java-sig-commits September 2017

java-sig-commits@lists.fedoraproject.org

1 participants
290 discussions

[Bug 1444759] New: CVE-2017-3523 mysql-connector-java: Connector/ J unspecified vulnerability (CPU Apr 2017)
by bugzilla＠redhat.com 09 May '18

09 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1444759 Bug ID: 1444759 Summary: CVE-2017-3523 mysql-connector-java: Connector/J unspecified vulnerability (CPU Apr 2017) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, avibelli(a)redhat.com, chazlett(a)redhat.com, coneill(a)redhat.com, databases-maint(a)redhat.com, gsterlin(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jcoleman(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, ldimaggi(a)redhat.com, mmuzila(a)redhat.com, mschorm(a)redhat.com, nwallace(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rwagner(a)redhat.com, tcunning(a)redhat.com, tiwillia(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com, xjakub(a)fi.muni.cz Blocks: 1444415 Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and eariler. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. External References: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html… -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1444406] New: CVE-2017-3586 mysql-connector-java: Connector/ J unspecified vulnerability (CPU Apr 2017)
by bugzilla＠redhat.com 09 May '18

09 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1444406 Bug ID: 1444406 Summary: CVE-2017-3586 mysql-connector-java: Connector/J unspecified vulnerability (CPU Apr 2017) Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, avibelli(a)redhat.com, chazlett(a)redhat.com, coneill(a)redhat.com, databases-maint(a)redhat.com, gsterlin(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jcoleman(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, ldimaggi(a)redhat.com, mmuzila(a)redhat.com, mschorm(a)redhat.com, nwallace(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rwagner(a)redhat.com, tcunning(a)redhat.com, tiwillia(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com, xjakub(a)fi.muni.cz Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. External References: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html… -- You are receiving this mail because: You are on the CC list for the bug.

1 11

[Bug 1444407] New: CVE-2017-3589 mysql-connector-java: Connector/ J unspecified vulnerability (CPU Apr 2017)
by bugzilla＠redhat.com 09 May '18

09 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1444407 Bug ID: 1444407 Summary: CVE-2017-3589 mysql-connector-java: Connector/J unspecified vulnerability (CPU Apr 2017) Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: amaris(a)redhat.com CC: abhgupta(a)redhat.com, aileenc(a)redhat.com, avibelli(a)redhat.com, chazlett(a)redhat.com, coneill(a)redhat.com, databases-maint(a)redhat.com, gsterlin(a)redhat.com, gvarsami(a)redhat.com, hhorak(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jbalunas(a)redhat.com, jcoleman(a)redhat.com, jshepherd(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, ldimaggi(a)redhat.com, mmuzila(a)redhat.com, mschorm(a)redhat.com, nwallace(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rwagner(a)redhat.com, tcunning(a)redhat.com, tiwillia(a)redhat.com, tjay(a)redhat.com, tkirby(a)redhat.com, xjakub(a)fi.muni.cz Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. External References: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html… -- You are receiving this mail because: You are on the CC list for the bug.

1 15

[Bug 1291292] New: CVE-2015-5254 activemq: unsafe deserialization
by Red Hat Bugzilla 09 May '18

09 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1291292 Bug ID: 1291292 Summary: CVE-2015-5254 activemq: unsafe deserialization Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: mprpic(a)redhat.com CC: abhgupta(a)redhat.com, agrimm(a)redhat.com, aileenc(a)redhat.com, ccoleman(a)redhat.com, chazlett(a)redhat.com, dmcphers(a)redhat.com, gvarsami(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jialiu(a)redhat.com, joelsmith(a)redhat.com, jokerman(a)redhat.com, kconner(a)redhat.com, kseifried(a)redhat.com, ldimaggi(a)redhat.com, lmeyer(a)redhat.com, mmccomas(a)redhat.com, nwallace(a)redhat.com, pavelp(a)redhat.com, puntogil(a)libero.it, rwagner(a)redhat.com, soa-p-jira(a)post-office.corp.redhat.com, s(a)shk.io, tcunning(a)redhat.com, tdawson(a)redhat.com, tiwillia(a)redhat.com, tkirby(a)redhat.com JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message transformation. As deserialization of untrusted data can leaed to security flaws as demonstrated in various reports, this leaves the broker vunerable to this attack vector. Additionally, applications that consume ObjectMessage type of messages can be vunerable as they deserlize objects on ObjectMessage.getObject() calls. This issue was fixed upstream in Apache ActiveMQ 5.13.0. Additionally, when using ObjectMessage message type, you need to explicitly list trusted packages. To see how to do that, please take a look at: http://activemq.apache.org/objectmessage.html External References: http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcem… -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=gmTDQZJf60&a=cc_unsubscribe

2 39

[Bug 1418717] New: CVE-2017-2606 jenkins: Internal API allowed access to item names that should not be visible ( SECURITY-380)
by bugzilla＠redhat.com 08 May '18

08 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1418717 Bug ID: 1418717 Summary: CVE-2017-2606 jenkins: Internal API allowed access to item names that should not be visible (SECURITY-380) Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: abhgupta(a)redhat.com, bleanhar(a)redhat.com, ccoleman(a)redhat.com, dedgar(a)redhat.com, dmcphers(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jgoulding(a)redhat.com, jkeck(a)redhat.com, joelsmith(a)redhat.com, kseifried(a)redhat.com, mizdebsk(a)redhat.com, msrb(a)redhat.com, tdawson(a)redhat.com, tiwillia(a)redhat.com The following flaw was found in Jenkins: The method Jenkins#getItems() included a performance optimization that resulted in all items being returned if the Logged in users can do anything authorization strategy was used, and no access was granted to anonymous users (an option added in Jenkins 2.0). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction. External References: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2017… Upstream patch: https://github.com/jenkinsci/jenkins/commit/09cfbc9cd5c9df7c763bc976b7f5c51… -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1493189] New: CVE-2017-14228 nasm: NULL pointer dereference in the paste_tokens function
by bugzilla＠redhat.com 03 May '18

03 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1493189 Bug ID: 1493189 Summary: CVE-2017-14228 nasm: NULL pointer dereference in the paste_tokens function Product: Security Response Component: vulnerability Keywords: Security Severity: low Priority: low Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function paste_tokens() in preproc.c, aka a NULL pointer dereference. It will lead to a denial of service. Upstream issue: https://bugzilla.nasm.us/show_bug.cgi?id=3392423 -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1493190] New: CVE-2017-14228 nasm: NULL pointer dereference in the paste_tokens function [fedora-all]
by bugzilla＠redhat.com 03 May '18

03 May '18

https://bugzilla.redhat.com/show_bug.cgi?id=1493190 Bug ID: 1493190 Summary: CVE-2017-14228 nasm: NULL pointer dereference in the paste_tokens function [fedora-all] Product: Fedora Version: 26 Component: nasm Keywords: Security, SecurityTracking Severity: low Priority: low Assignee: mizdebsk(a)redhat.com Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, mizdebsk(a)redhat.com, msimacek(a)redhat.com This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of fedora-all. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. -- You are receiving this mail because: You are on the CC list for the bug.

1 5

[Bug 1340386] New: CVE-2016-4434 tika: XML External Entity vulnerability
by Red Hat Bugzilla 28 Apr '18

28 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1340386 Bug ID: 1340386 Summary: CVE-2016-4434 tika: XML External Entity vulnerability Product: Security Response Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: anemec(a)redhat.com CC: alazarot(a)redhat.com, aszczucz(a)redhat.com, bdawidow(a)redhat.com, bgollahe(a)redhat.com, bkearney(a)redhat.com, brms-jira(a)redhat.com, chazlett(a)redhat.com, epp-bugs(a)redhat.com, etirelli(a)redhat.com, felias(a)redhat.com, hchiorea(a)redhat.com, hfnukal(a)redhat.com, java-sig-commits(a)lists.fedoraproject.org, jcoleman(a)redhat.com, jolee(a)redhat.com, jpallich(a)redhat.com, kanderso(a)redhat.com, lpetrovi(a)redhat.com, mbaluch(a)redhat.com, meissner(a)suse.de, mweiler(a)redhat.com, mwinkler(a)redhat.com, nwallace(a)redhat.com, ohudlick(a)redhat.com, pavelp(a)redhat.com, puntogil(a)libero.it, rrajasek(a)redhat.com, rzhang(a)redhat.com, rzima(a)redhat.com, taw(a)redhat.com, theute(a)redhat.com, thomas(a)suse.de, tkasparek(a)redhat.com, tkirby(a)redhat.com, tlestach(a)redhat.com, vhalbert(a)redhat.com Apache Tika parses XML within numerous file formats. In some instances, such as spreadsheets in OOXML files, XMP in PDF, and other file formats, the initialization of the XML parser or the choice of handlers did not protect against XML External Entity (XXE) vulnerabilities. References: http://seclists.org/oss-sec/2016/q2/413 -- You are receiving this mail because: You are on the CC list for the bug.

2 28

[Bug 1340387] New: CVE-2016-4434 tika: XML External Entity vulnerability [ fedora-all]
by Red Hat Bugzilla 28 Apr '18

28 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1340387 Bug ID: 1340387 Summary: CVE-2016-4434 tika: XML External Entity vulnerability [fedora-all] Product: Fedora Version: 23 Component: tika Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: puntogil(a)libero.it Reporter: anemec(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Blocks: 1340386 (CVE-2016-4434) This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1340386 [Bug 1340386] CVE-2016-4434 tika: XML External Entity vulnerability -- You are receiving this mail because: You are on the CC list for the bug.

2 22

[Bug 1394157] New: CVE-2016-6809 tika: Native deserialization of Java objects in matlab files [fedora-all]
by Red Hat Bugzilla 28 Apr '18

28 Apr '18

https://bugzilla.redhat.com/show_bug.cgi?id=1394157 Bug ID: 1394157 Summary: CVE-2016-6809 tika: Native deserialization of Java objects in matlab files [fedora-all] Product: Fedora Version: 24 Component: tika Keywords: Security, SecurityTracking Severity: medium Priority: medium Assignee: puntogil(a)libero.it Reporter: amaris(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: java-sig-commits(a)lists.fedoraproject.org, puntogil(a)libero.it Blocks: 1394156 (CVE-2016-6809) This is an automatically created tracking bug! It was created to ensure that one or more security vulnerabilities are fixed in affected versions of Fedora. For comments that are specific to the vulnerability please use bugs filed against the "Security Response" product referenced in the "Blocks" field. For more information see: http://fedoraproject.org/wiki/Security/TrackingBugs When submitting as an update, use the fedpkg template provided in the next comment(s). This will include the bug IDs of this tracking bug as well as the relevant top-level CVE bugs. Please also mention the CVE IDs being fixed in the RPM changelog and the fedpkg commit message. NOTE: this issue affects multiple supported versions of Fedora. While only one tracking bug has been filed, please correct all affected versions at the same time. If you need to fix the versions independent of each other, you may clone this bug as appropriate. [bug automatically created by: add-tracking-bugs] Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=1394156 [Bug 1394156] CVE-2016-6809 tika: Native deserialization of Java objects in matlab files -- You are receiving this mail because: You are on the CC list for the bug.

2 10

← Newer
1
...
10
11
12
13
14
15
16
...
29
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

java-sig-commits September 2017