:
Software		 Bulletins:
MITRE:29016
CVE-2015-1685 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass."
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28950		 Title:
oval:org.mitre.oval:def:28950: Windows forms elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:28950
CVE-2015-1673 		Severity:
Low
Description:
The Windows Forms (aka WinForms) libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-assisted remote attackers to execute arbitrary code via a crafted partial-trust application, aka "Windows Forms Elevation of Privilege Vulnerability."
Applies to:
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4.0
Microsoft .NET Framework 4.5
Microsoft .NET Framework 4.5.1
Microsoft .NET Framework 4.5.2		 Created:
2015-05-20		 Updated:
2015-12-22
ID:
MITRE:28362		 Title:
oval:org.mitre.oval:def:28362: OpenType Font parsing vulnerability		 Type:
Software		 Bulletins:
MITRE:28362
CVE-2015-1670 		Severity:
Low
Description:
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."
Applies to:
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4.0
Microsoft .NET Framework 4.5
Microsoft .NET Framework 4.5.1
Microsoft .NET Framework 4.5.2		 Created:
2015-05-20		 Updated:
2015-12-22
ID:
MITRE:28649		 Title:
oval:org.mitre.oval:def:28649: Windows Journal remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:28649
CVE-2015-1698 		Severity:
Low
Description:
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, and CVE-2015-1699.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28867		 Title:
oval:org.mitre.oval:def:28867: VBScript memory corruption vulnerability		 Type:
Miscellaneous		 Bulletins:
MITRE:28867
CVE-2015-1684 		Severity:
Low
Description:
VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript ASLR Bypass."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9
VBScript 5.6
VBScript 5.7
VBScript 5.8		 Created:
2015-05-20		 Updated:
2015-08-10
ID:
MITRE:28932		 Title:
oval:org.mitre.oval:def:28932: Service control manager elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:28932
CVE-2015-1702 		Severity:
Low
Description:
The Service Control Manager (SCM) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Service Control Manager Elevation of Privilege Vulnerability."
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28829		 Title:
oval:org.mitre.oval:def:28829: Internet Explorer elevation of privilege vulnerability		 Type:
Software		 Bulletins:
MITRE:28829
CVE-2015-1713 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28993		 Title:
oval:org.mitre.oval:def:28993: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28993
CVE-2015-1717 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1706, CVE-2015-1711, and CVE-2015-1718.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28405		 Title:
oval:org.mitre.oval:def:28405: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28405
CVE-2015-1710 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1694.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28473		 Title:
oval:org.mitre.oval:def:28473: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28473
CVE-2015-1708 		Severity:
Low
Description:
Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28876		 Title:
oval:org.mitre.oval:def:28876: Microsoft windows kernel memory disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:28876
CVE-2015-1677 		Severity:
Low
Description:
The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28745		 Title:
oval:org.mitre.oval:def:28745: VBScript and JScript ASLR bypass vulnerability		 Type:
Software		 Bulletins:
MITRE:28745
CVE-2015-1686 		Severity:
Low
Description:
The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass."
Applies to:
JScript 5.6
JScript 5.7
JScript 5.8
Microsoft Internet Explorer 10
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9
VBScript 5.6
VBScript 5.7
VBScript 5.8		 Created:
2015-05-20		 Updated:
2015-08-10
ID:
MITRE:28340		 Title:
oval:org.mitre.oval:def:28340: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28340
CVE-2015-1691 		Severity:
Low
Description:
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1712.
Applies to:
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28699		 Title:
oval:org.mitre.oval:def:28699: Windows Kernel security feature bypass vulnerability		 Type:
Software		 Bulletins:
MITRE:28699
CVE-2015-1674 		Severity:
Low
Description:
The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate an unspecified address, which allows local users to bypass the KASLR protection mechanism, and consequently discover the cng.sys base address, via a crafted application, aka "Windows Kernel Security Feature Bypass Vulnerability."
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28984		 Title:
oval:org.mitre.oval:def:28984: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28984
CVE-2015-1709 		Severity:
Low
Description:
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28672		 Title:
oval:org.mitre.oval:def:28672: Schannel information disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:28672
CVE-2015-1716 		Severity:
Low
Description:
Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict Diffie-Hellman Ephemeral (DHE) key lengths, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, aka "Schannel Information Disclosure Vulnerability."
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28739		 Title:
oval:org.mitre.oval:def:28739: .NET XML decryption denial of service vulnerability		 Type:
Software		 Bulletins:
MITRE:28739
CVE-2015-1672 		Severity:
Low
Description:
Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability."
Applies to:
Microsoft .NET Framework 2.0
Microsoft .NET Framework 3.5
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4.0
Microsoft .NET Framework 4.5
Microsoft .NET Framework 4.5.1
Microsoft .NET Framework 4.5.2		 Created:
2015-05-20		 Updated:
2015-12-22
ID:
MITRE:28555		 Title:
oval:org.mitre.oval:def:28555: Microsoft windows kernel memory disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:28555
CVE-2015-1679 		Severity:
Low
Description:
The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1677, CVE-2015-1678, and CVE-2015-1680.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28917		 Title:
oval:org.mitre.oval:def:28917: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28917
CVE-2015-1718 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1706, CVE-2015-1711, and CVE-2015-1717.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28723		 Title:
oval:org.mitre.oval:def:28723: Microsoft Office memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28723
CVE-2015-1683 		Severity:
Low
Description:
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
Applies to:
Microsoft Office 2007		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28924		 Title:
oval:org.mitre.oval:def:28924: Microsoft SharePoint page content vulnerabilities		 Type:
Services		 Bulletins:
MITRE:28924
CVE-2015-1700 		Severity:
Low
Description:
Microsoft SharePoint Server 2007 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, and SharePoint Foundation 2013 SP1 allow remote authenticated users to execute arbitrary code via crafted page content, aka "Microsoft SharePoint Page Content Vulnerabilities."
Applies to:
Microsoft SharePoint Foundation 2010
Microsoft SharePoint Foundation 2013
Microsoft SharePoint Server 2007
Microsoft SharePoint Server 2010		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:29018		 Title:
oval:org.mitre.oval:def:29018: Microsoft Management Console file format denial of service vulnerability		 Type:
Software		 Bulletins:
MITRE:29018
CVE-2015-1681 		Severity:
Low
Description:
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to cause a denial of service via a crafted .msc file, aka "Microsoft Management Console File Format Denial of Service Vulnerability."
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28162		 Title:
oval:org.mitre.oval:def:28162: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28162
CVE-2015-1706 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1711, CVE-2015-1717, and CVE-2015-1718.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28822		 Title:
oval:org.mitre.oval:def:28822: Internet Explorer clipboard information disclosure vulnerability		 Type:
Web		 Bulletins:
MITRE:28822
CVE-2015-1692 		Severity:
Low
Description:
Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script, aka "Internet Explorer Clipboard Information Disclosure Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28390		 Title:
oval:org.mitre.oval:def:28390: Windows Journal remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:28390
CVE-2015-1697 		Severity:
Low
Description:
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1696, CVE-2015-1698, and CVE-2015-1699.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28710		 Title:
oval:org.mitre.oval:def:28710: Windows Journal remote code execution vulnerability		 Type:
Software		 Bulletins:
MITRE:28710
CVE-2015-1696 		Severity:
Low
Description:
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1695, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28692		 Title:
oval:org.mitre.oval:def:28692: Internet Explorer elevation of privilege vulnerability		 Type:
Web		 Bulletins:
MITRE:28692
CVE-2015-1703 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-1704.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28808		 Title:
oval:org.mitre.oval:def:28808: Microsoft windows kernel memory disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:28808
CVE-2015-1680 		Severity:
Low
Description:
The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1677, CVE-2015-1678, and CVE-2015-1679.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28207		 Title:
oval:org.mitre.oval:def:28207: TrueType font parsing vulnerability		 Type:
Software		 Bulletins:
MITRE:28207
CVE-2015-1671 		Severity:
Low
Description:
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."
Applies to:
Microsoft .NET Framework 3.0
Microsoft .NET Framework 3.5.1
Microsoft .NET Framework 4.0
Microsoft .NET Framework 4.5
Microsoft .NET Framework 4.5.1
Microsoft .NET Framework 4.5.2
Microsoft Lync 2010
Microsoft Lync Basic 2013
Microsoft Silverlight 5		 Created:
2015-05-20		 Updated:
2015-12-22
ID:
MITRE:28167		 Title:
oval:org.mitre.oval:def:28167: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28167
CVE-2015-1711 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1706, CVE-2015-1717, and CVE-2015-1718.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28068		 Title:
oval:org.mitre.oval:def:28068: Microsoft windows kernel memory disclosure vulnerability		 Type:
Software		 Bulletins:
MITRE:28068
CVE-2015-1678 		Severity:
Low
Description:
The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1677, CVE-2015-1679, and CVE-2015-1680.
Applies to:
 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28951		 Title:
oval:org.mitre.oval:def:28951: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28951
CVE-2015-1705 		Severity:
Low
Description:
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1689.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28641		 Title:
oval:org.mitre.oval:def:28641: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28641
CVE-2015-1688 		Severity:
Low
Description:
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28840		 Title:
oval:org.mitre.oval:def:28840: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28840
CVE-2015-1712 		Severity:
Low
Description:
Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1691.
Applies to:
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28576		 Title:
oval:org.mitre.oval:def:28576: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28576
CVE-2015-1694 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1710.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28985		 Title:
oval:org.mitre.oval:def:28985: Microsoft Silverlight out of browser application vulnerability		 Type:
Software		 Bulletins:
MITRE:28985
CVE-2015-1715 		Severity:
Low
Description:
Microsoft Silverlight 5 before 5.1.40416.00 allows remote attackers to bypass intended integrity-level restrictions via a crafted Silverlight application, aka "Microsoft Silverlight Out of Browser Application Vulnerability."
Applies to:
Microsoft Silverlight 5		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28753		 Title:
oval:org.mitre.oval:def:28753: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28753
CVE-2015-1689 		Severity:
Low
Description:
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1705.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2015-05-20		 Updated:
2015-07-06
ID:
MITRE:28575		 Title:
oval:org.mitre.oval:def:28575: Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 could allow attackers to execute arbitrary code on Windows		 Type:
Software		 Bulletins:
MITRE:28575 		Severity:
Low
Description:
Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0334.
Applies to:
ActiveX Control
Adobe Flash Player		 Created:
2015-05-12		 Updated:
2015-08-03
ID:
CVE-2015-1152		 Title:
WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1152
SFBID74525 		Severity:
Medium
Description:
WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1153 and CVE-2015-1154.
Applies to:
 Created:
2015-05-07		 Updated:
2017-08-09
ID:
CVE-2015-1153		 Title:
WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1153
SFBID74523 		Severity:
Medium
Description:
WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1154.
Applies to:
 Created:
2015-05-07		 Updated:
2017-08-09
ID:
CVE-2015-1155		 Title:
The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1155
SFBID74527 		Severity:
Medium
Description:
The history implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to bypass the Same Origin Policy and read arbitrary files via a crafted web site.
Applies to:
 Created:
2015-05-07		 Updated:
2017-08-09
ID:
CVE-2015-1156		 Title:
The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same...		 Type:
Mobile Devices		 Bulletins:
CVE-2015-1156
SFBID74524 		Severity:
Medium
Description:
The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.
Applies to:
 Created:
2015-05-07		 Updated:
2017-08-09
ID:
CVE-2014-8361		 Title:
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request.		 Type:
Hardware		 Bulletins:
CVE-2014-8361
SFBID74330 		Severity:
High
Description:
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request.
Applies to:
dir-600l
dir-605l
dir-619l
dir-809
dir-809l
dir-905l		 Created:
2015-05-01		 Updated:
2017-08-09
ID:
MITRE:29009		 Title:
oval:org.mitre.oval:def:29009: MSXML3 same origin policy SFB vulnerability		 Type:
Software		 Bulletins:
MITRE:29009
CVE-2015-1646 		Severity:
Low
Description:
Microsoft XML Core Services (aka MSXML) 3.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted DTD, aka "MSXML3 Same Origin Policy SFB Vulnerability."
Applies to:
Microsoft XML Core Services 3.0		 Created:
2015-04-24		 Updated:
2015-06-22
ID:
MITRE:28565		 Title:
oval:org.mitre.oval:def:28565: Microsoft SharePoint XSS vulnerability		 Type:
Software		 Bulletins:
MITRE:28565
CVE-2015-1640 		Severity:
Low
Description:
Cross-site scripting (XSS) vulnerability in Microsoft Project Server 2010 SP2 and 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
Applies to:
Microsoft Project Server 2010
Microsoft Project Server 2013		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:27899		 Title:
oval:org.mitre.oval:def:27899: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:27899
CVE-2015-1652 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1666.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:28861		 Title:
oval:org.mitre.oval:def:28861: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:28861
CVE-2015-1666 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1652.
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:28523		 Title:
oval:org.mitre.oval:def:28523: Microsoft SharePoint XSS vulnerability		 Type:
Software		 Bulletins:
MITRE:28523
CVE-2015-1653 		Severity:
Low
Description:
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
Applies to:
Microsoft SharePoint Foundation 2013
Microsoft SharePoint Server 2013		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:28709		 Title:
oval:org.mitre.oval:def:28709: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28709
CVE-2015-1665 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1659 and CVE-2015-1662.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:28895		 Title:
oval:org.mitre.oval:def:28895: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28895
CVE-2015-1668 		Severity:
Low
Description:
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:28865		 Title:
oval:org.mitre.oval:def:28865: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28865
CVE-2015-1660 		Severity:
Low
Description:
Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 9		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:28821		 Title:
oval:org.mitre.oval:def:28821: Internet Explorer ASLR bypass vulnerability		 Type:
Web		 Bulletins:
MITRE:28821
CVE-2015-1661 		Severity:
Low
Description:
Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 6
Microsoft Internet Explorer 7
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:27908		 Title:
oval:org.mitre.oval:def:27908: Internet Explorer memory corruption vulnerability		 Type:
Web		 Bulletins:
MITRE:27908
CVE-2015-1667 		Severity:
Low
Description:
Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 8
Microsoft Internet Explorer 9		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:28574		 Title:
oval:org.mitre.oval:def:28574: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28574
CVE-2015-1659 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1662 and CVE-2015-1665.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:28783		 Title:
oval:org.mitre.oval:def:28783: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28783
CVE-2015-1662 		Severity:
Low
Description:
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1659 and CVE-2015-1665.
Applies to:
Microsoft Internet Explorer 11		 Created:
2015-04-21		 Updated:
2015-06-01
ID:
MITRE:28704		 Title:
oval:org.mitre.oval:def:28704: Internet Explorer memory corruption vulnerability		 Type:
Software		 Bulletins:
MITRE:28704
CVE-2015-1657 		Severity:
Low
Description:
Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Applies to:
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Microsoft Internet Explorer 9		 Created:
2015-04-21		 Updated:
2015-06-01