Tuesday Jan 20, 2015

Important announcement about Third Party Bulletin

By Ritwik Ghoshal-Oracle on Jan 20, 2015

Dear reader,

Beginning January 20, 2015, bulletins announcing patches in third party software
that are included in Solaris will be published on the Oracle Technology Network.
For more information, please see the Third Party Bulletin.

All bulletins published prior to January 20, 2015 will remain on this blog and
bulletins will also be updated if new Solaris patch or SRU information
becomes available.

Thanks,
-Ritwik Ghoshal
Oracle Security Alerts

Category: Alerts

Tags: none

Permanent link to this entry | Comments [0] | Comments have been disabled.

Multiple vulnerabilities in NTP

By Ritwik Ghoshal-Oracle on Jan 20, 2015

CVE Description CVSSv2 Base Score Component Product Resolution
CVE-2014-9295 Buffer Error vulnerability
CVE-2014-9296 Coding Error vulnerability		 7.5 NTP V4 Solaris 11.2 11.2.6.4.0
Solaris 11.1 IDR1583.2
Solaris 10 SPARC: 143725-05 X86: 143726-05
NTP V3 Solaris 10 SPARC: 148881-03 X86: 148882-03

Please log a support request via My Oracle Support to get access to the IDRs.

Latest version of NTP shipped with Solaris 10 and Solaris 11.2 is not impacted by CVE-2014-9293 and CVE-2014-9294.

Please upgrade to Solaris 11.1 SRU 13.6 to install the Solaris 11.1 IDR.

NTP service on Solaris 10 needs to be restarted for the patches to take effect. You can restart the daemon by using
# svcadm restart ntp (for NTPv3) or # svcadm restart ntp4 (for NTPv4)

NTPv3 is not vulnerable to CVE-2014-9296.

Please see http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities for workaround instructions.

This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.
Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

Category: Alerts

Tags: none

Permanent link to this entry | Comments [2]

Tuesday Dec 16, 2014

Multiple vulnerabilities fixed in Firefox 24.7.0 ESR

By Ritwik Ghoshal-Oracle on Dec 16, 2014

CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution
Multiple CVEs Multiple vulnerabilities 10.0 Firefox
Solaris 11.2 11.2.5.5.0

This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.
Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

Category: Alerts

Tags: none

Permanent link to this entry | Comments [0]

CVE-2014-3707 Information Disclosure vulnerability in Libcurl

By Ritwik Ghoshal-Oracle on Dec 16, 2014

CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution
CVE-2014-3707 Information Disclosure vulnerability 4.3 Libcurl
Solaris 11.2 11.2.5.5.0

This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.
Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

Category: Alerts

Tags: none

Permanent link to this entry | Comments [0]

Multiple vulnerabilities in Puppet

By Ritwik Ghoshal-Oracle on Dec 16, 2014

CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution
CVE-2014-3248 Untrusted search path vulnerability 6.2 Puppet
Solaris 11.2 11.2.5.5.0
CVE-2014-3250 Information Leakage vulnerability 3.1

This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.
Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

Category: Alerts

Tags: none

Permanent link to this entry | Comments [0]

Multiple Buffer Errors vulnerabilities in Kerberos

By Ritwik Ghoshal-Oracle on Dec 16, 2014

CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution
CVE-2014-4341 Buffer Errors vulnerability 5.0 Kerberos
Solaris 10 SPARC: 147793-15 X86: 147794-15
Solaris 11.2 11.2.5.5.0
CVE-2014-4342 Buffer Errors vulnerability 5.0

This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.
Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

Category: Alerts

Tags: none

Permanent link to this entry | Comments [0]

CVE-2014-2285 Input Validation vulnerability in Net-SNMP

By Ritwik Ghoshal-Oracle on Dec 16, 2014

CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution
CVE-2014-2285 Input Validation vulnerability 4.3 Net-SNMP
Solaris 11.2 11.2.5.5.0

This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.
Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

Category: Alerts

Tags: none

Permanent link to this entry | Comments [0]

CVE-2012-2141 Denial Of Service(DoS) vulnerability in Net-SNMP

By Ritwik Ghoshal-Oracle on Dec 16, 2014

CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution
CVE-2012-2141 Denial Of Service(DoS) vulnerability 3.5 Net-SNMP
Solaris 11.2 11.2.5.5.0

This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.
Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

Category: Alerts

Tags: none

Permanent link to this entry | Comments [0]

CVE-2014-3565 Resource Management Errors vulnerability in Net-SNMP

By Ritwik Ghoshal-Oracle on Dec 16, 2014

CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution
CVE-2014-3565 Resource Management Errors vulnerability 5.0 Net-SNMP
Solaris 11.2 11.2.5.5.0

This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.
Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

Category: Alerts

Tags: none

Permanent link to this entry | Comments [0]

Multiple vulnerabilities in Jinja2

By Ritwik Ghoshal-Oracle on Dec 16, 2014

CVE DescriptionCVSSv2 Base ScoreComponentProduct and Resolution
CVE-2014-0012 Permissions, Privileges, and Access Control vulnerability 4.4 Jinja2
Solaris 11.2 11.2.5.5.0
CVE-2014-1402 Permissions, Privileges, and Access Control vulnerability 4.4

This notification describes vulnerabilities fixed in third-party components that are included in Oracle's product distributions.
Information about vulnerabilities affecting Oracle products can be found on Oracle Critical Patch Updates and Security Alerts page.

Category: Alerts

Tags: none

Permanent link to this entry | Comments [0]

About

This blog provides security vulnerability fix notifications relevant to third party software components distributed and supported as part of Oracle Products.
Summarized version of this blog is available as a mapping of CVEs and solutions.

Search

Archives
« March 2015
SunMonTueWedThuFriSat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
    
       
Today