ALT-BU-2016-3131-1
Branch c7 update bulletin.
Closed vulnerabilities
Modified: 2016-11-28
BDU:2014-00019
Уязвимость программного обеспечения управления виртуальной инфраструктурой VMware vCenter Server, позволяющая злоумышленнику препятствовать входу других пользователей в систему
Modified: 2024-07-05
BDU:2015-04127
Уязвимости операционной системы Debian GNU/Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
Modified: 2016-11-28
BDU:2015-06145
Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
Modified: 2016-11-28
BDU:2015-06146
Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
Modified: 2016-11-28
BDU:2015-06147
Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
Modified: 2016-11-28
BDU:2015-06148
Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
Modified: 2016-11-28
BDU:2015-06149
Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
Modified: 2016-11-28
BDU:2015-06150
Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
Modified: 2016-11-28
BDU:2015-06151
Уязвимости операционной системы Red Hat Enterprise Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность и целостность защищаемой информации
Modified: 2021-03-23
BDU:2015-09678
Уязвимости операционной системы Gentoo Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации
Modified: 2025-04-11
CVE-2010-5107
The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.
- http://marc.info/?l=bugtraq&m=144050155601375&w=2
- http://rhn.redhat.com/errata/RHSA-2013-1591.html
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/servconf.c?r1=1.234#rev1.234
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config.5?r1=1.156#rev1.156
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config?r1=1.89#rev1.89
- http://www.openwall.com/lists/oss-security/2013/02/07/3
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/58162
- https://bugzilla.redhat.com/show_bug.cgi?id=908707
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19515
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19595
- http://marc.info/?l=bugtraq&m=144050155601375&w=2
- http://rhn.redhat.com/errata/RHSA-2013-1591.html
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/servconf.c?r1=1.234#rev1.234
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config.5?r1=1.156#rev1.156
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/sshd_config?r1=1.89#rev1.89
- http://www.openwall.com/lists/oss-security/2013/02/07/3
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/58162
- https://bugzilla.redhat.com/show_bug.cgi?id=908707
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19515
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19595
Modified: 2025-04-11
CVE-2014-1692
The hash_buffer function in schnorr.c in OpenSSH through 6.4, when Makefile.inc is modified to enable the J-PAKE protocol, does not initialize certain data structures, which might allow remote attackers to cause a denial of service (memory corruption) or have unspecified other impact via vectors that trigger an error condition.
- http://marc.info/?l=bugtraq&m=141576985122836&w=2
- http://marc.info/?l=bugtraq&m=144050155601375&w=2
- http://openwall.com/lists/oss-security/2014/01/29/10
- http://openwall.com/lists/oss-security/2014/01/29/2
- http://osvdb.org/102611
- http://secunia.com/advisories/60184
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1020637
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9%3Br2=1.10%3Bf=h
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10
- http://www.securityfocus.com/bid/65230
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90819
- http://marc.info/?l=bugtraq&m=141576985122836&w=2
- http://marc.info/?l=bugtraq&m=144050155601375&w=2
- http://openwall.com/lists/oss-security/2014/01/29/10
- http://openwall.com/lists/oss-security/2014/01/29/2
- http://osvdb.org/102611
- http://secunia.com/advisories/60184
- http://www-01.ibm.com/support/docview.wss?uid=isg3T1020637
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/Attic/schnorr.c.diff?r1=1.9%3Br2=1.10%3Bf=h
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/schnorr.c#rev1.10
- http://www.securityfocus.com/bid/65230
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90819
Modified: 2025-04-12
CVE-2014-2532
sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.
- http://advisories.mageia.org/MGASA-2014-0143.html
- http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc
- http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html
- http://marc.info/?l=bugtraq&m=141576985122836&w=2
- http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2
- http://rhn.redhat.com/errata/RHSA-2014-1552.html
- http://secunia.com/advisories/57488
- http://secunia.com/advisories/57574
- http://secunia.com/advisories/59313
- http://secunia.com/advisories/59855
- http://www.debian.org/security/2014/dsa-2894
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:068
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:095
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.securityfocus.com/bid/66355
- http://www.securitytracker.com/id/1029925
- http://www.ubuntu.com/usn/USN-2155-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91986
- https://support.apple.com/HT205267
- http://advisories.mageia.org/MGASA-2014-0143.html
- http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc
- http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html
- http://marc.info/?l=bugtraq&m=141576985122836&w=2
- http://marc.info/?l=openbsd-security-announce&m=139492048027313&w=2
- http://rhn.redhat.com/errata/RHSA-2014-1552.html
- http://secunia.com/advisories/57488
- http://secunia.com/advisories/57574
- http://secunia.com/advisories/59313
- http://secunia.com/advisories/59855
- http://www.debian.org/security/2014/dsa-2894
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:068
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:095
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.securityfocus.com/bid/66355
- http://www.securitytracker.com/id/1029925
- http://www.ubuntu.com/usn/USN-2155-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91986
- https://support.apple.com/HT205267
Modified: 2025-04-12
CVE-2014-2653
The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.
- http://advisories.mageia.org/MGASA-2014-0166.html
- http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html
- http://marc.info/?l=bugtraq&m=141576985122836&w=2
- http://openwall.com/lists/oss-security/2014/03/26/7
- http://rhn.redhat.com/errata/RHSA-2014-1552.html
- http://rhn.redhat.com/errata/RHSA-2015-0425.html
- http://secunia.com/advisories/59855
- http://www.debian.org/security/2014/dsa-2894
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:068
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:095
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/66459
- http://www.ubuntu.com/usn/USN-2164-1
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513
- http://advisories.mageia.org/MGASA-2014-0166.html
- http://aix.software.ibm.com/aix/efixes/security/openssh_advisory4.asc
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134026.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133537.html
- http://marc.info/?l=bugtraq&m=141576985122836&w=2
- http://openwall.com/lists/oss-security/2014/03/26/7
- http://rhn.redhat.com/errata/RHSA-2014-1552.html
- http://rhn.redhat.com/errata/RHSA-2015-0425.html
- http://secunia.com/advisories/59855
- http://www.debian.org/security/2014/dsa-2894
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:068
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:095
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.securityfocus.com/bid/66459
- http://www.ubuntu.com/usn/USN-2164-1
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513