【CESA-2017:0920】最新バージョンの389-ds-baseが、Red Hat Enterprise Linux 7 からご利用いただけるようになりました

CESA-2017:0920

最新バージョンの389-ds-baseが、Red Hat Enterprise Linux 7 からご利用いただけるようになりました。

Red Hat製品のセキュリティ及び品質は大変ご好評いただいております。

今回の最新バージョンVulnerability Scoring System(CVSS)は、各セキュリティホールへのアクセス安全面を厳重にクラス分けし、確実・安全に詳細レポートをお送りいたします。参照セクションのリンクをクリックしてください。

Security Fix(es):

* An invalid pointer dereference flaw was found in the way 389-ds-base handled
LDAP bind requests. A remote unauthenticated attacker could use this flaw to
make ns-slapd crash via a specially crafted LDAP bind request, resulting in
denial of service. (CVE-2017-2668)

Red Hat would like to thank Joachim Jabs (F24) for reporting this issue.

Bug Fix(es):

* Previously, when adding a filtered role definition that uses the “nsrole”
virtual attribute in the filter, Directory Server terminated unexpectedly. A
patch has been applied, and now the roles plug-in ignores all virtual
attributes. As a result, an error message is logged when an invalid filter is
used. Additionally, the role is deactivated and Directory Server no longer
fails. (BZ#1429498)

* In a replication topology, Directory Server incorrectly calculated the size of
string format entries when a lot of entries were deleted. The calculated size of
entries was smaller than the actual required size. Consequently, Directory
Server allocated insufficient memory and terminated unexpectedly when the data
was written to it. With this update, the size of string format entries is now
calculated correctly in the described situation and Directory Server no longer
terminates unexpectedly. (BZ#1429495)

Bugs Fixed

1429495 – ns-slapd dies under heavy load
1429498 – A filtered nsrole that specifies an empty nsrole in its nsRoleFilter will result in a segfault.
1436575 – CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages

【CESA-2017:0914】最新バージョンのlibreofficeが、Red Hat Enterprise Linux 7 からご利用いただけるようになりました

CESA-2017:0914

最新バージョンのlibreofficeが、Red Hat Enterprise Linux 7 からご利用いただけるようになりました。

Red Hat製品のセキュリティ及び品質は大変ご好評いただいております。

今回の最新バージョンVulnerability Scoring System(CVSS)は、各セキュリティホールへのアクセス安全面を厳重にクラス分けし、確実・安全に詳細レポートをお送りいたします。参照セクションのリンクをクリックしてください。

LibreOffice is an open source, community-developed office productivity suite. It
includes key desktop applications, such as a word processor, a spreadsheet, a
presentation manager, a formula editor, and a drawing program. LibreOffice
replaces OpenOffice and provides a similar but enhanced and extended office
suite.

Security Fix(es):

* It was found that LibreOffice disclosed contents of a file specified in an
embedded object’s preview. An attacker could potentially use this flaw to expose
details of a system running LibreOffice as an online service via a crafted
document. (CVE-2017-3157)

Bug Fix(es):

* Previously, an improper resource management caused the LibreOffice Calc
spreadsheet application to terminate unexpectedly after closing a dialog window
with accessibility support enabled. The resource management has been improved,
and the described problem no longer occurs. (BZ#1425536)

* Previously, when an incorrect password was entered for a password protected
document, the document has been considered as valid and a fallback attempt to
open it as plain text has been made. As a consequence, it could appear that the
document succesfully loaded, while just the encrypted unreadable content was
shown. A fix has been made to terminate import attempts after entering incorrect
password, and now nothing is loaded when a wrong password is entered.
(BZ#1426348)

* Previously, an improper resource management caused the LibreOffice Calc
spreadsheet application to terminate unexpectedly during exit, after the Text
Import dialog for CSV (Comma-separated Value) files closed, when accessibility
support was enabled. The resource management has been improved, and the
described problem no longer occurs. (BZ#1425535)

Bugs Fixed

1425536 – [fix available] Crash in calc after closing dialog box with a11y enabled
1425844 – CVE-2017-3157 libreoffice: Arbitrary file disclosure in Calc and Writer
1426348 – [fix available] Password Protected (Encrypted) files opening as plain text after cancelling password dialog

【CESA-2017:0892】最新バージョンのkernelが、Red Hat Enterprise Linux 6 からご利用いただけるようになりました

CESA-2017:0892

最新バージョンのkernelが、Red Hat Enterprise Linux 6 からご利用いただけるようになりました。

Red Hat製品のセキュリティ及び品質は大変ご好評いただいております。

今回の最新バージョンVulnerability Scoring System(CVSS)は、各セキュリティホールへのアクセス安全面を厳重にクラス分けし、確実・安全に詳細レポートをお送りいたします。参照セクションのリンクをクリックしてください。

The kernel packages contain the Linux kernel, the core of any Linux operating
system.

Security Fix(es):

* A race condition flaw was found in the N_HLDC Linux kernel driver when
accessing n_hdlc.tbuf list that can lead to double free. A local, unprivileged
user able to set the HDLC line discipline on the tty device could use this flaw
to increase their privileges on the system. (CVE-2017-2636, Important)

* A flaw was found in the Linux kernel’s implementation of seq_file where a
local attacker could manipulate memory in the put() function pointer. This could
lead to memory corruption and possible privileged escalation. (CVE-2016-7910,
Moderate)

Red Hat would like to thank Alexander Popov for reporting CVE-2017-2636.

Bug Fix(es):

* Previously, Chelsio firmware included an incorrectly-formatted firmware bin
file. As a consequence, the firmware could not be flashed. This update provides
a firmware bin file that is formatted correctly. As a result, Chelsio firmware
can now be flashed successfully. (BZ#1433865)

* When multiple simultaneous processes attempted to read from the /proc/stat
file, spinlock overhead was generated on Non-Uniform Memory Access (NUMA)
systems. Consequently, a large amount of CPU was consumed. With this update, the
underlying source code has been fixed to avoid taking spinlock when the
interrupt line does not exist. As a result, the spinlock overhead is now
generated less often, and multiple simultaneous processes can now read
/proc/stat without consuming a large amount of CPU. (BZ#1428106)

Bugs Fixed

1399727 – CVE-2016-7910 kernel: Use after free in seq file
1428319 – CVE-2017-2636 kernel: Race condition access to n_hdlc.tbuf causes double free in n_hdlc_release()

【CESA-2017:0893】最新バージョンの389-ds-baseが、Red Hat Enterprise Linux 6 からご利用いただけるようになりました

CESA-2017:0893

最新バージョンの389-ds-baseが、Red Hat Enterprise Linux 6 からご利用いただけるようになりました。

Red Hat製品のセキュリティ及び品質は大変ご好評いただいております。

今回の最新バージョンVulnerability Scoring System(CVSS)は、各セキュリティホールへのアクセス安全面を厳重にクラス分けし、確実・安全に詳細レポートをお送りいたします。参照セクションのリンクをクリックしてください。

389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base
packages include the Lightweight Directory Access Protocol (LDAP) server and
command-line utilities for server administration.

Security Fix(es):

* An invalid pointer dereference flaw was found in the way 389-ds-base handled
LDAP bind requests. A remote unauthenticated attacker could use this flaw to
make ns-slapd crash via a specially crafted LDAP bind request, resulting in
denial of service. (CVE-2017-2668)

Red Hat would like to thank Joachim Jabs (F24) for reporting this issue.

Bug Fix(es):

* Previously, the “deref” plug-in failed to dereference attributes that use
distinguished name (DN) syntax, such as “uniqueMember”. With this patch, the
“deref” plug-in can dereference such attributes and additionally “Name and
Optional UID” syntax. As a result, the “deref” plug-in now supports any syntax.
(BZ#1435365)

Bugs Fixed

1435365 – Unable to dereference unqiemember attribute because it is dn [#UID] not dn syntax
1436575 – CVE-2017-2668 389-ds-base: Remote crash via crafted LDAP messages

【CESA-2017:1204】最新バージョンの java-1.7.0-openjdk が、Red Hat Enterprise Linux 6/7 からご利用いただけるようになりました

CESA-2017:1204

最新バージョンの java-1.7.0-openjdk が、Red Hat Enterprise Linux 6/7 からご利用いただけるようになりました。

Red Hat製品のセキュリティ及び品質は大変ご好評いただいております。

今回の最新バージョンVulnerability Scoring System(CVSS)は、各セキュリティホールへのアクセス安全面を厳重にクラス分けし、確実・安全に詳細レポートをお送りいたします。参照セクションのリンクをクリックしてください。

The java-1.7.0-openjdk packages provide the OpenJDK 7 Java Runtime Environment
and the OpenJDK 7 Java Software Development Kit.

Security Fix(es):

* An untrusted library search path flaw was found in the JCE component of
OpenJDK. A local attacker could possibly use this flaw to cause a Java
application using JCE to load an attacker-controlled library and hence escalate
their privileges. (CVE-2017-3511)

* It was found that the JAXP component of OpenJDK failed to correctly enforce
parse tree size limits when parsing XML document. An attacker able to make a
Java application parse a specially crafted XML document could use this flaw to
make it consume an excessive amount of CPU and memory. (CVE-2017-3526)

* It was discovered that the HTTP client implementation in the Networking
component of OpenJDK could cache and re-use an NTLM authenticated connection in
a different security context. A remote attacker could possibly use this flaw to
make a Java application perform HTTP requests authenticated with credentials of
a different user. (CVE-2017-3509)

Note: This update adds support for the “jdk.ntlm.cache” system property which,
when set to false, prevents caching of NTLM connections and authentications and
hence prevents this issue. However, caching remains enabled by default.

* It was discovered that the Security component of OpenJDK did not allow users
to restrict the set of algorithms allowed for Jar integrity verification. This
flaw could allow an attacker to modify content of the Jar file that used weak
signing key or hash algorithm. (CVE-2017-3539)

Note: This updates extends the fix for CVE-2016-5542 released as part of the
RHSA-2016:2658 erratum to no longer allow the MD5 hash algorithm during the Jar
integrity verification by adding it to the jdk.jar.disabledAlgorithms security
property.

* Newline injection flaws were discovered in FTP and SMTP client implementations
in the Networking component in OpenJDK. A remote attacker could possibly use
these flaws to manipulate FTP or SMTP connections established by a Java
application. (CVE-2017-3533, CVE-2017-3544)

Bugs Fixed

1443007 – CVE-2017-3511 OpenJDK: untrusted extension directories search path in Launcher (JCE, 8163528)
1443052 – CVE-2017-3509 OpenJDK: improper re-use of NTLM authenticated connections (Networking, 8163520)
1443068 – CVE-2017-3544 OpenJDK: newline injection in the SMTP client (Networking, 8171533)
1443083 – CVE-2017-3533 OpenJDK: newline injection in the FTP client (Networking, 8170222)
1443097 – CVE-2017-3539 OpenJDK: MD5 allowed for jar verification (Security, 8171121)
1443252 – CVE-2017-3526 OpenJDK: incomplete XML parse tree size enforcement (JAXP, 8169011)