Red Hat安全公告—2016年5月

CVE-2016-0376

Critical

Java

2016/04/14

CVE-2016-0687

Critical

Java

2016/04/19

CVE-2016-3427

Critical

Java

2016/04/19

CVE-2016-0686

Critical

Java

2016/04/19

CVE-2016-3443

Critical

Java

2016/04/19

CVE-2016-3449

Important

Java

2016/04/19

CVE-2016-0639

Critical

rh-mysql56-mysql

2016/04/21

CVE-2016-0264

Important

Java

2016/04/27

CVE-2015-8869

Important

Ocaml

2016/04/28

CVE-2016-1541

Important

libarchive

2016/05/02

CVE-2016-2108

Important

openssl

2016/05/03

CVE-2016-3710

Important

kvm

2016/05/09

标题

CVE-2016-0376

描述

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Find out more about CVE-2016-0376 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Critical

漏洞的影响

Red Hat Enterprise Linux 6 (java-1.8.0-ibm)

Red Hat Enterprise Linux 7 ( java-1.8.0-ibm)

Bugzilla

1330986: CVE-2016-0376 IBM JDK: insecure deserialization in CORBA, incorrect CVE-2013-5456 fix

详细信息

https://access.redhat.com/security/cve/cve-2016-0376

公告标识 CVE-2016-0687

标题

CVE-2016-0687

描述

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to the Hotspot sub-component.

Find out more about CVE-2016-0687 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Critical

漏洞的影响

Red Hat Enterprise Linux 5 (java-1.7.0-openjdk、java-1.6.0-openjdk)

Red Hat Enterprise Linux 6 (java-1.8.0-openjdk、java-1.7.0-openjdk、java-1.8.0-ibm)

Red Hat Enterprise Linux 7 (java-1.8.0-openjdk、java-1.7.0-openjdk、java-1.6.0-openjdk)

Bugzilla

1327749: CVE-2016-0687 OpenJDK: insufficient byte type checks (Hotspot, 8132051)

详细信息

https://access.redhat.com/security/cve/cve-2016-0687

公告标识 CVE-2016-3427

标题

CVE-2016-3427

描述

It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws.

Find out more about CVE-2016-3427 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Critical

漏洞的影响

Red Hat Enterprise Linux 5 (java-1.7.0-openjdk、java-1.6.0-openjdk)

Red Hat Enterprise Linux 6 (java-1.8.0-openjdk、java-1.7.0-openjdk、java-1.6.0-openjdk、java-1.8.0-ibm)

Red Hat Enterprise Linux 7 (java-1.8.0-openjdk、java-1.7.0-openjdk、java-1.6.0-openjdk)

Bugzilla

1328210: CVE-2016-3427 OpenJDK: unrestricted deserialization of authentication credentials (JMX, 8144430)

详细信息

https://access.redhat.com/security/cve/cve-2016-3427

公告标识 CVE-2016-0686

标题

CVE-2016-0686

描述

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 and Java SE Embedded 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Serialization.

Find out more about CVE-2016-0686 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Critical

漏洞的影响

Red Hat Enterprise Linux 5 (java-1.7.0-openjdk、java-1.6.0-openjdk)

Red Hat Enterprise Linux 6 (java-1.8.0-openjdk、java-1.7.0-openjdk、java-1.6.0-openjdk、java-1.8.0-ibm)

Red Hat Enterprise Linux 7 (java-1.8.0-openjdk、java-1.7.0-openjdk、java-1.6.0-openjdk)

Bugzilla

1327743: CVE-2016-0686 OpenJDK: insufficient thread consistency checks in ObjectInputStream (Serialization, 8129952)

详细信息

https://access.redhat.com/security/cve/cve-2016-0686

公告标识 CVE-2016-3443

标题

CVE-2016-3443

描述

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D.

Find out more about CVE-2016-3443 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Critical

漏洞的影响

Red Hat Enterprise Linux 5 (java-1.6.0-sun、java-1.7.0-oracle)

Red Hat Enterprise Linux 6 (java-1.6.0-sun 、java-1.8.0-oracle 、java-1.7.0-oracle 、java-1.8.0-ibm)

Red Hat Enterprise Linux 7 ( java-1.6.0-sun 、 java-1.7.0-oracle 、 java-1.8.0-oracle、java-1.8.0-ibm)

Bugzilla

1328618: CVE-2016-3443 Oracle JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (2D)

详细信息

https://access.redhat.com/security/cve/cve-2016-3443

公告标识 CVE-2016-3449

标题

CVE-2016-3449

描述

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Deployment.

Find out more about CVE-2016-3449 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Important

漏洞的影响

Red Hat Enterprise Linux 5 (java-1.6.0-sun、java-1.7.0-oracle)

Red Hat Enterprise Linux 6 (java-1.6.0-sun 、java-1.8.0-oracle 、java-1.7.0-oracle 、java-1.8.0-ibm)

Red Hat Enterprise Linux 7 ( java-1.6.0-sun 、 java-1.7.0-oracle 、 java-1.8.0-oracle、java-1.8.0-ibm)

Bugzilla

1328619: CVE-2016-3449 Oracle JDK: unspecified vulnerability fixed in 6u115, 7u101 and 8u91 (Deployment)

详细信息

https://access.redhat.com/security/cve/cve-2016-3449

公告标识 CVE-2016-0639

标题

CVE-2016-0639

描述

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Pluggable Authentication.

Find out more about CVE-2016-0639 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Critical

漏洞的影响

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) (rh-mysql56-mysql)

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) (rh-mysql56-mysql)

Bugzilla

1329238: CVE-2016-0639 mysql: unspecified vulnerability in subcomponent: Server: Pluggable Authentication (CPU April 2016)

详细信息

https://access.redhat.com/security/cve/cve-2016-0639

公告标识 CVE-2016-0264

标题

CVE-2016-0264

描述

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Find out more about CVE-2016-0264 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Important

漏洞的影响

Red Hat Enterprise Linux 6 (java-1.8.0-ibm)

Red Hat Enterprise Linux 7 (java-1.8.0-ibm)

Bugzilla

1331359: CVE-2016-0264 IBM JDK: buffer overflow vulnerability in the IBM JVM

详细信息

https://access.redhat.com/security/cve/cve-2016-0264

公告标识 CVE-2015-8869

标题

CVE-2015-8869

描述

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Find out more about CVE-2015-8869 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Important

漏洞的影响

Red Hat Enterprise Linux 6 ( ocaml)

Red Hat Enterprise Linux 7 ( ocaml)

Bugzilla

1332090: CVE-2015-8869 ocaml: sizes arguments are sign-extended from 32 to 64 bits

详细信息

https://access.redhat.com/security/cve/cve-2015-8869

公告标识 CVE-2016-1541

标题

CVE-2016-1541

描述

Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0 allows remote attackers to execute arbitrary code via crafted entry-size values in a ZIP archive.

Find out more about CVE-2016-1541 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Important

漏洞的影响

Red Hat Enterprise Linux 6 ( libarchive)

Red Hat Enterprise Linux 7 ( libarchive)

Bugzilla

1334211: CVE-2016-1541 libarchive: heap-based buffer overflow due to improper input validation

详细信息

https://access.redhat.com/security/cve/cve-2016-1541

公告标识 CVE-2016-2108

标题

CVE-2016-2108

描述

A flaw was found in the way OpenSSL encoded certain ASN.1 data structures. An attacker could use this flaw to create a specially crafted certificate which, when verified or re-encoded by OpenSSL, could cause it to crash, or execute arbitrary code using the permissions of the user running an application compiled against the OpenSSL library.

Find out more about CVE-2016-2108 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Important

漏洞的影响

Red Hat Enterprise Linux 5 (openssl)

Red Hat Enterprise Linux 6 (openssl)

Red Hat Enterprise Linux 7 (openssl)

Bugzilla

1331402: CVE-2016-2108 openssl: Memory corruption in the ASN.1 encoder

详细信息

https://access.redhat.com/security/cve/cve-2016-2108

公告标识 CVE-2016-3710

标题

CVE-2016-3710

描述

An out-of-bounds read/write access flaw was found in the way QEMU's VGA emulation with VESA BIOS Extensions (VBE) support performed read/write operations using I/O port methods. A privileged guest user could use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process.

Find out more about CVE-2016-3710 from the MITRE CVE dictionary dictionary and NIST NVD.

最高严重等级

Important

漏洞的影响

Red Hat Enterprise Linux 5 (kvm)

Red Hat Enterprise Linux 6 ( qemu-kvm、qemu-kvm-rhev)

Red Hat Enterprise Linux 7 ( qemu-kvm)

Bugzilla

1331401: CVE-2016-3710 qemu: incorrect banked access bounds checking in vga module

详细信息

https://access.redhat.com/security/cve/cve-2016-3710